Sophos Anti-Virus: how to add extensions to the executable files list

Viruses can attack different types of executable files, so in order to detect certain viruses, you may need to change the list of executables that Sophos Anti-Virus scans. You do this by editing the list of file extensions.

What to do

1. Adding extensions centrally with Enterprise Console
2. Windows 2000/XP/2003/Vista version 5 and above
3. Windows NT and Windows 95/98/Me version 4.5 and above
4. Windows NT/2000/XP/2003 versions in maintenance
5. Windows 95/98/Me versions in maintenance
6. NetWare
7. SAV Interface
8. Macintosh
9. OpenVMS
10. Unix

A separate article describes how to remove extensions from the executable files list.

1. Adding extensions centrally with Enterprise Console

• The changes you make will affect all scanning modes.

1. At the Enterprise Console, select the group for which you want to change the settings.
2. Click 'SAV policy' on the toolbar. The 'Anti-virus policy .....' dialog box is displayed.
3. In the bottom panel, click 'Extensions and Exclusions', then select 'Allow me to control exactly what is scanned'.
4. Click 'Add', and in the 'Extension' field, type just the file extension, e.g. PDF.
   Repeat this step for each additional file type you want to add.
5. Click 'OK' to finish.

2. Windows 2000/XP/2003/Vista version 5 and above

Scheduled and immediate scans:

1. Open the 'Sophos Anti-Virus' window.
2. Click 'Configure'|'On-demand extensions and exclusions'.
3. Select the 'Extensions' tab.
4. At the top, select 'Allow me to control exactly what is scanned'.
5. Click Add, and type the file extension, e.g. PDF in the box. Click 'OK'. Repeat this step for each additional file type you want to add.
6. Click 'OK' to finish.

On-access scans:

1. Open the 'Sophos Anti-Virus' window.
2. Click 'Configure'|'On-access scanning'.
3. Select the 'Extensions' tab.
4. At the top, select 'Allow me to control exactly what is scanned'.
5. Click Add, and type the file extension, e.g. PDF in the box. Click 'OK'. Repeat this step for each additional file type you want to add.
6. Click 'OK' to finish.

3. Windows NT and Windows 95/98/Me version 4.5 and above

• The changes you make will affect all scanning modes.

1. Go to Start|Programs|Sophos|Sophos Anti-Virus and run the 'Sophos Anti-Virus' program.
2. Go to Options|Executables... and click 'Add'.
3. Type the new extension in the box. Click 'OK'.
4. Add any other new extensions in the same way.
5. Click 'OK' to finish.

4. Windows NT/2000/XP/2003 versions in maintenance

• The changes you make will take effect in all scanning modes.

1. Go to Start|Programs|Sophos Anti-Virus and run the 'Sophos Anti-Virus' program.
2. Go to Options|Executables... and click on 'Add'.
3. Type the new extension in the box. Click 'OK'.
4. Add any other new extensions in the same way.
5. Click 'OK' to finish.

To return to the default extension list, click 'Default'. Your defined list will override the default list. You should either revert to the default list when you next update, or maintain your own list.

5. Windows 95/98/Me versions in maintenance

On-demand scanning

• The changes you make will take effect in all scanning modes.

1. Go to Start|Programs|Sophos Anti-Virus and run the 'Sophos Anti-Virus' program.
2. Go to Options|Executables... and click on 'Add'.
3. Type the new extension in the box. Click 'OK'.
4. Add any other new extensions in the same way.
5. Click 'OK' to finish.

To return to the default extension list, click 'Default'. Your defined list will override the default list. You should either revert to the default list when you next update, or maintain your own list.

On-access scanning

To add extensions to the list of executables scanned by InterCheck, you will need to add an entry to [InterCheckGlobal] section of the InterChk.cfg file in the Sophos share on your server.

For example, to add the extensions TXT and PDF, insert the lines

AddProgramExtension=TXT
AddProgramExtension=PDF

For the current default extension list, see the latest DOS readme.

To return to the default extension, remove this statement from your InterChk.cfg file. You should either revert to the default list when you next update, or maintain your own list.

6. NetWare

To detect certain viruses, you either need to change the list of executables, or to scan all files.

• Any change made will take effect in immediate, scheduled and real-time modes.

1. Start the Sophos Anti-Virus user interface.
2. In the Main menu, select Administration|Executables|View|Modify.
3. Press the 'Ins' key to insert a new entry.
4. Type the new extension in the box and press 'Enter'.
5. Add any other new extensions in the same way.
6. Press 'Esc' three times to finish.

To return to the default extension list, select 'Set default' in the Executables menu. Your defined list will override the default list. You should either revert to the default list when you next update, or maintain your own list.

7. SAV Interface

SAVI for Windows NT/Windows 2000 scans files as directed, regardless of extension.

SAVI for Unix scans files as directed, regardless of extension.

SAVI for OpenVMS scans files as directed by the third-party application (such as PMDF).

8. Macintosh

All files are scanned by default. You cannot scan extensions separately.

9. Open VMS

All files are scanned by default. The autodefault extension list which is specified with the /AD switch cannot be customised.

10. Unix

Run sweep from the command line using the -ext= command line qualifier.

For example, to scan the files with extensions TXT and PDF only, use

sweep -ext=txt, pdf

To detect viruses in all files, use