The following file extensions are scanned when the ENSLTP Scan Default Files option is selected:
| ??_ |
DAT |
ICE |
NAP |
SCR |
URL |
| {?? |
D?B |
ico |
NEW |
SCT |
UUU |
| 00 |
deb |
ICS |
NWS |
SH? |
VB? |
| 00? |
DEV |
IM? |
o |
SIS |
VBS |
| 386 |
DIF |
IN? |
OB? |
SKV |
VS? |
| 3GR |
DL? |
ION |
OC? |
SLK |
VVV |
| 7z |
dmg |
IQY |
OD? |
SMM |
VWP |
| a |
DO? |
iso |
OL? |
so |
VXD |
| ACE |
DOC |
ISP |
OLE |
SPL |
WBK |
| ACM |
DOT |
ICE |
OTM |
SRF |
WIZ |
| ADE |
DQY |
ico |
OUT |
SWF |
WMF |
| ADP |
DRV |
ICS |
OV? |
SX? |
WMP |
| ADT |
EE? |
IM? |
patch |
SYS |
WMV |
| AP? |
EFV |
IN? |
PCD |
TAR |
WP? |
| ar |
EML |
ION |
PCI |
TAZ |
WRI |
| ARC |
EX? |
IQY |
PD? |
TBZ |
WRL |
| ARJ |
EXE |
iso |
PDF |
tcl |
WRZ |
| ASA |
FDF |
ISP |
PF? |
TD0 |
WS? |
| ASD |
FE? |
ITS |
PHP |
TFT |
X32 |
| ASP |
FMT |
JAR |
PI? |
TGZ |
XL? |
| AU3 |
FO? |
JP? |
pl |
TLB |
xls |
| AX? |
FPH |
jpg |
PL? |
TSP |
XML |
| B64 |
FPW |
JS? |
PNG |
txt |
XRF |
| BA? |
GF? |
LGP |
POT |
UNP |
XSL |
| BIN |
gif |
LIB |
PP? |
|
XTP |
| BMP |
GIM |
LNK |
ppt |
|
XX? |
| BO? |
GIX |
LSP |
PPZ |
|
Z?? |
| BZ? |
GMS |
LUA |
PRC |
|
Z0M |
| CAB |
GNA |
LWP |
ps |
|
ZI? |
| CC? |
GW? |
LZH |
PWZ |
|
ZIP |
| CDR |
GWI |
M3U |
py |
|
ZL? |
| CDX |
gz |
MB0 |
pyc |
|
ZZZ |
| CEO |
GZ? |
MB1 |
QLB |
|
|
| CGI |
HDI |
MB2 |
QPW |
|
|
| CHM |
HHT |
MBR |
QQY |
|
|
| CLA |
HLP |
MD? |
QTC |
|
|
| CMD |
HT? |
MHT |
RAR |
|
|
NOTE: The scanner only scans regular files. The files in
/sys,
/proc, and
/dev are areas that have block, character, terminal, named pipes, IPC, and sockets files. Event 1046 is generated for these files.
