Express Antivirus Limitations

Express antivirus has the following limitations when compared to full antivirus functionality:

• Express antivirus provides limited support for the scanning of file archives and compressed file formats. Express antivirus can only support gzip, deflate and compressed compressing formats.
• Express antivirus provides limited support for decompression. Decompression is only supported with HTTP (supports only gzip, deflate, and compress for HTTP and only supports one layer of compression) and POP3 (supports only gzip for POP3 and only supports one layer of compression).
• Express antivirus does not support scanning by extension.
• Express antivirus scanning is interrupted when the scanning database is loading.
• Express antivirus may truncate a warning message if a virus has been detected and the replacement warning message that is sent is longer than the original content it is replacing.

Note: Because express antivirus does only packet based string matching, if you use the standard EICAR file to test express antivirus, you will see false positives. To avoid these false positives, Juniper has disabled scanning on the standard EICAR file to create a modified EICAR file for testing express antivirus. You can download this modified EICAR file from the following links: http://www.juniper.net/security/avtest/ss-eicar.txt http://www.juniper.net/security/avtest/ss-eicar.com http://www.juniper.net/security/avtest/ss-eicar.zip