Excluded, yet still deleted

Discussion in 'ESET Smart Security' started by nameless, Oct 4, 2007.

Thread Status:
Not open for further replies.
  1. nameless

    nameless Registered Member

    Joined:
    Feb 23, 2003
    Posts:
    1,184
    ESS RC1, WinXP Pro SP2

    I added a few files to the exclusion list. Everything seemed fine until I rebooted. I don't know if the reboot is what made the difference, but that's when the problem happened.

    I saw a pop-up from ESS (I hate these pop-ups as opposed to the NOD32 2.7 alerts, BTW) saying that "C:\Program Files\Console\process.exe" was deleted and quarantined. OK...WHY? It's in the exclusion list.

    So, I went into the exclusion list. I have another file there, "C:\Program Files\Last.fm\process.exe". I selected that file and clicked Edit. ESS deleted that file, too, just after I clicked the Edit button. That is, it deleted it although it was already in the exclusion list.

    I don't think this is an issue of SFN versus LFN, and I had really hoped that we were past the days when we had to add two exclusions for each file (a SFN path and a LFN path for each file).
     
  2. sparx

    sparx Registered Member

    Joined:
    Jan 10, 2007
    Posts:
    60
    bump...

    Also having similar issues. Exclusions still work the same as with 2.7. I was under the assumption that 3.0 would be able to truly exclude the file from being scanned. Any thoughts on the issue would be appreciated.
     
  3. ASpace

    ASpace Guest

    It works here .

    I excluded a folder called C:\Downloads\
    I disabled File system protection and Web protections , downloaded Eicar and put them there.
    Rebooted.
    After reboot :
    I checked (the exclusions are there)
    I went to that folder , run the eicar files (nothing from ESS) , Eicar run and disaplayed its text
    I attempted right click scan on the folder , excluded seemed ok.

    I created an exclusion for one file to test this , too :
    C:\eicar.com

    After and before reboot it works

    It must be something with your system(s).

    And don't forget it is non-final ;)
     

    Attached Files:

    • 1.PNG
      1.PNG
      File size:
      17.2 KB
      Views:
      209
    • 2.PNG
      2.PNG
      File size:
      25.4 KB
      Views:
      2
    • 3.PNG
      3.PNG
      File size:
      26 KB
      Views:
      214
  4. nameless

    nameless Registered Member

    Joined:
    Feb 23, 2003
    Posts:
    1,184
    Exclusions still require short paths--strange but true

    As I reported here some months ago, exclusions in ESS/NOD32 3.0 still do not work as they should. As it turns out, one still needs to exclude both the SFN and LFN versions of a path. For example, in this case, I had to exclude:

    Code:
    C:\PROGRA~1\Last.fm\process.exe
    C:\Program Files\Last.fm\process.exe
    If I don't include the SFN form of the path to process.exe,No matter what I do, it will still be detected by NOD32.

    Just an FYI for anyone else who mistakenly thought we were at version 3.0 and nearly in the year 2008.
     
    Last edited: Dec 14, 2007
  5. nameless

    nameless Registered Member

    Joined:
    Feb 23, 2003
    Posts:
    1,184
    Re: Exclusions still require short paths--strange but true

    I take it back... It's not so simple as an SFN issue. I have both paths as shown above specified as exclusions, yet NOD32 still insists on detecting that file.

    My wild guess at this point is that NOD32 has trouble parsing the path because it has an imbedded period.

    Does anyone dare try reproducing this issue? Please note that you can't slap any old file in a root directory and claim to have tried reproducing it. Rather, either install Last.fm to C:\Program Files\Last.fm, or create that directory and place process.exe in it. Be sure to have potentially unwanted and potentially unsafe options enabled for real-time protection. (I assume that process.exe is the latter.)
     
Thread Status:
Not open for further replies.