Antivirus with file instead of location exceptions?

Galane · 30 Nov 2016

I'd like to have an antivirus that when I set an exemption for a file, it will ignore that file everywhere. There are many things like utility programs, demos (especially ones from Farbrausch) and other things using unusual programming techniques that cause antivirus and antimalware programs to have a fit.

Currently, Windows Defender is insistent upon deleting the setup.exe for Kerbal Space Program 1.05.

I want a security program that when I tell it to ignore a specific program, it ignores it no matter where it is on my computer, not just in a specific location so that if I move it or want to run it from a USB stick it pounces on it and deletes it. I've had some that would allow an exception to be set but would still attack and delete when I'd try to run it.

Avast does NOT fit this bill, despite calling its exceptions "global". It only works by full path location. Set it to ignore something on a USB stick and if the drive letter changes it will delete the file.

I don't care *how* it sets a recognition for a specific file, MD5 hash or some "fingerprint", as long as when told to leave something alone it will obey me without question.

ICIT2LOL · 01 Dec 2016

Hello mate but I don't know if this will be what you want but my Kaspersky has a Block Banner function which blocks any incoming from URL sites ie if you don't want say facebook.com you can add it as site you want blocked.

There is another setting that blocks sites that may be used by criminals etc - Threats and exclusions and another setting that will scan encrypted incoming - Network settings and another that blocks tracking in Private browser settings.

These may nt be what you man but I have used this AV for years now and every now and then it will pop up - blocked *****.com etc as a let you know message.

Galane · 02 Dec 2016

FILES not websites are what I want to EXCLUDE from constantly being falsely tagged as "malware" and deleted by security programs.

Just read what people write!

CountMike · 02 Dec 2016

I don't know how to exclude it in advance but you can try this.

Antivirus with file instead of location exceptions?-wdef1.jpg

NocFA · 02 Dec 2016

I use bitdefender total security 2017 and I know it has exclusions but if you want to test it out right bow it has a 3 month trial running on facebook which gives you the full 2017 suite.

RolandJS · 02 Dec 2016

Galane, I know exactly what you want! What I cannot remember is: which one of my several AVs in the past did exactly what you want. I will try to comb my brain for the answer you want. Now, it's possible I'm going to be in error -- I'm not running those AVs anymore.

ICIT2LOL · 02 Dec 2016

[QUOTEFILES not websites are what I want to EXCLUDE from constantly being falsely tagged as "malware" and deleted by security programs.

Just read what people write!][/QUOTE]

Ok mate well I shall leave your problem for the others to answer - suffice to say I have been on the 7 and 10 forums for soem considerable time and I don't appreciate replies that are in my mind less than a little uncivil

91fw · 02 Dec 2016

It has to alert to a new location of any application. Most good security programs do it.
Otherwise malware can copy your file, change it to include a trojan, which if allowed to run its game over.
Your problem is that Defender deletes. Try quarantine that you can restore from. Or use something that allows to IGNORE - there are fewer and fewer of those however because AV companies think we're all idiots.

Kerbal Space Program - I'm not familiar with it, but considering the Defender's evaluation it's either false positive or the program itself has questionable components, such as running something in command line. Did you scan it with something else? Did you send the setup file to Virus total for evaluation by many AVs? I would.

Galane · 03 Dec 2016

91fw said:

It has to alert to a new location of any application. Most good security programs do it.
Otherwise malware can copy your file, change it to include a trojan, which if allowed to run its game over.
Your problem is that Defender deletes. Try quarantine that you can restore from. Or use something that allows to IGNORE - there are fewer and fewer of those however because AV companies think we're all idiots.

Kerbal Space Program - I'm not familiar with it, but considering the Defender's evaluation it's either false positive or the program itself has questionable components, such as running something in command line. Did you scan it with something else? Did you send the setup file to Virus total for evaluation by many AVs? I would.

If it goes by some characteristics other than just the name, that wouldn't be a problem. No malware can successfully clone any file and fool a test that compares things like exact number of bytes, an MD5 hash, name and who knows what other properties may be chosen.