Malware Protection
The Malware Protection tab contains options for configuring AV, anti-exploit, cloud-based malware detection, removable media access, exclusions list, and other options. Some options only display if you enable Advanced view.
Enable or disable the eye icon to show or hide this feature from the end user in FortiClient.
Configure the following options:
- AntiVirus Protection
- Anti-Exploit
- Cloud Based Malware Detection
- Removable Media Access
- Exclusions
- Other
AntiVirus Protection
Enable AV protection.
Anti-Exploit
Enable anti-exploit engine to monitor commonly used applications for attempts to exploit known vulnerabilities.
|
Options |
Description |
|---|---|
|
Show System Tray Notifications |
Show system tray notifications when anti-exploit engine detects an exploit. |
|
Application Exclusion List |
Exclude applications from anti-exploit detection. |
Cloud Based Malware Detection
Enable cloud-based malware outbreak detection. The cloud-based malware protection feature helps protect endpoints from high risk file types from external sources such as the Internet or network drives by querying FortiGuard to determine whether files are malicious. The following describes the process for cloud-based malware protection:
- A high risk file is downloaded or executed on the endpoint.
- FortiClient generates a SHA1 checksum for the file.
- FortiClient sends the checksum to FortiGuard to determine if it is malicious against the FortiGuard checksum library.
- If the checksum is found in the library, FortiGuard communicates to FortiClient that the file is deemed malware. By default, FortiClient quarantines the file.
This feature only submits high risk file types such as .exe, .doc, .pdf, and .dll to FortiGuard. The list of high risk file types is the same as the list of file types submitted to Sandbox by default.
Removable Media Access
Control access to removable media devices, such as USB drives.
|
Options |
Description |
|---|---|
|
Control removable media access |
Configure the action to take with removable media devices. Available options are:
|
|
Show bubble notifications |
Display bubble notifications when FortiClient blocks removable media access. |
Exclusions
Enable exclusions from AV scanning. FortiClient EMS supports using wildcards and path variables to specify files and folders to exclude from scanning. EMS supports the following wildcards and variables:
- Using wildcards to exclude a range of file names with a specified extension, such as Edb*.jrs
- Using wildcards to exclude all files with a specified extension, such as *.jrs
- Path variable %windir%
- Path variable %allusersprofile%
- Path variable %systemroot%
- Path variable %systemdrive%
Having a longer exclusion list affects AV performance. It is advised to keep the exclusion list as short as possible.
|
Options |
Description |
|---|---|
|
Paths to Excluded Folders |
Enter fully qualified excluded folder paths in the provided text box to exclude these folders from RTP and on-demand scanning. |
|
Paths to Excluded Files |
Enter fully qualified excluded files in the provided text box to exclude these files from RTP and on-demand scanning. |
|
File Extensions Excluded from Real-Time Protection |
RTP skips scanning files with the specified extensions. |
|
File Extensions Excluded from On Demand Scanning |
On-demand AV protection skips scanning files with the specified extensions. |