NOD32 File Exclusions -- Excluding a file from all sub-directories using wildcards

[Guest Daniel (deloppoled)]

Hello,

 

Been a big fan of NOD32 for a long time and now with version 6 on Windows 8, I've run into a problem that I don't recall ever having before--exclusing a certain filename.ext from being scanned, no matter where on a particular drive the file may show up.

 

For instance let's call my files nicefile1.exe and nicefile2.exe any time that file shows up anywhere on HDD "D:\" I don't want NOD32 to scan it.

 

So here are a few random examples:

 

D:\nicefile1.exe

D:\sub1\nicefile2.exe

D:\sub1\sub2\nicefile1.exe

D:\sub1\sub2\sub3\nicefile2.exe

D:\sub1\sub2\sub3\sub4\nicefile1.exe

D:\sub1\sub2\sub3\sub4\sub5\nicefile3.exe

 

The only way that I've been able to get NOD32 to ignore these files has been like this:

(In my Exclusions list I've added these)

 

D:\nicefile*.exe
D:\*\nicefile*.exe
D:\*\*\nicefile*.exe
D:\*\*\*\nicefile*.exe
D:\*\*\*\*\nicefile*.exe
D:\*\*\*\*\*\nicefile*.exe
D:\*\*\*\*\*\*\nicefile*.exe
D:\*\*\*\*\*\*\*\nicefile*.exe
D:\*\*\*\*\*\*\*\*\nicefile*.exe
D:\*\*\*\*\*\*\*\*\*\nicefile*.exe
D:\*\*\*\*\*\*\*\*\*\*\nicefile*.exe

 

I've tried any and all wildcards that seemed to make sense and even most that didn't! I haven't used a lot of wildcards since my MSDOS v3-v6 days and some on QNX so I may be a bit out of practice! Here's what I've tried in my Exclusions List within the NOD32 Advanced interface:

 

*nicefile*.exe
.nicefile*.exe

.*nicefile*.exe

*.nicefile*.exe

*.*nicefile*.exe
*.*\nicefile*.exe
*\nicefile*.exe
*.\nicefile*.exe
*.*\nicefile*.exe
D:\nicefile*.exe -- This works if nicefilfe.exe is in the root folder i.e. D:\nicefile1.exe
D:\*\nicefile*.exe -- This works if nicefilfe.exe is one folder down/deep from root i.e. D:\sub1\nicefile2.exe
D:\*\*\nicefile*.exe -- This works if nicefilfe.exe is two folders down/deep from root i.e. D:\sub1\sub2\nicefile1.exe
D:\*\*\*\nicefile*.exe -- This works if nicefilfe.exe is three folders down/deep from root i.e. D:\sub1\sub2\sub3\nicefile2.exe
D:\*\*\*\*\nicefile*.exe -- This works if nicefilfe.exe is four folders down/deep from root i.e. D:\sub1\sub2\sub3\sub4\nicefile1.exe
D:\*\*\*\*\*\nicefile*.exe -- This works if nicefilfe.exe is five folders down/deep from root D:\sub1\sub2\sub3\sub4\sub5\nicefile1.exe

 

 

While it works to do this

 

D:\NiceFile*.exe|
D:\*\NiceFile*.exe|
D:\*\*\NiceFile*.exe|
D:\*\*\*\NiceFile*.exe|
D:\*\*\*\*\NiceFile*.exe|
D:\*\*\*\*\*\NiceFile*.exe|
D:\*\*\*\*\*\*\NiceFile*.exe|
D:\*\*\*\*\*\*\*\NiceFile*.exe|
D:\*\*\*\*\*\*\*\*\NiceFile*.exe|
D:\*\*\*\*\*\*\*\*\*\NiceFile*.exe|
D:\*\*\*\*\*\*\*\*\*\*\NiceFile*.exe|
 

That get's pretty repetitive even if I script it. I worry that if I exclude, say a dozen files, from each of my working drives, we could be talking about 12(files to exclude) X 11 (Exclusions per file per drive) X 20 HDD = 12x11x20=2,640 ENRTIES IN MY EXCLUSIONS LIST! While I could script the data entry portion, to make all of those entries in the Exclusions List fairly easily, what I would worry about is having all of those Exclusions may have an impact NOD32 performance?

 

Oh by the way, I did discover that if you enter a "|" between entries, you can enter many entries at one time like this:

D:\NiceFile*.exe|D:\*\NiceFile*.exe|D:\*\*\NiceFile*.exe|D:\*\*\*\NiceFile*.exe|D:\*\*\*\*\NiceFile*.exe|D:\*\*\*\*\*\NiceFile*.exe|D:\*\*\*\*\*\*\NiceFile*.exe|D:\*\*\*\*\*\*\*\NiceFile*.exe|D:\*\*\*\*\*\*\*\*\NiceFile*.exe|D:\*\*\*\*\*\*\*\*\*\NiceFile*.exe|D:\*\*\*\*\*\*\*\*\*\*\NiceFile*.exe

 

I hope that this all makes sense and that perhaps someone here can help me with the wild card syntax! I certainly could use it!

 

Dan

[Marcos 5,249]

Unfortunately, this is the only possible workaround. Excluding files just by names regardless of the path is dangerous as malware could use that name to evade detection.

[Guest Guest]

Thank you for the rapid response Marcos! Do you think that if I were to enter that many exclusions it would have a great impact on system performance?

 

I have a pretty up-to-date PC (Processor : Intel® Core i7-3770 CPU @ 3.40GHz (4C 8T 3.9GHz, 3.9GHz IMC, 4x 256kB L2, 8MB L3 and 32GB DIMM DDR3 RAM)  but still!

 

At least NOD32 affords the option of an Exclusion List, many don't! That's just one of the many reasons that I'm a big ESET fan/supporter,

Thanks again, appreciate your feedback!

Dan

[Marcos 5,249]

I don't think entering many exclusions would make any noticeable impact on the system performance.