PDA

View Full Version : Exceptions doesnt work (?)


kalbakk
September 8th, 2009, 04:50 AM
Hello

Due to a serious network performance problem I need to temporarily exclude some network shares on a server, but the exceptions I make does no longer affect the real-time filesystem protection.

Is it a known issue that exclusions doesn't work with v4 now ?

On 10 August I added some exclusions because of serious performance degrade while accessing network shares. The exceptions "fixed" the problem as a temporarily solution back then. On 31 August the performance problem was once again an issue, so I had to fully disable real-time protection. After some investigation with Eicar it seems to me that NOD32 doesn't honor the exclusion list at all.

(Of course the real problem is that performance on network shares is severely degraded with NOD32 v4 on the server, but that is another issue that needs to be resolved.)

ASpace
September 8th, 2009, 08:23 AM
In the Real-time file system protection options there is a box that is by default ticked . This box is called "network drivers" and is for scanning network drives . Uncheck it .

If applying network exclusions , make sure they are written in that way:
Z:\*

Where "Z" is just an example of a mapped network drive . The star (*) means everything inside this Z

In addition to the exclusions , you could also enter the ThreatSense scanning engine options , goto "Extensions" and uncheck "Scan all file types" options.


ASpace

kalbakk
September 8th, 2009, 08:46 AM
-{ Quote: "In the Real-time file system protection options there is a box that is by default ticked . This box is called "network drivers" and is for scanning network drives . Uncheck it .

If applying network exclusions , make sure they are written in that way:
Z:\*

Where "Z" is just an example of a mapped network drive . The star (*) means everything inside this Z

In addition to the exclusions , you could also enter the ThreatSense scanning engine options , goto "Extensions" and uncheck "Scan all file types" options.


ASpace" }-


Thanks for your answer, but please not that this is not about excluding network drives. I'm excluding folders in NOD32 on a Windows Server 2003 R2 installation, whose folders are shared and accessed by domain members.

Marcos
September 8th, 2009, 09:24 AM
Could you please post here a screenshot of your exception/exclusion list?

kalbakk
September 8th, 2009, 09:32 AM
-{ Quote: "Could you please post here a screenshot of your exception/exclusion list?" }-

The exclusionslist just contain "G:\*".

This exclusion worked when I added it, but as mentioned some time later exclusions stopped working. I ran SysInternals procmon.exe with and without the exclusion just to be sure, and it is clear that ekrn.exe on the server doesn't honor the exclusionlist.

Marcos
September 8th, 2009, 09:36 AM
Excluding entire drives is not currently supported, only folders and files with folders can be excluded.

kalbakk
September 8th, 2009, 05:09 PM
Thanks for the clarification. A reboot of the server was the solution for me, exclusions now work.