The exclude of file type is invalid.

[Tarikzhang]

I had already exclude several file types in the threatsense of real-time file system protection, but I can still see EAV scans these types of file by the infomation of statistics in the protection status. Is this a bug?

[Cudni]

did you something on these lines?
http://kb.eset.com/esetkb/index?page...nt&id=SOLN2153

[Marcos]

Have you tried it with eicar? You can either rename its extension to test extension exclusions or simply put it to an excluded folder and try to access it. If exclusions work, it won't be detected.

[Tarikzhang]

I use the method of the below link, followed the step 6, I add "rar" and any other file types in the box. However, the infomation of statistics shows that the types of files which I have already excluded still be detected.


http://kb.eset.com/esetkb/index?page...=1295358416206

[Marcos]

Originally Posted by Tarikzhang

I use the method of the below link, followed the step 6, I add "rar" and any other file types in the box. However, the infomation of statistics.

Don't look at the Statistics window, it only tells you what files are going through scanners, it does not mean they are actually scanned. Hence I asked if eicar is still detected in spite of having the folder excluded from scanning.

[Tarikzhang]

I'm not trouble with the excluded folder, it works well. My trouble is that the files types exclude which can see in the picture is invalid. I have finished the setting as I posted above, but the real-time protection doesn't ignore the types of files.

http://kb.eset.com/library/ESET/KB%2...tensions_s.png

[Tarikzhang]

Originally Posted by Marcos

Don't look at the Statistics window, it only tells you what files are going through scanners, it does not mean they are actually scanned. Hence I asked if eicar is still detected in spite of having the folder excluded from scanning.

The files show in the Statistics window are not actually scanned? However, when a download job finishing writing a big RAR file to hard disk, I can feel the computer lags a second. At that moment, and the statistic windows just show the file, and the Windows Task Manager shows me that the process of ekrn.exe using 50% of the cpu. thus I guess the exclude is invalid. So, can you tell me any other method to test the exclude?

By the way, I have already tested the folder exclude. When I copy files in two excluded folders, the Statistics window doesn's show any files I copied. However, when I copy files of excluded type, the statistics always show them.

[Marcos]

Originally Posted by Tarikzhang

The files show in the Statistics window are not actually scanned? However, when a download job finish writing a big RAR file to hard disk, I can feel the computer lag a second. The Taskmgr of system shows me that the process of ekrn.exe using 50% of the cpu time at that moment, thus I guess the exclude is invalid. So, can you tell me any other method to test the exclude?

Couldn't it be that web protection scanned the file as you downloaded it? Have you tested it with web protection disabled?

[Tarikzhang]

Originally Posted by Marcos

Couldn't it be that web protection scanned the file as you downloaded it? Have you tested it with web protection disabled?

I exclude the types of file in every threatsense of the monitor.

[Tarikzhang]

Originally Posted by Marcos

Couldn't it be that web protection scanned the file as you downloaded it? Have you tested it with web protection disabled?

You said that the files showed in the statistic window are not actually detected，but one issue bewildered me，why the file in exclude folders won't show in the window yet the files exclude types still be accounted? So I ask if you have any other method to test whether the exclude is valid.

[Marcos]

Originally Posted by Tarikzhang

You said that the files showed in the statistic window are not actually detected,but one issue bewildered me,why the file in exclude folders won't show in the window yet the files exclude types still be accounted? So I ask if you have any other method to test whether the exclude is valid.

Maybe the file has already been scanned? Try doing a test with eicar, it's the best method how to test if exclusions work properly.

[Tarikzhang]

Originally Posted by Marcos

Maybe the file has already been scanned? Try doing a test with eicar, it's the best method how to test if exclusions work properly.

The test of eicar is valid，thank you for ask my question.