Reply to thread

Message

<blockquote data-quote="ForgottenSeer 58943" data-source="post: 698660">Some INI changes I recommend - very safe, well tested changes. FortiClient by default &#039;assumes&#039; it&#039;s being installed on the lowest common denominator PC, a dual core with 2GB of Ram and sets itself with such an assumption. With that in mind, you can test the following below, compare it with your own conf.&lt;use_extreme_db&gt;1&lt;/use_extreme_db&gt;--this setting enables zoo signatures. The entire Fortinet virus/trojan/rootkit/ransomware database. Old, Not so old and brand new.&lt;heuristic_scanning&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;level&gt;1&lt;/level&gt;--this setting enables heuristics for the realtime engine. It defaults to OFF. (0) Consider the following; 0-Off, 1-Low, 2-Medium, 3-High.. Depending on PC horsepower you can increase it as you desire, false positives become more possible as you increase the number but detection is &#039;significantly&#039; improved in the process.Here&#039;s the relevant snippets from the INI. Once again, these settings are completely safe to tweak. I would avoid tweaking the threading, GPU use and other settings as you could potentially cause issues without knowing their full purpose and parameters.&lt;real_time_protection&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;enabled&gt;1&lt;/enabled&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;use_extreme_db&gt;1&lt;/use_extreme_db&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;when&gt;0&lt;/when&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;ignore_system_when&gt;2&lt;/ignore_system_when&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;on_virus_found&gt;5&lt;/on_virus_found&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;popup_alerts&gt;1&lt;/popup_alerts&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;popup_registry_alerts&gt;0&lt;/popup_registry_alerts&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;bypass_java&gt;0&lt;/bypass_java&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;cloud_based_detection&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;on_virus_found&gt;4&lt;/on_virus_found&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;/cloud_based_detection&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;sandboxing&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;use_sandbox_signatures&gt;1&lt;/use_sandbox_signatures&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;/sandboxing&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;compressed_files&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;scan&gt;1&lt;/scan&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;maxsize&gt;10&lt;/maxsize&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;/compressed_files&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;riskware&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;enabled&gt;1&lt;/enabled&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;/riskware&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;adware&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;enabled&gt;1&lt;/enabled&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;/adware&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;heuristic_scanning&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;level&gt;1&lt;/level&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;action&gt;3&lt;/action&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;/heuristic_scanning&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;scan_file_types&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;all_files&gt;0&lt;/all_files&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;file_types&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;extensions&gt;.386,.ACE,.ACM,.ACV,.ACX,.ADT,.APP,.ASD,.ASP,.ASX,.AVB,.AX,.AX2,.BAT,.BIN,.BTM,.CDR,.CFM,.CHM,.CLA,.CLASS,.CMD,.CNN,.COM,.CPL,.CPT,.CPY,.CSC,.CSH,.CSS,.DEV,.DLL,.DOC,.DOT,.DRV,.DVB,.DWG,.EML,.EXE,.FON,.GMS,.GVB,.HLP,.HTA,.HTM,.HTML,.HTT,.HTW,.HTX,.HXS,.INF,.INI,.JPG,.JS,.JTD,.KSE,.LGP,.LIB,.LNK,.MDB,.MHT,.MHTM,.MHTML,.MOD,.MPD,.MPP,.MPT,.MRC,.OCX,.PIF,.PL,.PLG,.PM,.PNF,.PNP,.POT,.PPA,.PPS,.PPT,.PRC,.PWZ,.QLB,.QPW,.REG,.RTF,.SBF,.SCR,.SCT,.SH,.SHB,.SHS,.SHT,.SHTML,.SHW,.SIS,.SMM,.SWF,.SYS,.TD0,.TLB,.TSK,.TSP,.TT6,.VBA,.VBE,.VBS,.VBX,.VOM,.VSD,.VSS,.VST,.VWP,.VXD,.VXE,.WBK,.WBT,.WIZ,.WK,.WML,.WPC,.WPD,.WSC,.WSF,.WSH,.XLS,.XML,.XTP&lt;/extensions&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;include_files_with_no_extension&gt;0&lt;/include_files_with_no_extension&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;/file_types&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;/scan_file_types&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;exclusions&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;file /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;folder /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;file_types&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;extensions&gt;.zip,.gzip,.msc,.rar,.tar,.tgz,.lzh,.CAB,.BZIP2,.7Z,.BZIP,.ARJ&lt;/extensions&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;/file_types&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;/exclusions&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;/real_time_protection&gt;</blockquote>

[QUOTE="ForgottenSeer 58943, post: 698660"] Some INI changes I recommend - very safe, well tested changes. FortiClient by default 'assumes' it's being installed on the lowest common denominator PC, a dual core with 2GB of Ram and sets itself with such an assumption. With that in mind, you can test the following below, compare it with your own conf. <use_extreme_db>1</use_extreme_db> --this setting enables zoo signatures. The entire Fortinet virus/trojan/rootkit/ransomware database. Old, Not so old and brand new. <heuristic_scanning> <level>1</level> --this setting enables heuristics for the realtime engine. It defaults to OFF. (0) Consider the following; 0-Off, 1-Low, 2-Medium, 3-High.. Depending on PC horsepower you can increase it as you desire, false positives become more possible as you increase the number but detection is 'significantly' improved in the process. Here's the relevant snippets from the INI. Once again, these settings are completely safe to tweak. I would avoid tweaking the threading, GPU use and other settings as you could potentially cause issues without knowing their full purpose and parameters. <real_time_protection> <enabled>1</enabled> <use_extreme_db>1</use_extreme_db> <when>0</when> <ignore_system_when>2</ignore_system_when> <on_virus_found>5</on_virus_found> <popup_alerts>1</popup_alerts> <popup_registry_alerts>0</popup_registry_alerts> <bypass_java>0</bypass_java> <cloud_based_detection> <on_virus_found>4</on_virus_found> </cloud_based_detection> <sandboxing> <use_sandbox_signatures>1</use_sandbox_signatures> </sandboxing> <compressed_files> <scan>1</scan> <maxsize>10</maxsize> </compressed_files> <riskware> <enabled>1</enabled> </riskware> <adware> <enabled>1</enabled> </adware> <heuristic_scanning> <level>1</level> <action>3</action> </heuristic_scanning> <scan_file_types> <all_files>0</all_files> <file_types> <extensions>.386,.ACE,.ACM,.ACV,.ACX,.ADT,.APP,.ASD,.ASP,.ASX,.AVB,.AX,.AX2,.BAT,.BIN,.BTM,.CDR,.CFM,.CHM,.CLA,.CLASS,.CMD,.CNN,.COM,.CPL,.CPT,.CPY,.CSC,.CSH,.CSS,.DEV,.DLL,.DOC,.DOT,.DRV,.DVB,.DWG,.EML,.EXE,.FON,.GMS,.GVB,.HLP,.HTA,.HTM,.HTML,.HTT,.HTW,.HTX,.HXS,.INF,.INI,.JPG,.JS,.JTD,.KSE,.LGP,.LIB,.LNK,.MDB,.MHT,.MHTM,.MHTML,.MOD,.MPD,.MPP,.MPT,.MRC,.OCX,.PIF,.PL,.PLG,.PM,.PNF,.PNP,.POT,.PPA,.PPS,.PPT,.PRC,.PWZ,.QLB,.QPW,.REG,.RTF,.SBF,.SCR,.SCT,.SH,.SHB,.SHS,.SHT,.SHTML,.SHW,.SIS,.SMM,.SWF,.SYS,.TD0,.TLB,.TSK,.TSP,.TT6,.VBA,.VBE,.VBS,.VBX,.VOM,.VSD,.VSS,.VST,.VWP,.VXD,.VXE,.WBK,.WBT,.WIZ,.WK,.WML,.WPC,.WPD,.WSC,.WSF,.WSH,.XLS,.XML,.XTP</extensions> <include_files_with_no_extension>0</include_files_with_no_extension> </file_types> </scan_file_types> <exclusions> <file /> <folder /> <file_types> <extensions>.zip,.gzip,.msc,.rar,.tar,.tgz,.lzh,.CAB,.BZIP2,.7Z,.BZIP,.ARJ</extensions> </file_types> </exclusions> </real_time_protection> [/QUOTE]

Verification