Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 5 replies
  • Subscribers 1 subscriber
  • Views 2312 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

" on access" process exlcusions

danpalmer

Good morning.

I am seeking confirmation on howto exclude windows "process" from the on access scanner.

The only way i seem to be able to find is within the exclusions and then add the .exe name as a "File" type exlusion.

Is this correct?

:26007


This thread was automatically locked due to age.
  • 0

    Hello danpalmer,

    I'm not sure I correctly understand what you want to achieve? Do you want the process (i.e. the executable) being exempt from scanning or the files accessed by the process?

    Christian

    :26013
  • 0

    i want to exclude the .exe (there are a few as it's exchange 2010) read/writes being scanned.

    i am just concerned adding the .exe into the exclusions as "file" may only exclude file itself and not the process.

    thanks.

    :26015
  • 0

    I see - indeed an exclusion applies just to the file (and a warning, BTW: It applies to all files with the same name regardless of their location).

    So this is about on-access scanning on an Exchange server? Any particular problem you want to solve or do you want to implement the File-Level Antivirus Scanning on Exchange 2010 recommendations? To be honest, I don't get what they mean by the Process Exclusions ... As suggested in the comments you should consider an "Exchange aware" product.

    Or did I misunderstand you?

    Christian

    :26017
  • 0

    indeed the ms recommendations are what we are looking to implement.

    having come from a mcafee background this was easy to apply.

    i am surprised it can't be done.

    :26019
  • 0

    Hello Dan,

    I assumed something like this. Ascribe it to different paradigms or "cultures" - different vendors have different views.

    You can do it with Sophos in case you desperately need it (see: Re: How to exclude a process? - but I want to emphasize Jak's warning). Perhaps slightly exaggerated - you might be better off just disabling on-access scanning. The serious alternative - as said - is AV specifically for Exchange (PureMessage for Exchange might be already included in your license).

    Christian

    :26021