Choosing when to scan files with the on-access scanner

You can specify when the on-access scanner examines files: when writing to disk, when reading from disk, both, or let Trellix decide when to scan.

When writing to disk ("Write scan")

Caution

The Write scan option doesn't prevent access to files, either before or after scanning, and so can leave your system vulnerable to attack.

When you select Write scan, the scanner examines the file only after it has been written to disk and closed. A process can perform a Read, Open, or Execute operation on the file before the scanner can perform a Write scan, potentially resulting in infection. Applications might also encounter SHARING_VIOLATION errors if they access the file again after writing it, while a Write scan is in progress.

The on-access scanner examines when files are:

When reading from disk ("Read scan")

Best practice: Enable the Read scan option to provide security against outbreaks.

When you select Read scan, the scanner prevents access to files unless they are determined to be clean.

The on-access scanner examines when files are:

Let Trellix decide

Best practice: Enable this option for the best protection and performance.

When you select this option, the on-access scanner uses trust logic to optimize scanning. Trust logic improves your security and boosts performance with scan avoidance — avoiding unnecessary scans. For example, Trellix analyzes and considers some programs to be trustworthy. If Trellix verifies that these programs haven't been tampered with, the scanner might perform reduced or optimized scanning.

Let me decide

When you select this option, you can choose whether the on-access scanner scans when writing to disk, when reading from disk, or both.