Excluding files, folders and drives from scanning operations in VirusScan Enterprise

03/26/2020 7 13020

DESCRIPTION:

Excluding files, folders and drives from scanning operations in VirusScan Enterprise

A notice has been issued for SonicWall Enforced Client's (McAfee and Kaspersky). Please see Notice: End of Support for SonicWall Enforced Client for more information.

RESOLUTION:

Question/Topic:

When configuring detection settings, each of the VirusScan Enterprise scanners allows you to fine-tune the list of file types scanned.

Using wildcards
When using wildcards, these limitations apply:

• Valid wildcards are question mark (?) for excluding single characters and asterisk (*) for excluding multiple characters.

• Wildcards can appear in front of a backslash () in a path. For example:
  C:ABC*XYZ matches C:ABCDEFXYZ.

• An exclusion containing question mark (?) characters applies if the number of characters matches the length of the file or folder name. For example:
  The exclusion W?? excludes WWW, but does not exclude WW or WWWW.

• The syntax is extended to include a double asterisk (**), which means zero or more of any characters including backslash. This allows multiple-depth exclusions.
  For example: C:ABC**XYZ matches C:ABCDEFXYZ and C:ABCDEFDEFXYZ, etc.

Resolution/Workaround:

Specify files, folders, and drives to exclude from scanning operations. You can also remove any exclusions you specified previously.

1. From the VirusScan Console, open the scanner's property pages, then select the Detection tab.
2. Click Exclusions.

Option or Button Description

- Item: File, folder, or drive to exclude from scanning. Click the Add or Edit button to define this information.
Notes and Tips: Default = Windows File Protection.

- Exclude Subfolders: When scanning the item, do not scan its subfolders.
- Read/Write: Do not scan this item when it is being read and/or written.
- Add: Add new items to the list. See Adding or editing exclusion items below.
- Edit: Change items in the list. See Adding or editing exclusion items below.

- Remove:  Delete file types from the list. Select one or more file types in the User-specified additional file types, then click Remove.
Notes and Tips: Use CTRL + SHIFT to select more than one extension.

- Clear: Remove all file types from the user-specified list.

Adding or editing exclusion items

You can use wildcards when adding or editing exclusion items. Choose from these options:

• To add an item, click Add.
• To edit an item, select it in the list, then click Edit.

• 

  Option or Button Description

  - By name/location: Specify the name or location or click Browse to locate it.
  Notes and Tips:�
   - Default = By name/location.
  
   You can specify:
   
    Full pathnames such as C:WINNITSYSTEM*.
   File names such as PAGEFILE.SYS, PAGEFILE.*, P*.*, or *.SYS.
    Folder names such as BACKUP. For example, specifying BACKUP excludes all folders named BACKUP, wherever they are located.
  
    - When specifying a folder, you must append a backslash () to a path to indicate that it is intended to match a folder, or folders, when wildcards are used.

  - Also exclude subfolders: When scanning, exclude the subfolders of the folders that match the specified pattern.
  Notes and Tips:
  When the Also exclude subfolders option is not selected and a path does not end with a backslash (), the path is treated as a file, or files, when wildcards are used

  - By file type: Specify a file type to exclude from scanning.
  - Select: Select file types to exclude from scanning. From the Select File Type dialog box, select one or more file type extensions from the list.
  Notes and Tips: Use CTRL + SHIFT to select more than one file type extension.

  - By file age: Exclude files by age.
  - Access type: If you selected By file age, select the type of access from these options:
    - Modified
   - Created
    - Accessed

  - Minimum age in days: If you selected By file age, specify the minimum age in number of days.
  Notes and Tips: The file must be at least the specified number of days old before it is excluded.

  - Files protected by Windows File Protection: Exclude a file based on its Windows File Protection status.
  - On read:  Exclude the item from scanning when read from disk. This option is not available for on-demand scan tasks.
  - On write: Exclude the item from scanning when written to disk. This option is not available for on-demand scan tasks.

  Source: McAfee VirusScan Enterprise 8.5i Product Guide