Malware Scanning is a Folder Setting that scans every file uploaded into a folder and moves infected files to quarantine.

While the scan runs, the file is visible at the path it was uploaded to but cannot be downloaded, previewed, moved, copied, or renamed. A clean file is released at that path. An infected file never becomes available at all, because Files.com removes it from the folder and moves it to quarantine.

The setting applies to the folder you choose and every folder beneath it, and a subfolder cannot override or disable it.

Malware Scanning is available on the Enterprise plan. The setting has no options to configure.

If you are deciding between Malware Scanning and an extension restriction, see Malware Scanning vs. File Extension Restrictions below.

Which Folders to Protect

Malware Scanning checks new content at upload intake, before that content is used or distributed. Apply it to the folders that receive uploads so files are checked as they enter your workflow.

An infected file that is not scanned at upload can be sent outside your organization through a Share Link, copied to a Remote Server or a partner's system by an Automation or a Sync, and copied or moved to other folders on your site.

Apply the setting to the folder an Inbox writes into, to the folder an upload-enabled Share Link writes into, and to any folder you share with customers, vendors, partners, or contractors.

Moves and copies organize content already available to your workflow; they do not start an upload scan. This includes moves and copies performed by an Automation. A setting on a later destination folder does not scan files arriving through those operations, so protect the original upload folder.

Files that a Sync delivers into a protected folder are scanned, because a Sync writes them as uploads.

Existing files in the folder are not scanned. The setting applies to new uploads from the moment you turn it on, and there is no way to scan files uploaded before that.

Files larger than 100 GB are released without a scan and without consuming credits. Files uploaded into the Remote Server folders under _/RemoteServers or the Child Site folders under _/Sites, and files written directly to your external storage, are not scanned.

How Scanning Works

Files.com scans uploads using Amazon GuardDuty Malware Protection. Scanning happens in the same region as your folder's storage. Files moved to quarantine are stored in your site's default storage region, which may differ from the upload folder's region.

When you upload a file into a protected folder, Files.com stores it outside your folder's storage until the scan completes. The file is locked while the scan runs, and an upload that would overwrite it is blocked as well. Deleting still works.

On a Remote Server Mount the file is not written to the remote server until the scan completes and releases it.

Any action that needs to read the file fails with an error stating that the resource is not available while being processed.

A scan has four outcomes: no malware detected, malware detected, file cannot be inspected, and scan not completed.

When no malware is detected, Files.com releases the file and it stays at the path it was uploaded to.

When malware is detected, Files.com moves the file to quarantine. Files.com sends no notification, fires no webhook, and records no event.

When the scanner cannot inspect the file, Files.com releases it at the same path. Password-protected archives are the common case, because the scan cannot read what is inside them. Retrying the same file would not make it inspectable. Nothing shows that the file went unscanned, and its release does not mean it was verified as malware-free.

When the scan cannot be completed at all, the file stays visible at its path and stays locked. This covers a scan that failed, a file that could not be reached for scanning, and a scan that returned no result within six hours. Keeping the file locked prevents a scanning outage or configuration problem from silently allowing uploads through without a result. Files.com records the failure on the Pending Work log.

Files.com reports nothing else about scanning. There is no scan status on a file, nothing in the file browser to show a scan is running, and no result to read back through the API, so a file waiting for a malware scan looks the same as a file waiting for any other processing.

Enabling and Removing the Setting

Scanning uses transformation credits.

Site Administrators can apply Malware Scanning to any folder, including your site root. Workspace Administrators can apply it within their Workspace, and Folder Admins can apply it to folders they administer.

None of them can switch it off below a folder that already has it, so protection can only be increased further down the tree, never reduced. A folder that inherits the setting shows which folder it comes from.

If a folder beneath the one you chose already has its own Malware Scanning setting, Files.com does not create the parent setting and returns an error naming the conflicting subfolder paths. Delete those settings first, then apply the setting to the parent.

Deleting the setting stops scanning for new uploads. It does not affect files that were already scanned, and it does not release anything from quarantine.

Changing the Setting on the Root Folder

When Malware Scanning is set on the site's root folder, Root Folder Settings can allow only Site Administrators to change it. Folder Admins can still see the setting but cannot change it.

Applying the Setting in Every Workspace

A setting at your site root applies to Workspaces only when Root Folder Settings make it apply there. Without that, each Workspace needs its own setting at the Workspace root.

Adding the Setting to Every Child Site

A Child Site Management Policy can add Malware Scanning to the root folder of every Child Site it covers. While the setting is part of a policy, nobody on the Child Site can change it.

Malware Scanning vs. File Extension Restrictions

Limit Uploaded Files To Certain File Extensions compares a file's extension to a list. Malware Scanning inspects the file's contents. An extension restriction that blocks .exe uploads does not check whether an uploaded .pdf contains malware, and Malware Scanning does not block a file type your workflow cannot process.

An extension restriction rejects the upload as it happens, and the sender sees the error. Malware Scanning accepts the upload, locks the file while it scans, and moves it to quarantine when malware is detected. The sender sees no error at any point.

Use both on a folder that accepts outside uploads. The extension restriction blocks file types you never accept, and Malware Scanning inspects the contents of the files you do accept.