Jump to content
DeltaSM

ESET Endpoint Antivirus - Exclusion in users account folder (APPDATA)

Recommended Posts

Hello,

We have the following version of the ESET Endpoint Antivirus: 7.1.253.0.

We purchased a new development software. In its prerequisites, it is asked to add exceptions in antivirus software in the following location:
%LOCALAPPDATA%\JetBrains\Transient

So i tried to add this in ESET (performance exclusion):

%LOCALAPPDATA%\JetBrains\Transient\*

%HOMEPATH%\AppData\Local\JetBrains\Transient\*

%USERPROFILE%\AppData\Local\JetBrains\Transient\*

Nothing is working.

C:\Users\*\AppData\Local\JetBrains\Transient\*

Still not working.

I read the following article:
https://help.eset.com/eea/7/en-US/idh_exclude_format.html?idh_performance_exclusion.html

Indeed, %LOCALAPPDATA%, %HOMEPATH% or even %USERPROFILE% are not working. This is really annoying...
I did another test with %PROGRAMFILES% and it works well but this is not a solution...

Is there any workaround?

Kind Regards,

DeltaSM

Share this post


Link to post
Share on other sites

User variables do not resolve under the local system account under which ekrn.exe is run. That's why such exclusions cannot work. You can use C:\Users\*\AppData\Local\JetBrains\Transient\*.*, however, this is not officially supported and may not work if you add other exclusions.

Share this post


Link to post
Share on other sites

Hello Marcos,

Indeed, this makes sense. I understand.

I just tried C:\Users\*\AppData\Local\JetBrains\Transient\*.* but it doesn't work.

I guess there is not other solution?

Share this post


Link to post
Share on other sites

Is it the only exclusion in the list? Have you tested it by putting the eicar test file there and subsequently accessing it?

Share this post


Link to post
Share on other sites
1 hour ago, DeltaSM said:

I just tried C:\Users\*\AppData\Local\JetBrains\Transient\*.* but it doesn't work.

As far as I am aware of, Eset doesn't support wildcards in a file path name. Only at the end of the path name using \* or \*.*.

Edited by itman

Share this post


Link to post
Share on other sites

@Marcos I tried these two examples:
1st: Disabling all ESET protections.

2nd: Creating exceptions in Performance exclusions with the following paths:
A. C:\Users\*\AppData\Local\JetBrains\Transient\*.*
B. %PROGRAMFILES%\Test\*

3rd: Downloading and pasting EICAR test files in those folders.

4th: Turning all protections ON again

Test A is not working and when accessing to the folder and files are deleted.
Test B is working and when accessing to the folder are still present.

As mentioned by @itman I think that wildcards are not support in a path except for the end.

This is really annoying :(

Share this post


Link to post
Share on other sites

While it is true that wildcards in the path are not supported in performance exclusions, they may work but may also stop to work as further exclusions are added.

Share this post


Link to post
Share on other sites

So no solution unfortunately :( I will try to find a workaround.

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.


  • Recently Browsing   0 members

    No registered users viewing this page.

×
×
  • Create New...