On-Demand Archive File Scanning File Types

[shocko]

The option to scan or not to scan  'Compressed Archive Files. refers to which archive types? Is there a list of exactly what this covers i..e .CAB, .JAR, .RAR etc. ?

[ryadav1 · Accepted solution]

This generally refers to all the archived files (compressed) files, including 7z,ACE, ARC, ARJ, cfs, .RAR ,rzip, sit sit,Xar,zoo,ZIP,ZPAQ,CAB.

Also the archiving used in Software packaging and distribution

Best practice: Because scanning compressed archive files can negatively affect system performance, deselect this option to improve system performance.

Thanks .

[shocko]

Thanks for taking time to reply. Does that also include .ISO files for example? I guess I should really take this to a test machine and evaluate 😊

[ryadav1]

Yes , It does include .ISO file as well .

Thank you 

[johma]

You can also locate the file CSSCAN.EXE in the VirusScan Enterprise\Core directory.

If you open an Admin CMD prompt you can use the following command..

CSSCAN.EXE /extlist

Which will provide you with a list of extensions grouped by type. "compressed files" is a subset listed there. 

[shocko]

That's great info! Thanks!

[User16096767]

Any documentation that indicate negative impact if archive files scanning enabled? I need to show it to the customer.

[Tares1]

Hello @User16096767 ,

I responded to that question of yours on the other topic.

The KB How to improve performance with Endpoint Security:

https://kc.mcafee.com/corporate/index?page=content&id=KB88205

has the recommendation to no enable archive scanning.

and the KB Slow performance with Java-based applications:

https://kb.mcafee.com/corporate/index?page=content&id=KB58727

states the performance impact of large archive files being scanned.

Hope this helps.