File Shield

 

File Shield is the main layer of Antivirus active protection. It scans programs and files saved on the device for malicious threats as they are opened, run, modified, and saved. File Shield is designed to prevent any detected malware from infecting the system.

We strongly recommend you always keep this shield turned on and only make configuration changes if you have an advanced understanding of malware protection principles.

Note that in Antivirus for macOS, the shields can only be disabled, not uninstalled. Therefore, if you uninstall File Shield from a policy, the service on macOS endpoints will only be disabled.

Configuring File Shield Settings for Windows Devices

To access File Shield settings for Windows devices:

1. Go to the Policies page
2. Open the desired policy
3. Select Windows Workstation or Windows Server
4. Go to the Active Protection tab
5. Click the Customize link next to File Shield

Six sets of settings are available here:

• Scan behavior
• Exclusions
• Actions
• Packers
• Sensitivity
• Report file

Scan Behavior

The settings here determine what File Shield scans and under which conditions. The following options are available:

• Scan when executing 
  • Scan programs when executing: Scans programs when they are executed (e.g. when the user opens Microsoft Excel).
  • Scan scripts when executing: Scans scripts when they are executed (e.g. a JavaScript file).
  • Scan libraries when executing: Scans libraries (dlls) when programs are executed.

• Scan when opening
  • Scan documents when opening: Scans documents when they are opened by the user (e.g. Microsoft Word).
  • Scan documents with custom extensions: Enabling this will allow you to add specific extensions to be scanned.
  • Scan all files: All file types will be scanned when opened. This can have a negative performance impact. By default, only the most common files that can be infected are scanned.

• Scan when attaching
  • Scan auto-run items when removable media is attached: When a removable device is attached, auto-run items are scanned to help prevent any viruses that infect the system by automatically running when a removable device is plugged.
  • Scan diskette boot sectors on access: When a floppy disk is accessed, the boot sector is scanned.

• Scan when writing
  • Scan files when writing: Scans files with default and/or custom extensions, or all files when they are created or modified (this can have a negative performance impact).
  • Do not scan files on remote shares: Prevents File Shield from scanning remote shares for files that are written. It can help with performance issues over the network, and is checked by default.
  • Do not scan files on removable media: Prevents File Shield from scanning files on removable devices. This is not recommended.

Exclusions

The settings here allow you to configure a list of locations that are excluded from File Shield scans when they are read (R), written (W), and/or executed (X). You can modify/remove existing entries or add new paths to the list.

Exclusions that you specify here only apply to File Shield and do not affect any other scans. To exclude a location from all Antivirus scans, set up standard exclusions instead.

For more information on standard and component-specific exclusions, see Configuring Antivirus Exclusions.

Actions

The Actions settings define how viruses, PUPs, unwanted tools, and suspicious objects are handled when detected by File Shield. For each type, it is possible to configure three actions to perform, with the "if the action fails" value. The following actions can be selected from each drop-down menu:

• Fix automatically: Runs a sequence of actions (repair file; if not possible, then move to Quarantine; if not possible, then delete).
• Move to quarantine: Sends the threat to Quarantine, where it cannot harm your system.
• Repair: Removes only malicious code attached to an otherwise safe file — this is not possible for files that are entirely malware.
• Ask: Avast asks what you want to do with a detected threat before any action is taken.
• Delete: Permanently removes the file from your computer.
• No action: No action is taken during the scan; the threat is listed in your scan results and you can decide what to do later.

For example, you can set the first action to Move to quarantine. If that fails, then Ask the user. If that then fails as well, the final action can be to Delete the file. If the final action also fails, nothing further will be performed (the file will continue to be blocked).

Under the Options section, you can also define whether File Shield will:

• Show notifications for actions: Choose whether a notification is displayed each time File Shield detects a threat on the device.
• Perform the selected action when the system restarts: File Shield will perform the necessary action when the device restarts.

Lastly, the Processing of infected archives section allows you to configure what to do with infected archives. By default, the shield will try to remove the infected file from the archive and if that fails, nothing will happen.

The other two options (removing the whole archive if removing the infected file from the archive fails, or always removing the whole archive) can lead to issues if there is a false positive, and the archive may be deleted if too large.

Packers

These settings allow you to define which archive (packer) formats Avast should try to extract during File Shield scans (unpacked files can be better analyzed for malware). Original archives remain intact while processed by File Shield. You can choose to use either all packer formats or just the ones you select from the list. By default, only the most commonly infected packers are used.

Sensitivity

Here, you can adjust the sensitivity of the Antivirus scan for File Shield:

• Heuristics Sensitivity: Heuristics enable Antivirus to detect unknown malware by analyzing code for commands that may indicate malicious intent. The default setting is Normal. With higher sensitivity, Antivirus is more likely to detect malware, but also more likely to make false-positive detections that incorrectly identify files as malware.
  • Use code emulation: Choose whether to use code emulations to unpack and test suspected malware in an emulated environment, where the files cannot cause damage to devices.
• Sensitivity: Enable Test whole files to check the whole content of a file instead of the parts typically affected by malicious code. There is usually no need to enable this option, and it will likely impact system performance.
• PUP and suspicious files: Choose whether or not to scan for potentially unwanted programs (PUPs).

Report File

You can configure the report file here in order to enhance the reporting of the shield:

• File name: Enter a name for the report file (default * will use the default file name)
  • The Generate report file checkbox needs to be ticked for the report file to be created.
• File type: Select the format of the report file:
  • Plain text (ANSI)
  • Plain text (Unicode)
  • XML
• If file exists: Select Append if you want new results to be added to the end of the previous report, or Overwrite if you want new results to replace the previous report
  • Using the Append option will gradually increase the size of the report file on the disk. Including informative events such as OK will also greatly increase the size on the disk as every clean file will be reported.
• Reported items: Define which events appear in report files:
  • Infected items — Files and areas of the scanned environment that the virus scan identifies as containing malware
  • Hard Errors — Unexpected errors that require further investigation
  • Soft Errors — Minor errors, such as a file being unable to be scanned because it was in use
  • OK items — Files and areas that the virus scan identified as being clean
  • Skipped items — Files and areas that the virus scan did not check because of the scan settings

At the bottom of the settings, the default location of the report is displayed.

Configuring File Shield Settings for macOS Devices

To access File Shield settings for macOS devices:

1. Go to the Policies page
2. Open the desired policy
3. Select Mac OS X
4. Go to the Active Protection tab
5. Click the Customize link next to File Shield

Two sets of settings are available here:

• Policy: Controls whether potentially unwanted programs are reported and if infected files are quarantined.

• Exclusions: Allows specifying locations that should be excluded from File Shield scans.

  • For more information on standard and component-specific exclusions, see Configuring Antivirus Exclusions.

Enabling Anti-Exploit Monitor

The Anti-Exploit Monitor (called Anti-Exploit Shield in the local client) scans and protects against known exploits (e.g. the "Hafnium Exchange" exploit) in popular software. This feature is part of File Shield but is not manageable via policies and is only visible in the Protection section of the local client UI (see Core Shields Settings).

FAQ