Running tasks

• Quick scan uses in-the-cloud scanning to detect malware running in the system. This type of scan is preconfigured to allow scanning only critical Windows and Linux system locations. Running a Quick Scan usually takes less than a minute and uses a fraction of the system resources needed by a regular virus scan.

  When malware or rootkits are found, Bitdefender automatically proceeds with disinfection. If, for any reason, the file cannot be disinfected, then it is moved to quarantine. This type of scanning ignores suspicious files.

• Full scan checks the entire system for all types of malware threatening its security, such as viruses, spyware, adware, rootkits and others.

  Bitdefender automatically tries to disinfect files detected with malware. In case malware cannot be removed, it is contained in quarantine, where it cannot do any harm. Suspicious files are being ignored. If you want to take action on suspicious files as well, or if you want other default actions for infected files, then choose to run a Custom Scan.

• Memory scan checks the programs running in the endpoint's memory.

• Network scan is a type of custom scan, allowing to scan network drives using the Bitdefender security agent installed on the target endpoint.

  For the network scan task to work:

  • You need to assign the task to one single endpoint in your network.

  • You need to enter the credentials of a user account with read/write permissions on the target network drives, for the security agent to be able to access and take actions on these network drives. The required credentials can be configured in the Target tab of the tasks window.

  Note

  For memory, network and custom scans, you have also these options:

  • Run the task with low priority. Select this checkbox to decrease the priority of the scan process and allow other programs to run faster. This will increase the time needed for the scan process to finish.

    On ARM-based macOS endpoints, the security agent optimizes the scan process depending on the processor usage. At over 50% usage, the scan process relocates to the efficiency cores, while at over 80% the task pauses until the processor usage drops below this threshold. Intel-based macOS endpoints do not support the Run the task with low priority option.

  • Shut down computer when scan is finished. Select this checkbox to turn off your machine if you do not intend to use it for a while.

  • Pause scan when computer is in Battery mode: this option helps you pause the scanning process on endpoints running on battery power and automatically resume it once they are plugged back in.

  • Enable CPU usage control: this option allows you to adjust the CPU usage allocated for the scanning process and tailor the scan performance to your needs. The option is available for all operating systems, offering three levels:

    • Low

      macOS: One core is reserved for scanning from the total number of available cores. The scanning process pauses when the idle CPU usage falls below 75% of the remaining cores and automatically resumes when idle CPU usage rises above this threshold.

      Windows and Linux: the scanning process uses up to 25% of the total CPU.

    • Medium

      macOS: One core is reserved for scanning from the total number of available cores. The scanning process pauses when the idle CPU usage falls below 50% of the remaining cores and automatically resumes when it rises above this threshold.

      Windows and Linux: the scan uses up to 50% of the total CPU.

    • High

      macOS: One core is reserved for scanning from the total number of available cores. The scanning process pauses when the idle CPU usage falls below 25% of the remaining cores and automatically resumes when it rises above this threshold.

      Windows and Linux: no CPU usage limit is imposed on the scanning process.

    Note

    Selecting a specific CPU usage profile directly impacts the duration of the scan task. Lower CPU usage results in longer scan times, while higher CPU usage speeds up the scanning process.

• Custom scan allows you to choose the locations to be scanned and to configure the scan options.

• Go to the Options tab to set the scan options.

  Click the security level that best suits your needs (Aggressive, Normal or Permissive).

  Use the description on the right-side of the scale to guide your choice.

  Based on the selected profile, the scan options in the Settings section are automatically configured. However, if you want to, you can configure them in detail. To do that, select the Custom checkbox and then expand the Settings section.

  The following options are available:

  • File types

    Use these options to specify which types of files you want to be scanned.

    You can set the security agent to scan all files (regardless of their file extension), application files only or specific file extensions you consider to be dangerous.

    Scanning all files provides best protection, while scanning applications only can be used to perform a quicker scan.

    Note

    Application files are far more vulnerable to malware attacks than other types of files.

    For more information, refer to Application file types.

    If you want only specific extensions to be scanned, choose Custom extensions from the menu and then enter the extensions in the edit field, pressing Enter after each extension.

    Important

    Bitdefender security agents installed on Windows and Linux operating systems scan most of the .ISO formats, but does not take any action on them.

    

  • Archives

    Archives containing infected files are not an immediate threat to system security.

    The malware can affect the system only if the infected file is extracted from the archive and executed without having real-time protection enabled.

    However, it is recommended to scan archives in order to detect and remove any potential threat, even if it is not an immediate threat.

    Important

    Scanning archived files increases the overall scanning time and requires more system resources.

    • Scan inside archives

      Select this option if you want to check archived files for malware.

      If you decide on using this option, you can configure the following optimization options:

      • Limit archive size to (MB)

        You can set a maximum accepted size limit of archives to be scanned.

        Select the corresponding checkbox and type the maximum archive size (in MB).

      • Maximum archive depth (levels)

        Select the corresponding checkbox and choose the maximum archive depth from the menu.

        For best performance choose the lowest value, for maximum protection choose the highest value.

    • Scan email archives

      Select this option if you want to enable scanning of email message files and email databases, including file formats such as .eml, .msg, .pst, .dbx, .mbx, .tbb and others.

      Important

      Email archive scanning is resource intensive and can impact system performance.

  • Miscellaneous

    Select the corresponding checkboxes to enable the desired scan options.

    • Scan boot sectors

      Scans the system’s boot sector.

      This sector of the hard disk contains the necessary computer code to start the boot process.

      When a virus infects the boot sector, the drive may become inaccessible and you may not be able to start your system and access your data.

    • Scan UEFI

      This option enables Unified Extensible Firmware Interface (UEFI) scanning ensuring the security and integrity of the system's boot process and protecting against sophisticated threats that can persist at the firmware level.

      The option is available for Full, Quick, and Custom scan types and is enabled by default when the security level is set to Aggressive.

    • Scan registry

      Select this option to scan registry keys.

      Windows Registry is a database that stores configuration settings and options for the Windows operating system components, as well as for installed applications.

    • Scan for rootkits

      Select this option to scan for glossary.rootkit rootkits and objects hidden using such software.

    • Scan for keyloggers

      Select this option to scan for glossary.keylogger keylogger software.

    • Scan network shares

      This option scans mounted network drives.

      For quick scans, this option is deactivated by default. For full scans, it is activated by default. For custom scans, if you set the security level to Aggressive/Normal, the Scan network shares option is automatically enabled. If you set the security level to Permissive, the Scan network shares option is automatically disabled.

    • Scan memory

      Select this option to scan programs running in the system's memory.

    • Scan cookies

      Select this option to scan the cookies stored by browsers on the computer.

    • Scan only new and changed files

      By scanning only new and changed files, you may greatly improve overall system responsiveness with a minimum trade-off in security.

    • Scan for Potentially Unwanted Applications (PUA)

      A Potentially Unwanted Application (PUA) is a program that may be unwanted on the PC and sometimes comes bundled with freeware software. Such programs can be installed without the user's consent (also called adware) or will be included by default in the express installation kit (ad-supported). Potential effects of these programs include the display of pop-ups, installing unwanted toolbars in the default browser or running several processes in the background and slowing down the PC performance.

    • Preserve last access time

      This option helps you control whether to preserve the last access time for a file during a scan or to allow the scanning process to modify the timestamp of that file. The option is enabled by default.

    • Scan detachable volumes

      Select this option to scan any removable storage drive attached to the endpoint.

  • Actions

    Depending on the type of detected file, the following actions are taken automatically:

    • When an infected object is found

      Bitdefender detects objects (such as files and registries) as infected through various advanced mechanisms, which include malware signatures, machine learning, and artificial intelligence (AI) based technologies.

      The security agent typically handles infected objects by denying access to them and moving them to quarantine. An attempt is then made to disinfect the system by removing the malware code and any artifacts created by the malware.

      If an infected object is detected, the security agent will automatically attempt to remediate it.

      Important

      For particular types of malware, disinfection is not possible because the detected object is entirely malicious. In such cases, the infected object is deleted from the disk.

    • When a rootkit is found

      Rootkits represent specialized software used to hide files from the operating system.

      Though not malicious in nature, rootkits are often used to hide malware or to conceal the presence of an intruder into the system.

      Detected rootkits and hidden files are ignored by default.

    Though not recommended, you can change the default actions.

    The following actions are available:

    • Remediate

      Access to the infected objects is denied, and they are moved to quarantine. An attempt is then made to disinfect the system by removing the malware code and any artifacts created by the malware.

      It is recommended to always keep this as the default action to be taken on infected objects.

      Note

      To automatically move the infected objects to quarantine, make sure you have selected Copy files to quarantine before applying the disinfect action in the Antimalware > Settings section of the policy.

    • Move to quarantine

      Infected objects are moved from their current location to the quarantine folder.

      Quarantined files cannot be executed or opened; therefore, the risk of getting infected disappears.

      You can manage quarantine files from the Quarantine page of the console.

    • Report only

      No action will be taken on infected objects. These objects will only appear in the scan log.

• Go to Target tab to configure the locations you want to be scanned on the target endpoints.

  In the Scan target section you can add a new file or folder to be scanned:

  1. Choose a predefined location from the drop-down menu or enter the Specific paths you want to scan.

  2. Specify the path to the object to be scanned in the edit field.

     • If you have chosen a predefined location, complete the path as needed.

       For example, to scan the entire Program Files folder, it suffices to select the corresponding predefined location from the drop-down menu.

       To scan a specific folder from Program Files, you must complete the path by adding a backslash (\) and the folder name.

     • If you have chosen Specific paths, enter the full path to the object to be scanned.

       It is advisable to use system variables (where appropriate) to make sure the path is valid on all target computers. For more information regarding system variables, refer to appendices.variables.

  3. Click the corresponding Add button.

  To edit an existing location, click it.

  To remove a location from the list, click the corresponding Delete button.

  For network scan tasks, you need to enter the credentials of a user account with read/write permissions on the target network drives, for the security agent to be able to access and take actions on these network drives.

  Click the Exclusions section if you want to define target exclusions.

  

  You can either use the exclusions defined by policy or define explicit exclusions for the current scan task.

  For more details regarding exclusions, refer to Settings.

• Only unread messages

• Only items with attachments

• Only new items, received in a specified time interval

If you want to scan only files with specific extensions, you have two alternatives:

• Scan file types. Use this option to specify which file types you want to be scanned. You can choose to scan all files (regardless of their file extension), application files only, or specific file extensions you consider to be dangerous. Scanning all files provides the best protection, while scanning only applications is recommended for a quicker scan.

  Note

  Application files are far more vulnerable to malware attacks than other types of files.

• Attachment / email body maximum size (MB). Select this checkbox and enter a value in the corresponding field to set the maximum accepted size of an attached file or of the email body to be scanned.

• Archive maximum depth (levels). Select the checkbox and choose the maximum archive depth from the corresponding field. The lower the depth level is, the higher the performance and the lower the protection grade.

• Scan for Potentially Unwanted Applications (PUA). Select this checkbox to scan for possibly malicious or unwanted applications, such as adware, which may install on systems without user’s consent, change the behavior of various software products and lower the system performance.

• Infected files. Bitdefender detects files as infected through various advanced mechanisms, which include malware signatures, machine learning and artificial intelligence (AI) based technologies.

• Suspicious files. These files are detected as suspicious by the heuristic analysis and other Bitdefender technologies. These provide a high detection rate, but the users must be aware of certain false positives (clean files detected as suspicious) in some cases.

• Unscannable files. These files cannot be scanned. Unscannable files include but are not limited to password-protected, encrypted or over-compressed files.

• Remediate. Removes the malware code from infected files and reconstructs the original file. For particular types of malware, disinfection is not possible because the detected file is entirely malicious. It is recommended to always keep this as the first action to be taken on infected files. Suspicious files cannot be disinfected, because no disinfection routine is available.

• Reject / Delete email. On servers with Edge Transport role, the detected email is rejected with a 550 SMTP error code. In all other cases, the email is deleted without any warning. It is advisable to avoid using this action.

• Delete file. Deletes the attachments with issues without any warning. It is advisable to avoid using this action.

• Replace file. Deletes the files with issues and inserts a text file that notifies the user of the actions taken.

• Move file to quarantine. Moves detected files to the quarantine folder and inserts a text file that notifies the user of the actions taken. Quarantined files cannot be executed or opened; therefore, the risk of getting infected disappears. You can manage quarantine files from the Quarantine page.

  Note

  The quarantine for Exchange Servers requires additional hard-disk space on the partition where the security agent is installed. The quarantine size depends on the number of items stored and their size.

• Report only. No action will be taken on detected files. These files will only appear in the scan log. Scan tasks are configured by default to ignore suspicious files. You may want to change the default action in order to move suspicious files to quarantine.

• Central Scan in Public or Private Cloud (with Security Server) with fallback on Hybrid Scan (Light Engines), for physical endpoints with low hardware performance and for virtual machines. This case requires at least one Security Server deployed in the network.

• Local Scan (with Full Engines) for physical endpoints with high hardware performance.

• Local scan for EC2 instances and Microsoft Azure virtual machines.

• Central Scan in Public or Private Cloud (with Security Server), which can fallback* on Local Scan (with Full Engines) or on Hybrid Scan (with Light Engines)

• Hybrid Scan (with Light Engines)

• Local Scan (with Full Engines)

• The default scan mode for EC2 instances is Local Scan (security content is stored on the installed security agent, and the scan is run locally on the machine). If you want to scan your EC2 instances with a Security Server, you need to configure the security agent’s installation package and the applied policy accordingly.

  Note

  In this case, the Bitdefender Security Server hosted in the AWS region corresponding to the target EC2 instances is automatically assigned.

• The default scan mode for Microsoft Azure virtual machines is Local Scan (security content is stored on the installed security agent, and the scan is run locally on the machine). If you want to scan your Microsoft Azure virtual machines with a Security Server, you need to configure the security agent’s installation package and the applied policy accordingly.

  * When using a dual engines scanning, if the first engine is unavailable, the fallback engine will be used. Resource consumption and network utilization will be based on used engines.

• The default scan mode for BEST for Linux v7 when using the Bitdefender for Security Containers add-on is:

  • Hybrid Scan, for physical endpoints (including container hosts) and nodes (in case of Kubernetes).

  • Central Scan with the fallback on Hybrid Scan for endpoints (including container hosts) and nodes (in case of Kubernetes) that are either virtual machines or on a cloud infrastructure (whether IaaS or PaaS) supported by GravityZone integrations.

    Note

    A Security Server needs to be available for this scan to apply. If none is available the scan mode will be set to Hybrid.