ESET Endpoint Antivirus - Exclusion in users account folder (APPDATA)

[DeltaSM 0]

Hello,

We have the following version of the ESET Endpoint Antivirus: 7.1.253.0.

We purchased a new development software. In its prerequisites, it is asked to add exceptions in antivirus software in the following location:
%LOCALAPPDATA%\JetBrains\Transient

So i tried to add this in ESET (performance exclusion):

%LOCALAPPDATA%\JetBrains\Transient\*

%HOMEPATH%\AppData\Local\JetBrains\Transient\*

%USERPROFILE%\AppData\Local\JetBrains\Transient\*

Nothing is working.

C:\Users\*\AppData\Local\JetBrains\Transient\*

Still not working.

I read the following article:
https://help.eset.com/eea/7/en-US/idh_exclude_format.html?idh_performance_exclusion.html

Indeed, %LOCALAPPDATA%, %HOMEPATH% or even %USERPROFILE% are not working. This is really annoying...
I did another test with %PROGRAMFILES% and it works well but this is not a solution...

Is there any workaround?

Kind Regards,

DeltaSM

[Marcos 5,074]

User variables do not resolve under the local system account under which ekrn.exe is run. That's why such exclusions cannot work. You can use C:\Users\*\AppData\Local\JetBrains\Transient\*.*, however, this is not officially supported and may not work if you add other exclusions.

[DeltaSM 0]

Hello Marcos,

Indeed, this makes sense. I understand.

I just tried C:\Users\*\AppData\Local\JetBrains\Transient\*.* but it doesn't work.

I guess there is not other solution?

[Marcos 5,074]

Is it the only exclusion in the list? Have you tested it by putting the eicar test file there and subsequently accessing it?

[itman 1,659]

1 hour ago, DeltaSM said:

I just tried C:\Users\*\AppData\Local\JetBrains\Transient\*.* but it doesn't work.

As far as I am aware of, Eset doesn't support wildcards in a file path name. Only at the end of the path name using \* or \*.*.

Edited November 15, 2019 by itman

[DeltaSM 0]

@Marcos I tried these two examples:
1st: Disabling all ESET protections.

2nd: Creating exceptions in Performance exclusions with the following paths:
A. C:\Users\*\AppData\Local\JetBrains\Transient\*.*
B. %PROGRAMFILES%\Test\*

3rd: Downloading and pasting EICAR test files in those folders.

4th: Turning all protections ON again

Test A is not working and when accessing to the folder and files are deleted.
Test B is working and when accessing to the folder are still present.

As mentioned by @itman I think that wildcards are not support in a path except for the end.

This is really annoying

[Marcos 5,074]

While it is true that wildcards in the path are not supported in performance exclusions, they may work but may also stop to work as further exclusions are added.

[DeltaSM 0]

So no solution unfortunately I will try to find a workaround.