Malware Treatment

The malware treatment options let you choose what happens to malware that is detected on a client computer. The options are:

• Quarantine detected malware - If Endpoint Security cannot repair the file, it is deleted and put in a secure location from where it can be restored if necessary.
• Delete detected malware - If Endpoint Security cannot repair the file, it is deleted.

Double-click an Action to edit the Properties.

You can change the settings for malware and riskware. The options are:

• Malware Treatment - Malware is software that is definitely dangerous.
  • Quarantine file if cure failed - If Endpoint Security cannot repair the file, it is deleted and put in a secure location from where it can be restored if necessary.
  • Delete file if cure failed - If Endpoint Security cannot repair the file, it is deleted.
• Riskware Treatment - Riskware is legal software that might be dangerous.
  • Treat as malware - Use the option selected for Malware.
  • Skip file - Do not treat riskware files.

Exceptions

You can create a list of infections (by name) that will get different treatment than the selections above. Use an exception to allow a file that was detected as a threat in your organization, but was a false positive or riskware (software that can have both legitimate and malicious usage). For example, RAdmin might be detected as a threat but you want to allow it.

You can get the virus names of threats detected in your organization from one of these sources:

• In SmartEndpoint > Users and Computers, select a computer and click Anti-Malware. The list of infections for that computer show.
• The Top Infections report.
• Anti-Malware infection logs in Smart Log

To create a list of exceptions for malware treatment:

1. In the Edit Properties - Malware Treatment window, click Override treatment for specific infections.
2. Click Add to add infections to the list.
3. Enter the name of the infection.
4. Click OK.
5. Click OK.