Malware Scanning is a Folder Setting that scans every file uploaded into a folder and moves infected files to quarantine.

While the scan runs, the file is visible at the path it was uploaded to but cannot be downloaded, previewed, moved, copied, or renamed. A clean file is released at that path. An infected file never becomes available at all, because Files.com removes it from the folder and moves it to quarantine.

The setting applies to the folder you choose and every folder beneath it, and a subfolder cannot override or disable it.

Malware Scanning is available on the Enterprise plan. The setting has no options to configure.

If you are deciding between Malware Scanning and an extension restriction, see Malware Scanning vs. File Extension Restrictions below.

Which Folders to Protect

A file is scanned when it is uploaded, so the folder receiving that upload is the one that needs the setting.

An infected file that is not scanned at upload can be sent outside your organization through a Share Link, copied to a Remote Server or a partner's system by an Automation or a Sync, and copied or moved to other folders on your site.

Apply the setting to the folder an Inbox writes into, to the folder an upload-enabled Share Link writes into, and to any folder you share with customers, vendors, partners, or contractors.

A file that is moved or copied into a protected folder is not scanned, because it was not uploaded there. So if an Automation moves or copies files into a folder, a Malware Scanning setting on that folder does not scan them. Apply the setting to the folder the files were uploaded to.

Files that a Sync delivers into a protected folder are scanned, because a Sync writes them as uploads.

Existing files in the folder are not scanned. The setting applies to new uploads from the moment you turn it on, and there is no way to scan files uploaded before that.

Files larger than 100 GB are released without a scan and without consuming credits. Files uploaded into the Remote Server folders under _/RemoteServers or the Child Site folders under _/Sites, and files written directly to your external storage, are not scanned.

How Scanning Works

Files.com scans uploads using Amazon GuardDuty Malware Protection. Scanning happens in the same region your folder's storage is in, so file data never leaves its region.

When you upload a file into a protected folder, Files.com stores it outside your folder's storage until the scan completes. The file is locked while the scan runs, and an upload that would overwrite it is blocked as well. Deleting still works.

On a Remote Server Mount the file is not written to the remote server until the scan completes and releases it.

Any action that needs to read the file fails with an error stating that the resource is not available while being processed.

A scan has four outcomes: no threat found, threat found, file cannot be inspected, and scan not completed.

When no threats are found, Files.com releases the file and it stays at the path it was uploaded to.

When a threat is found, Files.com moves the file to quarantine. Files.com sends no notification, fires no webhook, and records no event.

When Files.com cannot open the file, it releases the file anyway. The file stays at that same path, and nothing shows that it went unscanned. Password-protected archives are the common case, because the scan cannot read what is inside them.

When the scan cannot be completed at all, the file stays visible at its path and stays locked. This covers a scan that failed, a file that could not be reached for scanning, and a scan that returned no result within six hours. Files.com records the failure on the Pending Work log.

Files.com reports nothing else about scanning. There is no scan status on a file, nothing in the file browser to show a scan is running, and no result to read back through the API, so a file waiting for a malware scan looks the same as a file waiting for any other processing.

Enabling and Removing the Setting

Scanning uses transformation credits.

Site Administrators can apply Malware Scanning to any folder, including your site root. Workspace Administrators can apply it within their Workspace, and Folder Admins can apply it to folders they administer.

None of them can switch it off below a folder that already has it, so protection can only be increased further down the tree, never reduced. A folder that inherits the setting shows which folder it comes from.

If a folder beneath the one you chose already has its own Malware Scanning setting, Files.com does not create the parent setting and returns an error naming the conflicting subfolder paths. Delete those settings first, then apply the setting to the parent.

Deleting the setting stops scanning for new uploads. It does not affect files that were already scanned, and it does not release anything from quarantine.

Changing the Setting on the Root Folder

When Malware Scanning is set on the site's root folder, Root Folder Settings can allow only Site Administrators to change it. Folder Admins can still see the setting but cannot change it.

Applying the Setting in Every Workspace

A setting at your site root applies to Workspaces only when Root Folder Settings make it apply there. Without that, each Workspace needs its own setting at the Workspace root.

Adding the Setting to Every Child Site

A Child Site Management Policy can add Malware Scanning to the root folder of every Child Site it covers. While the setting is part of a policy, nobody on the Child Site can change it.

Malware Scanning vs. File Extension Restrictions

Limit Uploaded Files To Certain File Extensions compares a file's extension to a list. Malware Scanning inspects the file's contents. An extension restriction that blocks .exe uploads does not check whether an uploaded .pdf contains malware, and Malware Scanning does not block a file type your workflow cannot process.

An extension restriction rejects the upload as it happens, and the sender sees the error. Malware Scanning accepts the upload, locks the file while it scans, and moves it to quarantine when a threat is found. The sender sees no error at any point.

Use both on a folder that accepts outside uploads. The extension restriction blocks file types you never accept, and Malware Scanning inspects the contents of the files you do accept.