Symantec Endpoint Protection for Macintosh: How to Disable Scanning of Compressed Archives

Article:TECH106231  |  Created: 2008-01-13  |  Updated: 2013-11-01  |  Article URL http://www.symantec.com/docs/TECH106231
Article Type
Technical Solution


Issue



How to disable scanning of compressed files by SEP for Macintosh.


Solution



 SEP clients managed by a SEPM server: To disable scanning of compressed files

  • Auto-Protect scans:

SEPM Antivirus and Antispyware policy, Mac Settings, File System Auto-Protect, Scan Details tab, "Scan compressed files" checkbox

  • Scheduled scans:

SEPM Antivirus and Antispyware policy, Mac Settings, Admin-Defined Scans,Common Settings tab, "Scan compressed files" checkbox

  • On-demand scans (as commanded via right-click in SEPM client listing):

SEPM Antivirus and Antispyware policy, Mac Settings, Admin-Defined Scans, Scans tab (at bottom, "Administrator On-demand Scan settings") 

These settings override the client's local settings only for AutoProtect, scheduled scans, and on-demand scans.

Scans commanded through the local client GUI and navx command line (in SEP for Mac 11.0.6-12.1.2) use settings that are independent of any SEPM configuration.


Unmanaged SEP for Macintosh clients: To disable scanning of compressed files

SEP for Mac 12.1.4 and newer:

Auto-Protect scans:

Open the SEP for Mac client GUI:

1. Go to Settings.

2. Click "Configure" under Auto-Protect settings and authenticate with an Administrator password.

3. Uncheck "Scan compressed files (e.g zip files).

4. Click "Done" to dismiss the dialog.

Manual Scans:

Open the SEP for Mac client GUI:

1. Go to Status.

2. Click the Scan drop down in the lower right. Choose "Run custom scan".

3. Select the object to be scanned. Uncheck the option "Scan Compressed Files" and then click the "Scan" button.

Scheduled Scans:

Open the SEP for Mac client GUI:

1. Go to Settings.

2. Click on "Configure" under "Scheduled Scans" to display the available scans.

3. Choose the scheduled scan to edit and click the "Edit..." button.

4. Uncheck the option "Scan Compressed" and click OK.

 

SEP for Mac 11.0.6-12.1.2:

Auto-Protect scans:

Using the SEP for Mac client GUI:

1. Open System Preferences->Symantec Auto-Protect.

2. Click the padlock icon in the lower left corner to authenticate with your Administrator password.

3. Click the "Off" radio button option for "Scan Compressed Files" to disable the scan of archives.

Alternatively, the settings can be modified via the Terminal for those comfortable using Unix commands:

From the SEP client command line as root (or using sudo as below, and commands are case-sensitive):

sudo defaults write /var/root/Library/Preferences/com.symantec.autoprotect ScanCompressedOn –bool NO

NOTE: Changing these settings on a managed SEP for Mac client will be reverted via policy on the next heartbeat to the SEPM.

User-scheduled scans:

For ALL user-scheduled scans, from the SEP client command line (note capitalization):

defaults write /Library/Preferences/com.Symantec.SAVX ScanCompressedPref -bool NO

Managed and un-managed clients: To turn off the default setting for manual scans run by the current user through the local GUI

This setting cannot be controlled via the SEPM. There is a checkbox labeled "Scan within Compressed Archives" in the client GUI for SEP for Macintosh. This setting does not affect AutoProtect or scheduled scans; it affects only manual scans that are run from the client GUI. Changes to the default state of this setting (checking or unchecking the box) are not retained if you close and re-open the GUI. But the command below will change the default setting globally for all users.

defaults write /Library/Preferences/com.Symantec.NAVX ScanCompressedPref -bool NO

For scans run from the command line

See Command line switches and use of NAVX command line utility for SAV/SEP for Macintosh



Legacy ID



2008101314543548


Article URL http://www.symantec.com/docs/TECH106231


Terms of use for this information are found in Legal Notices