Malware Treatment

The malware treatment options let you choose what happens to malware that is detected on a client computer.

Double-click an Action to edit the Properties.

You can change the settings for malware and riskware. The options are:

• Malware Treatment - Malware is software that is definitely dangerous.

  • Quarantine file if cure failed - If Endpoint Security cannot repair the file, it is deleted and put in a secure location from where it can be restored if necessary.

  • Delete file if cure failed - If Endpoint Security cannot repair the file, it is deleted.

• Riskware Treatment - Riskware is legal software that might be dangerous.

  • Treat as malware - Use the option selected for Malware.

  • Skip file - Do not treat riskware files.

Excluding Infections by Name

You can create a list of infections (by name) that will get different treatment than the selections above. Use an exception to allow a file that was detected as a threat in your organization, but was a false positive or riskware (software that can have both legitimate and malicious usage). For example, RAdmin might be detected as a threat but you want to allow it.

Contextual scans are done even if the file is in the Exclude Infections by Name list. A contextual scan is a scan that the user runs from the right-click menu of the file that the user wants to scan: The user does a right-click on a file and selects Scan with Check Point Anti-Malware.

You can get the virus names of threats detected in your organization from one of these sources:

• In SmartEndpoint A Check Point GUI application which connects to the Endpoint Security Management Server, to manage your Endpoint Security environment - to deploy, monitor and configure Endpoint Security clients and policies. > Users and Computers, select a computer and click Anti-Malware. The list of infections for that computer show.

• The Top Infections report.

• Anti-Malware A component on Endpoint Security Windows clients. This component protects clients from known and unknown viruses, worms, Trojan horses, adware, and keystroke loggers. infection logs in SmartLog

To create a list of exceptions for malware treatment:

1. In the Edit Properties - Malware Treatment window, click Exclude infections by name.

2. Click Add to add infections to the list.

3. Enter the name of the infection.

4. Click OK.

5. Click OK.