There are various configuration settings that you can adjust for the Microsoft Forefront Protection 2010 for SharePoint (FPSP) realtime scan in order to meet the needs of your environment. These include selecting the number of scan engines to use for each scan, setting the action to take when malware is detected, and specifying whether or not to quarantine detected files.

To configure the realtime scan

  1. In the Forefront Protection 2010 for SharePoint Administrator Console, click Policy Management and in Antimalware, click Realtime.

  2. In the Antimalware - Realtime pane, configure the following settings:

    1. Enable realtime antivirus scan—Select or clear this check box to enable or disable the realtime scan. This setting is enabled by default.

    2. Enable realtime antispyware scan—Select or clear this check box to enable or disable the realtime antispyware scan. This setting is enabled by default.

  3. In the Antimalware - Realtime pane, in the Engines and performance section, configure the number of scan engines that should be used for this scan. For more information, see Configuring the number of scan engines used for each scan.

  4. In the Antimalware - Realtime pane, in the Scan actions section, configure the following settings:

    1. Action—Select the action that you want performed when a virus or spyware is detected. For more information, see Configuring the action when malware is detected.

    2. Quarantine files—Using the drop-down list, enable (by selecting Yes) or disable (by selecting No) saving infected files detected by the file-scanning engines. Quarantining is enabled by default. Enabling quarantine causes deleted files to be storedin a secure location, from which you can recover them. For more information about quarantine, see Viewing and managing quarantine.

    3. Edit Malware Deletion text—You can specify deletion text, which is used to replace the contents of an infected file during a delete operation. The default deletion text informs you that an infected file was removed, along with the name of the file and the name of the malware found. To change the default text, click Edit Deletion Text, make the modifications to the deletion text in the Edit Malware Deletion Text dialog box, and then click OK to return to the Antimalware - Realtime pane

      Note:
      FPSP provides keywords that can be used in the deletion text field to obtain information from the message in which the infection was found. To use them, in the Malware Deletion Text dialog box, right click, select Insert Field, and then select the desired macro. For more information about this feature, see Keyword substitution macros.

  5. In the Antimalware - Realtime pane, in the SharePoint and WSS antivirus settings section, you can optionally modify several other settings via SharePoint Central Administration. These include scanning documents when they are uploaded or downloaded, allowing users to download infected documents, and the time-out value for the realtime scan. For more information, see Configuring other settings via SharePoint Central Administration.

  6. Click Save.

  7. Optionally, configure the settings to tell FPSP what to do if a scan encounters a corrupted compressed file. For more information, see Deleting corrupted compressed files.

  8. Optionally, configure the settings to tell FPSP what to do if certain threshold levels are exceeded. For more information, see Configuring maximum file sizes and other threshold levels.

Configuring additional realtime scan options

You can configure several additional settings for the realtime scan. In the FPSP Administrator Console, click Policy Management, and then in Global Settings, click Scan Options. In the Realtime scan section, you can configure the following settings:

  • Bypass realtime scanning—You can configure FPSP to bypass realtime scanning of all SharePoint files. When you configure FPSP to bypass realtime scanning, no malware scanning or filtering is performed by the realtime scan job. This setting is disabled by default. To enable it, select the Bypass realtime scanning check box, and then click Save.

    Important:
    Bypassing the realtime scan should only be used for troubleshooting and under the direction of a Customer Service and Support (CSS) engineer. When enabled (it is disabled by default), the realtime scan offers no protection from malware and all files are marked as "Clean". When you are finished troubleshooting, in order to once again be protected against malware, you must restore scanning by disabling the bypass. Do this by clearing the Bypass realtime scanning check box and then clicking Save. If you bypassed scanning for any period of time, it is also recommended that you run a full scheduled scan for malware that may have been bypassed.
  • Scan .doc files as containers— Configures the realtime scan to scan .doc files and any other files that use structured storage and the OLE embedded data format (for example, .xls, .ppt, or .shs) as container files. This ensures that any embedded files are scanned as potential malware carriers. This setting is enabled by default.

  • Scan after engine update—Configures the realtime scan to rescan previously scanned files when they are accessed following an engine update.

    This setting is disabled by default. When enabled, this setting provides heightened security protection by rescanning files that have already been scanned. Files are rescanned the first time an "on-access" event occurs and during every "on-access" event after the initial one if new engine definition updates have been received since the last time the file was scanned.

    Note:
    The SharePoint server may experience increased malware scanning when this option is enabled. This may impact server performance.
  • Process Count—Configures the number of processes you want running per Web Front End server. The default value is 4; the maximum value is 10.

    When multiple realtime processes are running, the first process scans the file unless it is busy; in which case, the file is delivered to the second process for scanning. If the second process is busy, and a third is enabled, the third process scans the file. Whenever possible, FPSP delivers files to the first process if it is available.

    Multiple processes increase the load on the server at startup when the processes are being loaded, and whenever they are called upon to scan a file. More than the default number of processes should not be necessary, except in high-volume environments. Because increasing the number of processes consumes additional server resources, it is best to increase them one at a time, and evaluate the performance at each step.

    It is recommended that the number of realtime processes should be set to twice the number of effective processors on the server. For example, a two-processor server or a single processor dual core server should have the realtime Process count set to the default value of 4. If the server contains two processors each of which is dual core, the recommended setting is 8.

    Important:
    You must stop and then start the Microsoft Forefront Server Protection Controller Service and World Wide Web Publishing Service in order for changes to this setting to take effect.
  • Maximum container scan time (seconds)—Configures the number of seconds that the realtime scan scans a compressed file before reporting it as a "ScanTimeExceeded" incident. This option is intended to prevent the risk of denial of service due to zip-of-death attacks. The default value is 120 seconds (2 minutes).

Click Save after making any changes to your settings.

Indicating whether notifications should be sent

You can indicate whether virus or spyware notifications should be sent when malware is detected by using the Forefront Management Shell.

To access the Forefront Management Shell, click Start, point to All Programs, point to Microsoft Forefront Server Protection, and then click Forefront Management Shell.After accessing the Forefront Management Shell, you can issue the following command:

Set-FsspRealtimeScan -SuppressMalwareNotifications

The possible values are $false and $true. The default of $false indicates that if virus or spyware notifications are enabled, they are sent. If they are disabled, this parameter has no effect.

Related Topics