Contents
File Threat Protection task (File_Threat_Protection, ID:1)
File Threat Protection prevents infection of the device's file system. The File Threat Protection task is created automatically with default settings when you install Kaspersky Embedded Systems Security application on your device. By default, the File Threat Protection task starts automatically when the application starts. The task resides in the device's RAM and scans all opened, saved, and active files.
Administrator role privileges are required to start and stop the File Threat Protection task from the command line.
Upon detecting malware, Kaspersky Embedded Systems Security may remove the infected file and terminate the malware process started from this file.
When the File Threat Protection task is running, the application scans all namespaces and containers in all supported operating systems if NamespaceMonitoring is set to Yes in the general application settings. Additionally, for Astra Linux, a custom virus scan task (Scan_File) allows files from other namespaces to be scanned (as part of a mandatory scan). You can separately configure general scan settings for containers and namespaces.
The application does not scan namespaces and containers unless components for working with containers and namespaces are installed in the operating system. Moreover, when viewing application information in the Container monitoring row, "The task is available and not running" is displayed.
File Threat Protection user tasks cannot be created. You can modify the settings of the default File Threat Protection task.
If InterceptorProtectionMode is set to Notify in the general application settings, then when infected objects are detected, the application does not perform the actions specified in the FirstAction and SecondAction settings of the File Threat Protection task.
Special considerations for scanning symbolic links and hard links
Kaspersky Embedded Systems Security lets you scan symbolic links and hard links to files.
Scanning symbolic links
The application scans symbolic links only if the file referenced by the symbolic link is within the protection scope of the File Threat Protection task.
If the file referenced by the symbolic link is not within the File Threat Protection task, the application does not scan this file. However, if the file contains malicious code, the security of the device is at risk.
Scanning hard links
When processing a file with more than one hard link, the application chooses an action depending on the specified action on objects:
- If the Perform recommended action option is selected, the application automatically selects and performs an action on an object based on data about the danger level of the threat detected in the object and the possibility of disinfecting it.
- If the Remove action is selected, the application removes the hard link being processed. The remaining hard links to this file will not be processed.
- If the Disinfect action is selected, the application disinfects the source file. If disinfection fails, the application deletes the hard link and creates in its place a copy of the source file with the name of the deleted hard link.
When you restore a file with a hard link from the Storage, the application creates a copy of the source file with the name of the hard link that was moved to the Storage. Connections with the remaining hard links to the source file will not be restored.
Page topFile Threat Protection task settings
The table describes all available values and default values of all the settings that you can specify for the File Threat Protection task.
File Threat Protection task settings
Setting |
Description |
Values |
|
|---|---|---|---|
|
Enables scanning of archives (including SFX self-extracting archives). The application scans the following archives: .zip; .7z*; .7-z; .rar; .iso; .cab; .jar; .bz; .bz2; .tbz; .tbz2; .gz; .tgz; .arj. The list of supported archive formats depends on the application databases being used. |
|
|
|
Enables scanning of self-extracting archives only (archives that contain an executable extraction module). |
|
|
|
Enables scanning email databases of Microsoft Outlook, Outlook Express, The Bat, and other mail clients. |
|
|
|
Enables scanning of plain text email messages. |
|
|
|
Temporary exclusion of files in text format from scans. If the value of this setting is |
|
|
|
Maximum size of an object to be scanned (in megabytes). If the object to be scanned is larger than the specified value, the application skips this object. |
0–999999 0 — The application scans objects of any size. Default value: 0. |
|
|
Maximum object scan duration (in seconds). The application stops scanning the object if it takes longer than the time specified by this setting. |
0–9999 0 — The object scan time is unlimited. Default value: 60. |
|
|
Selection of the first action to be performed by the application on the infected objects. Before performing the action specified by you on an object, Kaspersky Embedded Systems Security blocks access to the object by applications that attempt to access it.
If |
Default value: |
|
|
Selection of the second action to be performed by the application on the infected objects. The application performs the second action if the first action fails. If InterceptorProtectionMode is set to |
The possible values of the If Default value: |
|
|
Enables exclusion of the objects specified by the |
|
|
|
Excludes objects from being scanned by name or mask. You can use this setting to exclude an individual file from the specified scan scope by name or exclude several files at once using masks in the shell format. |
The default value is not defined.
|
|
|
Enables exclusion of objects containing the threats specified by the |
|
|
|
Excludes objects from scans by the name of the threats detected in them. Before specifying a value for this setting, make sure that the In order to exclude an object from scans, specify the full name of the threat detected in this object – the string containing the application's decision that the object is infected. For example, you may be using a utility to collect information about your network. To keep the application from blocking it, add the full name of the threat contained in it to the list of threats excluded from scans. You can find the full name of the threat detected in an object in the application log or on the Virus Encyclopedia website. |
The setting value is case-sensitive. The default value is not defined.
|
|
|
Enables logging of information about scanned objects that the application reports as not being infected. You can enable this setting, for example, to make sure that a particular object was scanned by the application. |
|
|
|
Enables logging of information about scanned objects that are part of compound objects. You can enable this setting, for example, to make sure that an object within an archive has been scanned by the application. |
|
|
|
Enables logging of information about objects that have not been processed for some reason. |
|
|
|
Enables heuristic analysis. Heuristic analysis helps the application to detect threats even before they become known to virus analysts. |
|
|
|
Specifies the heuristic analysis level. The heuristic analysis level sets the balance between the thoroughness of searches for threats, the load on the operating system's resources, and the scan duration. The higher the heuristic analysis level, the more resources and time are required for scanning. |
|
|
|
Enables usage of the iChecker technology. |
|
|
|
File Threat Protection task operation mode. The |
|
|
The [ScanScope.item_#] section contains the following settings: |
|||
|
Description of the scan scope, which contains additional information about the scan scope. The maximum length of the string specified using this setting is 4096 characters. |
Default value:
|
|
|
Enables scans of the specified scope. To run the task, enable scans of at least one scope. |
|
|
|
Scan scope limitation. With this scan scope, the application only scans files that are specified using masks in the shell format. If this setting is not specified, the application scans all the objects in the scan scope. You can specify several values for this setting. |
The default value is
|
|
|
Path to the directory with objects to be scanned.
|
|
|
The [ExcludedFromScanScope.item_#] section contains the following settings: |
|||
|
Description of the scan exclusion scope, which contains additional information about the exclusion scope. |
The default value is not defined. |
|
|
Excludes the specified scope from scans. |
|
|
|
Limitation of scan exclusion scope. In the exclusion scope, the application excludes from scans only files that are specified using masks in the shell format. If this setting is not specified, the application does not scan any of the objects within the exclusion scope. You can specify several values for this setting. |
Default value: |
|
|
Path to the directory with objects to be excluded.
|
In order to optimize the operation of scan tasks, it is recommended to add the path with snapshots mounted by the system in the read-only mode to the exclusions for the systems with the btrfs file system and enabled active snapshots. For example, for the systems based on SUSE/OpenSUSE, you can add the following exclusion
Remote directories are excluded from scanning by the application only if they were mounted before the task was started. Remote directories mounted after the task is started are not excluded from scanning. |
|
The [ExcludedForProgram.item_#] section contains the following settings: |
|||
|
Path to excluded process. |
|
|
|
Exclude child processes of the excluded process specified by the |
|
|
|
Description of the process exclusion scope. |
Default value: |
|
|
Excludes the specified scope from scans. |
|
|
|
Limitation of the process exclusion scope. In the process exclusion scope, the application excludes from scans only the files that are specified using masks in the shell format. If this setting is not specified, the application excludes from scans all the objects within the process exclusion scope. You can specify several values for this setting. |
Default value: |
|
|
Path to a directory with files that are modified by the process.
|
|
|
Specifying an exclusion scope
You can specify an exclusion scope for the File Threat Protection task. Files in the exclusion scope are excluded from protection scopes.
To create an exclusion scope:
- Save the File Threat Protection task settings to a file using the following command:
kess-control --get-settings 1 --file <full path to the configuration file> - Add the
[ExcludedFromScanScope.item_#]section to the created file. This section contains the following settings:AreaDesc– a description of the exclusion scope, which contains additional information about the exclusion scope.Path– the path to the files or directories to be excluded from the protection scope.AreaMask.item_#– file name mask for the files to be excluded from the protection scope.Example:
[ExcludedFromScanScope.item_0000]AreaDesc=UseScanArea=YesPath=/tmp/notcheckedAreaMask.item_0000=*
- Import settings from the configuration file to the File Threat Protection task by using the following command:
kess-control --set-settings 1 --file <full path to the configuration file>
You can also manage exclusion scopes from the command line.
Page topOptimizing network directory scanning
To optimize the File Threat Protection task, you can exclude from scans any files being copied from network directories. Files are scanned only after the process of copying to a local directory is finished. To exclude files located in network directories from scans, configure scan exclusion for the utility used to copy files from network directories (for example, for the cp utility).
To configure exclusion of network directories from scans:
- Save the File Threat Protection task settings to a file using the following command:
kess-control --get-settings 1 --file <full path to the configuration file> - Add the
[ExcludedForProgram.item_#]section to the created file. This section contains the following settings:ProgramPath– path to the process to be excluded or to the directory with the processes to be excluded.ApplyToDescendantsparameter indicates whether the scan should exclude child processes of the excluded process specified by theProgramPathparameter (possible values:YesorNo).AreaDesc– a description of the process exclusion scope, which contains additional information about the exclusion scope.UseExcludedForProgramparameter indicates whether the scan task should exclude the specified scope (possible values:YesorNo).Path– path to the files or directory with files modified by the process.AreaMask.item_#is the file name mask for the files to be excluded from the scan. You can also specify the full path to the file.Example:
[ExcludedForProgram.item_0000]ProgramPath=/usr/bin/cpApplyToDescendants=NoAreaDesc=UseExcludedForProgram=YesPath=AllRemoteMountedAreaMask.item_0000=*
- Import settings from the configuration file to the File Threat Protection task by using the following command:
kess-control --set-settings 1 --file <full path to the configuration file>
The application does not scan the files in network directories, but the cp command itself (for the example given above) and local files are scanned.