Trend Micro InterScan M Series, Administrator'S Manual

Page: 79 / 480

How InterScan Gateway Security Appliance Works
3
-
19
File extension checking—IntelliScan also uses extension checking, that is, the file
name itself. The list of extension names to scan for is updated with each new pattern
file. For example, when there is a new vulnerability discovered with regard to ".jpg"
files, the ".jpg" extension is immediately added to the extension-checking list for the
next pattern update.
Only files of the type that are capable of being infected are scanned. For example,
.gif files make up a large volume of all Web traffic, but they are not currently able to
carry viruses and therefore do not need to be scanned. Similarly, .jpg files are not
currently utilized to carry viruses, though there is some concern this may change in
the future—which means, IntelliScan would be changed to also scan for this threat.
As of the date of publication of this guide, however, with true file type selected, once
the true type has been determined, these inert file types are not scanned.
Outbreak Defense Services
A virus outbreak can occur on the Internet and spread rapidly. Outbreak Defense is a
combination of services designed to protect networks in the event of an outbreak and
to repair clients' computers that have been exposed to viruses or malware.
Outbreak Defense uses the following components to protect networks from outbreaks
and clean clients exposed to viruses or malware:
• Outbreak Prevention Services and Outbreak Prevention Policy
• Damage Cleanup Services and Damage Cleanup Tool
Outbreak Prevention Services and Outbreak Prevention Policy
Outbreak Prevention Services protects networks by deploying an Outbreak Preven-
tion Policy.
When TrendLabs receives information that a new outbreak is developing anywhere
in the world, it quickly develops a response to it called an Outbreak Prevention
Policy. Trend Micro ActiveUpdate servers then deploy the Outbreak Prevention
Policy to InterScan Gateway Security Appliance. The Outbreak Prevention Policy
remains in effect for the administrator-specified amount of time or until TrendLabs
develops a complete solution to the threat.