Step 4. Configuring scan settings

At this step, specify virtual machine scan settings.

To specify the virtual machine scan settings:

1. Select the security level at which Kaspersky Security scans virtual machines. To do so, in the Security level section, perform one of the following actions:
   • If you want to apply one of the preset security levels (High, Recommended, Low), select it by using the slider.
   • To change the security level to Recommended, click the Default button.
   • If you want to configure the security level on your own, click the Settings button. In the Security level settings window that opens:
   1. In the Scanning archives and compound files section, specify the values of the following settings:
      • Scan archives
        

        Enable / disable scanning of archives.

        This check box is cleared by default.

      • Delete archives if disinfection fails
        

        Deletes archives that cannot be disinfected.

        If this check box is selected, Kaspersky Security deletes archives that could not be disinfected.

        If this check box is cleared, the application does not delete archives that could not be disinfected. Kaspersky Security relays information that the infected file has not been deleted to the Administration Server of Kaspersky Security Center.

        This check box is available when the Scan archives check box is selected.

        This check box is cleared by default.

      • Scan self-extracting archives
        

        Enables / disables the scanning of self-extracting archives.

        By default, this check box is cleared for protection profiles and selected for scan tasks.

      • Scan embedded OLE-objects
        

        Enables/disables the scanning of objects that are embedded inside a file.

        This check box is selected by default.

      • Do not unpack large compound files
        

        If this check box is set, Kaspersky Security does not scan compound files whose size exceeds the value that is specified in the Maximum size of a scanned compound file is N MB field.

        If this check box is cleared, Kaspersky Security scans compound files of all sizes.

        Kaspersky Security scans large files that are extracted from archives, regardless of whether the Do not unpack large compound files check box is selected.

        This check box is selected by default.

      • Maximum size of a scanned compound file N MB
        

        Maximum size of compound files that are subject to scanning (in megabytes). Kaspersky Security does not unpack and scan objects whose size is larger than the specified value.

        This setting can be edited if the Do not unpack large compound files check box is selected.

        You can specify a value in the range of 1 to 999999 in this field. By default, the value is set to 8 MB.

   2. In the Performance section, specify the values of the following settings:
      • Limit file scan time
        

        If this check box is selected, Kaspersky Security stops scanning a file when the scan duration reaches the value that is specified in the Scan files for no longer than N second(s) field and skips this file.

        If this check box is cleared, Kaspersky Security does not limit the duration of file scanning.

        By default, this check box is selected for protection profiles and cleared for scan tasks.

      • Scan files for no longer than N second(s)
        

        Maximum duration of file scanning (in seconds). Kaspersky Security stops scanning a file if scanning takes longer than the time value specified.

        This setting can be edited if the Limit file scan time check box is selected.

        You can specify a value in the range of 1 to 3600 in this field. The default value is 60 seconds.

   3. In the Objects to detect section, click the Settings button. In the Objects to detect window that opens, specify the values of the following settings:
      • Malicious tools
        

        Enables/disables protection against malicious tools.

        Malicious tools do not perform their actions right after they are started. Instead, they can be stealthily stored and run on the virtual machine. Intruders often use the features of malicious tools to create viruses, worms, and Trojans, perpetrate network attacks on remote servers, or perform other malicious actions.

        If this check box is set, protection against malicious tools is enabled.

        If this check box is cleared, protection against malicious tools is disabled.

        This check box is selected by default.

      • Auto-dialers
        

        Enables/disables protection against auto-dialers.

        If this check box is selected, protection against auto-dialers is enabled.

        If this check box is cleared, protection against auto-dialers is disabled.

        This check box is selected by default.

      • Adware
        

        Enables/disables protection against adware.

        The function of adware is to display advertising information to the user. For example, it displays banner ads in the interfaces of other programs and redirects search queries to advertising websites. Some varieties of adware collect marketing information about the user and send it to the developer: this information may include the names of the websites that are visited by the user or the content of the user's search queries. Unlike Trojan-Spy–type programs, adware sends this information to the developer with the user's permission.

        If this check box is set, protection against adware is enabled.

        If this check box is cleared, protection against adware is disabled.

        This check box is selected by default.

      • Other
        

        Enables / disables protection against legitimate software that could be exploited by criminals to harm a virtual machine or user data.

        Most of these programs are useful, so many users run them. These programs include IRC clients, file downloaders, remote administration programs, user activity monitoring programs, password utilities, and Internet servers for FTP, HTTP, and Telnet. However, if criminals gain access to these programs, some program features could be used to harm a virtual machine or user data.

        Selecting this check box enables protection against legitimate software that could be used by criminals to harm a virtual machine or user data.

        If this check box is cleared, protection against such software is disabled.

        This check box is cleared by default.

      • Multi-packed files
        

        Enables/disables scanning of files that have been packed using one or several packers three or more times.

        If a file was packed by one or several packers three or more times, the file probably contains malware or legitimate software that can be used by criminals to damage your computer or personal data.

        If this check box is selected, protection against multi-packed files is enabled, and the scanning of such files is allowed.

        If this check box is cleared, protection against multi-packed files is disabled.

        This check box is selected by default.

      Kaspersky Security always scans virtual machine files for viruses, worms, and Trojans. That is why the Viruses and worms and Trojans settings in the Malware section cannot be changed.

   4. In the Objects to detect window, click OK.
   5. In the Security level settings window, click OK.

      If you have changed security level settings, the application creates a custom security level. The name of the security level in the Security level section changes to Custom.

2. Select an action in the Action on threat detection list.
   

   Action that Kaspersky Security performs after detecting infected files. You can select one of the following options:

   • Choose action automatically. Kaspersky Security performs the default action specified by Kaspersky Lab specialists:
     • Disinfect. Delete if disinfection fails when an infected file is detected on a powered on virtual machine.
     • Block when an infected file is detected on a powered off virtual machine.

     This option is selected by default.

   • Disinfect. Block if disinfection fails Kaspersky Security automatically attempts to disinfect infected files. If disinfection fails, Kaspersky Security blocks such files.
   • Disinfect. Delete if disinfection fails. Kaspersky Security automatically attempts to disinfect infected files. If disinfection fails, the application deletes such files. If deletion fails, Kaspersky Security blocks the infected files.

     Kaspersky Security deletes infected archives that could not be disinfected only if the Delete archives if disinfection fails check box is selected in the security level settings.

   • Delete. Block if deletion fails Kaspersky Security automatically deletes infected files without attempting to disinfect them. If deletion fails, Kaspersky Security blocks such files.
   • Block. Kaspersky Security automatically blocks infected files without attempting to disinfect them.
3. Kaspersky Security can scan powered off virtual machines that have Windows or Linux operating systems with the following file systems: NTFS, FAT32, EXT2, EXT3, EXT4, XFS, BTRFS. If you want the application to scan powered off virtual machines that are included in the task scope, select the Scan powered off virtual machines check box in the Additional scan settings section.

   Kaspersky Security does not scan files on powered off virtual machines with other file systems.

   While a powered off virtual machine is being scanned, it is impossible to turn on or migrate the virtual machine.

4. Kaspersky Security can scan virtual machine templates that are included in the task scope. If you want the application to scan virtual machine templates, select the Scan virtual machine templates check box in the Additional scan settings section.
5. When scanning virtual machines running Windows operating systems, Kaspersky Security can scan files on optical drives (CD, DVD, Blu-Ray). If you want the application to scan files on optical drives, select the Scan optical drives check box in the Additional scan settings section.

   If the Scan optical drives check box is selected but the path to the optical drive is not included in the scan scope, Kaspersky Security does not scan the optical drive.

   Kaspersky Security does not scan files on optical drives when scanning powered off virtual machines and virtual machines running Linux operating systems.

6. In the Stop scan section, choose one of the following options:
   • After N minute(s) since task launch
     

     Maximum scan task duration (in minutes). When the specified time limit is reached, the scan task is interrupted even if it has not been completed.

     This option is selected by default.

     You can specify a value in the range of 1 to 4320 in this field. The default value is set to 120 minutes.

   • After completing scan of files on all protected virtual machines
     

     The scan task is performed until files on all protected virtual machines that are within the task scope have been scanned.

Proceed to the next step of the Task Wizard.