KathyJ

My Exclusion Settings aren't working

Recommended Posts

I have the recent version of Emisoft Internet Security, 2017.4.1.7484 on Windows 7 Service Pack2 .  Every time I do a scan,  it will show a particular file in my downloads folder that is installed on my system. It has never given me a problem and I don't want it deleted so rather than letting it quarantine it, I put it in the exclusions. But, each time I do another scan, it is as though I haven't excluded it. I check my excluded settings and it is still listed so why isn't it excluding it rather than scanning it?

Share this post


Link to post
Share on other sites

Could you post a screenshot of the exclusions definition?  (Only support staff will then be able to see that, not normal users like me.)

Added later: I'm sorry, what I wrote about 'only support staff' is wrong.  I keep forgetting this.  It used to be true but isn't any longer, so if any details in a screenshot contain any values you'd not want other people to see, you'd need to use a picture-editing tool to blot those out first.  Sorry.

Share this post


Link to post
Share on other sites

Which exclusions did you add it to? The exclusions for scanning, or the exclusions for monitoring?

Share this post


Link to post
Share on other sites
6 hours ago, GT500 said:

Which exclusions did you add it to? The exclusions for scanning, or the exclusions for monitoring?

The exclusions for scanning until yesterday. Since the scanning exclusion wasn't working by itself, I added it to the monitoring exclusions in addition to the scanning exclusions. This file has been on my system for many months and until recently was being scanned by Emsisoft Internet Security without any problems at all. Why has it started causing problems? The program itself hasn't changed.

Share this post


Link to post
Share on other sites
13 hours ago, JeremyNicoll said:

Could you post a screenshot of the exclusions definition?  (Only support staff will then be able to see that, not normal users like me.)

Added later: I'm sorry, what I wrote about 'only support staff' is wrong.  I keep forgetting this.  It used to be true but isn't any longer, so if any details in a screenshot contain any values you'd not want other people to see, you'd need to use a picture-editing tool to blot those out first.  Sorry.

Maybe this is what you want to see:

 

Emsisoft exclusions.jpg
Download Image

Share this post


Link to post
Share on other sites

Arthur (gt500): I don't know if it's relevant, but I've never seen an entry like the second one in the scanning exclusions before.  What do the bits after the arrows mean?  (Maybe that's one of those setup .exe's which unzips/unpacks files when it's run and this is something to do with one of the contained files? But how would a user get that definition into there?)  Also, isn't that the same base .exe as in the definition above that?  Why would EIS let you define the same exclusion twice?

Share this post


Link to post
Share on other sites
10 hours ago, JeremyNicoll said:

... I've never seen an entry like the second one in the scanning exclusions before.  What do the bits after the arrows mean?

If you add the EICAR test file to an archive along with a few other files, and then scan it and select to exclude the detection from the scan results, then it will add the following to the exclusions:

C:\USERS\GT500\DESKTOP\RANDOM_ARCHIVE.7Z -> EICAR.COM

If you have more than one file detected in the same archive, and you exclude them all, then it adds a separate exclusion for each file in the archive that looks like the above. If you have and archive within an archive that also contains the EICAR test file, and add that detection to the exclusions from the scan result, then the exclusion will look like this:

C:\USERS\GT500\DESKTOP\RANDOM_ARCHIVE.7Z -> SECOND_RANDOM_ARCHIVE.7Z -> EICAR.COM.TXT

I think his exclusions have the parenthesis around them because they are installer modules.

 

11 hours ago, KathyJ said:

Maybe this is what you want to see:

Try removing the second entry in the scanning exclusions that looks like the following, and let me know if that helps:

C:\BELLSOUTH DOWNLOADS\CDBXP_SETUP_4.5.1.3868.EXE -> (INSTYLER O) -> (INSTYLER MODULE 1)

 

Share this post


Link to post
Share on other sites
13 hours ago, GT500 said:

Try removing the second entry in the scanning exclusions that looks like the following, and let me know if that helps:

C:\BELLSOUTH DOWNLOADS\CDBXP_SETUP_4.5.1.3868.EXE -> (INSTYLER O) -> (INSTYLER MODULE 1)

 I removed it and it worked as it should. I did a full system scan and it didn't find anything this time. Why did that make a difference? It had listed the second file in suspicious files along with the CDBXP SETUP file.

 

Share this post


Link to post
Share on other sites

It may have been overriding the other exclusion, and causing contents of the file that were not covered by it (the exclusion you removed) to be detected.

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.


  • Recently Browsing   0 members

    No registered users viewing this page.