Solved Shadow Defender Exclusions

[Overkill]

I'm wanting to exclude Eset from shadow mode and so far I have excluded the following folders...

Are there anymore I need to add?

 

[Deleted member 178]

check if it uses the "users" folders.

be sure ESET doesn't write to the registry when it does updates.

 

[Overkill]

It doesn't use the users folders, how can I tell if it writes to the registry?

 

[Deleted member 178]

ask to the forum

 

[Overkill]

Thanks, you used it before you never excluded it from SD?

 

[Deleted member 178]

i only started using shadow mode at each boot when i was using EIS + WSA and EIS write nothing except in its own folder

 

[Ramblin]

MRF, look in App Data. ESET has to have something in Local and/or Roaming folders. After you find the ESET folders, look at the time stamp of the files in there immediately after performing an update. Thats how you can tell which files change when you update. Afterward, exclude files that changed.

Bo

 

[Plexx]

If I am not mistaken, eset does not update the registry key when signatures are updated.

You may use one of this tools to monitor registry prior to update and then after update.

http://www.raymond.cc/blog/tracking-registry-and-files-changes-when-installing-software-in-windows/

hope it helps.

 

[Overkill]

MRF, look in App Data. ESET has to have something in Local and/or Roaming folders. After you find the ESET folders, look at the time stamp of the files in there immediately after performing an update. Thats how you can tell which files change when you update. Afterward, exclude files that changed.

Bo

I don't see eset in local or roaming Bo

---

Thanks guys, I'll just ask in the forum

 

[Ramblin]

I don't see eset in local or roaming Bo

I just searched a little, you are correct, it seems that on W7, ESET folders are located in Program files and ProgramData only. I found this article that mentions folders "Updfiles" and "Charon" as being related to updates. They are located in ProgramData.

I would try excluding those folders instead of the whole ESET folder in ProgramData to see if it makes a difference. I also see files that resemble "em0**_32.dat files", they are located in Program Files and are also related to ESETs updates. Make an exclusion to the folders within the ESET folder where they are located instead of the whole ESET folder in Program files.

http://kb.eset.cz/esetkb/index?page=content&id=soln2134

It might work. Maybe, the less you exclude, the better the chances for the exclusion to work.

I started using SD a few days ago, I only exclude my Download folder and bookmarks for Firefox. Exclusions work great for that. I would try excluding definitions to see how that works but I don't have any program that updates definitions.

Bo

 

[illumination]

I quit using the exclusions myself. Every day i start up my system, update everything, and then when that is done i throw it in shadow mode, of course it helps that im running CIS 6 as it by default checks every 6 hours.

 

[Overkill]

Found this on wilders


For Windows XP:
C:\Program Files\ESET
C:\Documents and Settings\All Users\Application Data\ESET
C:\Documents and Settings\%USER%\Application Data\ESET

For Windows Vista and Windows 7:
C:\Program Files\ESET
C:\ProgramData\ESET

As said, some update files will be held in the registry and there's no way to add these keys to the exclusion.

http://www.wilderssecurity.com/showthread.php?t=322742