Anti-Malware Files and Folders Exclusion

Anti-Malware -> Files and Folders Exclusion (system, scheduled and on-demand)

Files and Folder Exclusions are applied to all types of scans except contextual scan. The reason for configuring exclusions is to reduce the CPU usage of Anti-Malware.

Note:

Files and folders must be excluded only if they are located in a Trusted zone or are considered a low-risk target for viruses.

Windows

Syntax:

Directory paths must end with a backlash.

Examples:

  • Directory:

    • C:\Program Files\MyTrustedDirectory\

    • %programdata%\MyTrustedDirectory\

  • Specific file:

    • C:\ProgramFiles\MyTrustedDirectory\excludeMe.txt

    • %programdata%\MyTrustedDirectory\excludeMe.txt

  • File type:

    • *.exe

    • \\ServerName\Share\folder\file.txt or \\ip_addres\Share\folder\file.txt depending on a way file is attached.

    • C:\Program Files\MyTrustedDirectory**.exe(recursive exclusion - applies for all .exe in C:\Program Files\MyTrustedDirectory\ and all subfolders)

  • For Endpoint Security client version E80.80 or higher, you can exclude MD5 hash from the scheduled malware scan. For example:

    • md5:0123456789012345

      • Exclude by hash in any folder

    • md5:0123456789012345:app.exe

      • Exclude by hash and exact file name

    • md5:0123456789012345:c:\folder\app.exe

      • Exclude by hash and full path

    • md5:0123456789012345:%ENV%\app.exe

      • Exclude by hash and environment variable

  • For Endpoint Security client version E86.10 or higher, you can exclude URL from the scheduled malware scan. For example:

    • url:*.example.com

    • url:http://*.example.com

    • url:http://example.com/*

    • url:www.example.com/abc/123

    • url:*192.168.*

    • url:http://192.168.*

Notes for URL exclusions-

  • The * character replaces any sequence that contains zero or more characters.

  • The www. character sequence at the beginning of an exclusion mask is interpreted as a *. sequence.

  • If an exclusion mask does not start with the * character, the content of the exclusion mask is equivalent to the same content with the *. prefix.

  • If an exclusion mask ends with a character other than / or *, the content of the exclusion mask is equivalent to the same content with the /* postfix.

  • If an exclusion mask ends with the / character, the content of the exclusion mask is equivalent to the same content with the /*. postfix.

  • The character sequence /* at the end of an exclusion mask is interpreted as /* or an empty string.

  • URLs are verified against an exclusion mask, taking into account the protocol (http or https).
Note:

For Windows, files and folder names are not case-sensitive.

macOS

Syntax:

Directory path, a specific file, or a file type. Environment variables are not supported.

Example:

Trusted directory

  • /Users/Shared/MyTrustedDirectory/

Specific file

  • /Users/*/Documents/excludeMe.txt

File type

  • *.txt

Note:

For macOS, files and folder names are case-sensitive.

  • Folder can contain environment variables

  • Folder cannot contain wildcards (*)

  • By default, sub-folders are included.