Excluded, yet still deleted

[nameless]

ESS RC1, WinXP Pro SP2

I added a few files to the exclusion list. Everything seemed fine until I rebooted. I don't know if the reboot is what made the difference, but that's when the problem happened.

I saw a pop-up from ESS (I hate these pop-ups as opposed to the NOD32 2.7 alerts, BTW) saying that "C:\Program Files\Console\process.exe" was deleted and quarantined. OK...WHY? It's in the exclusion list.

So, I went into the exclusion list. I have another file there, "C:\Program Files\Last.fm\process.exe". I selected that file and clicked Edit. ESS deleted that file, too, just after I clicked the Edit button. That is, it deleted it although it was already in the exclusion list.

I don't think this is an issue of SFN versus LFN, and I had really hoped that we were past the days when we had to add two exclusions for each file (a SFN path and a LFN path for each file).

[sparx]

bump...

Also having similar issues. Exclusions still work the same as with 2.7. I was under the assumption that 3.0 would be able to truly exclude the file from being scanned. Any thoughts on the issue would be appreciated.

[HiTech_boy]

It works here .

I excluded a folder called C:\Downloads\
I disabled File system protection and Web protections , downloaded Eicar and put them there.
Rebooted.
After reboot :
I checked (the exclusions are there)
I went to that folder , run the eicar files (nothing from ESS) , Eicar run and disaplayed its text
I attempted right click scan on the folder , excluded seemed ok.

I created an exclusion for one file to test this , too :
C:\eicar.com

After and before reboot it works

It must be something with your system(s).

And don't forget it is non-final ;)

[nameless]

As I reported here (http://www.wilderssecurity.com/showthread.php?t=187410) some months ago, exclusions in ESS/NOD32 3.0 still do not work as they should. As it turns out, one still needs to exclude both the SFN and LFN versions of a path. For example, in this case, I had to exclude:

C:\PROGRA~1\Last.fm\process.exe
C:\Program Files\Last.fm\process.exe
If I don't include the SFN form of the path to process.exe,No matter what I do, it will still be detected by NOD32.

Just an FYI for anyone else who mistakenly thought we were at version 3.0 and nearly in the year 2008.

[nameless]

I take it back... It's not so simple as an SFN issue. I have both paths as shown above specified as exclusions, yet NOD32 still insists on detecting that file.

My wild guess at this point is that NOD32 has trouble parsing the path because it has an imbedded period.

Does anyone dare try reproducing this issue? Please note that you can't slap any old file in a root directory and claim to have tried reproducing it. Rather, either install Last.fm (http://www.last.fm/download/) to C:\Program Files\Last.fm, or create that directory and place process.exe (http://www.beyondlogic.org/solutions/processutil/processutil.htm) in it. Be sure to have potentially unwanted and potentially unsafe options enabled for real-time protection. (I assume that process.exe is the latter.)