A scan exclusion is a set of conditions that must be fulfilled so that Kaspersky Industrial CyberSecurity for Nodes will not scan a particular object for viruses and other threats.
Scan exclusions can be used by the following application components and tasks:
Kaspersky Industrial CyberSecurity for Nodes does not scan an object if the drive or folder containing this object is included in the scan scope at the start of one of the scan tasks. However, the scan exclusion is not applied when a custom scan task is started for this particular object.
Kaspersky Industrial CyberSecurity for Nodes does not support exclusion lists containing over 5000 objects.
In the Kaspersky Security Center Administration Console tree, select the Policies folder.
Select the necessary policy and double-click to open the policy properties.
In the policy window, select Supplementary → Trusted zone and click Settings.
Select the Scan exclusions tab.
Select the Merge values when inheriting check box if you want to create a consolidated list of exclusions for all computers in the company. The lists of exclusions in the parent and child policies will be merged. The lists will be merged provided that merging values when inheriting is enabled. Exclusions from the parent policy are displayed in child policies in a read-only view. Changing or deleting exclusions of the parent policy is not possible.
Select the Allow use of local exclusions check box if you want to enable the user to create a local list of exclusions. This way, a user can create their own local list of exclusions in addition to the general list of exclusions generated in the policy. An administrator can use Kaspersky Security Center to view, add, edit, or delete list items in the computer properties.
If the check box is cleared, the user can access only the general list of exclusions generated in the policy. Also, if this check box is cleared, Kaspersky Industrial CyberSecurity for Nodes hides the consolidated list of scan exclusions in the Application Console.
Click Add and select an action:
Category. You can group scan exclusions into separate categories. To create a new category, enter the name of the category and add at least one scan exclusion to the category.
New exclusion. Kaspersky Industrial CyberSecurity for Nodes adds a new scan exclusion to the root of the list.
New exclusion to selected category. To add a new scan exclusion to a specific category, select a category.
Select exclusion from list. To quickly configure Kaspersky Industrial CyberSecurity for Nodes on SQL servers, Microsoft Exchange servers, and System Center Configuration Manager, the application includes predefined scan exclusions. Also predefined scan exclusions have been added to support application set-up in Citrix and VMware virtual environments. You must select predefined scan exclusions depending on the purpose of the protected server.
To exclude a file or folder from scan, select the File or folder check box. Click the select file or folder link to open a window, and in that window, select a file or folder by clicking Browse.
You can also enter the path manually. Kaspersky Industrial CyberSecurity for Nodes supports environment variables and the * and ? characters when entering a mask:
The * (asterisk) character, which takes the place of any set of characters, except the \ and / characters (delimiters of the names of files and folders in paths to files and folders). For example, the mask C:\*\*.txt will include all paths to files with the TXT extension located in folders on the C: drive, but not in subfolders.
Two consecutive * characters take the place of any set of characters (including an empty set) in the file or folder name, including the \ and / characters (delimiters of the names of files and folders in paths to files and folders). For example, the mask C:\Folder\**\*.txt will include all paths to files with the TXT extension located in folders nested within the Folder, except the Folder itself. The mask must include at least one nesting level. The mask C:\**\*.txt is not a valid mask.
The ? (question mark) character, which takes the place of any single character, except the \ and / characters (delimiters of the names of files and folders in paths to files and folders). For example, the mask C:\Folder\???.txt will include paths to all files residing in the folder named Folder that have the TXT extension and a name consisting of three characters.
You can use masks at the beginning, in the middle or at the end of the file path. For example, if you want to add a folder for all users to exclusions, enter the ?:\Users\*\Folder\ mask.
To exclude a predefined area from scan, select the Predefined scope check box. Click the select predefined scope link to open a window, and in that window, select one the standard scopes on the protected device.
To exclude the specific objects from scan, select the Type of detected object check box. Click the enter object names link, click the Add button, and in the displayed window, enter the name of the object type according to the Kaspersky Encyclopedia classification (for example, Email-Worm, Rootkit, or RemoteAdmin).
You can use masks with the ? character (replaces any single character) and the * character (replaces any number of characters). For example, if the Client* mask is specified, Kaspersky Industrial CyberSecurity for Nodes excludes Client-IRC, Client-P2P and Client-SMTP objects from scans.
To exclude an individual file from scan, select the Object hash check box. Click the enter object hash link to open a window, and in that window, enter a file hash.
If the file is modified, the file hash will also be modified. If this happens, the modified file will not be added to exclusions.
In the Rule usage scope block, select the components that you want the scan exclusion to apply to.
If necessary, in the Comment field, enter a brief comment on the scan exclusion that you are creating.
Save changes to add the exclusion to the list. You can disable the exclusion at any time using the check box next to the object.
In the main window of the Web Console, select Assets (Devices) → Policies & profiles.
Click the name of the Kaspersky Industrial CyberSecurity for Nodes policy.
The policy properties window opens.
Select the Application settings tab.
Go to Supplementary → Trusted zone and click the Configure button.
Select the Scan exclusions tab.
Select the Merge values when inheriting check box if you want to create a consolidated list of exclusions for all computers in the company. The lists of exclusions in the parent and child policies will be merged. The lists will be merged provided that merging values when inheriting is enabled. Exclusions from the parent policy are displayed in child policies in a read-only view. Changing or deleting exclusions of the parent policy is not possible.
Select the Allow use of local exclusions check box if you want to enable the user to create a local list of exclusions. This way, a user can create their own local list of exclusions in addition to the general list of exclusions generated in the policy. An administrator can use Kaspersky Security Center to view, add, edit, or delete list items in the computer properties.
If the check box is cleared, the user can access only the general list of exclusions generated in the policy. Also, if this check box is cleared, Kaspersky Industrial CyberSecurity for Nodes hides the consolidated list of scan exclusions in the Application Console.
Click Add and select an action:
Category. You can group scan exclusions into separate categories. To create a new category, enter the name of the category and add at least one scan exclusion to the category.
New exclusion. Kaspersky Industrial CyberSecurity for Nodes adds a new scan exclusion to the root of the list.
Select exclusion from list. To quickly configure Kaspersky Industrial CyberSecurity for Nodes on SQL servers, Microsoft Exchange servers, and System Center Configuration Manager, the application includes predefined scan exclusions. Also predefined scan exclusions have been added to support application set-up in Citrix and VMware virtual environments. You must select predefined scan exclusions depending on the purpose of the protected server.
If you want to exclude a file or folder from scanning, select File or folder and select the check box in the field with the same name. Specify the path to the file or folder.
Kaspersky Industrial CyberSecurity for Nodes supports environment variables and the * and ? characters when entering a mask:
The * (asterisk) character, which takes the place of any set of characters, except the \ and / characters (delimiters of the names of files and folders in paths to files and folders). For example, the mask C:\*\*.txt will include all paths to files with the TXT extension located in folders on the C: drive, but not in subfolders.
Two consecutive * characters take the place of any set of characters (including an empty set) in the file or folder name, including the \ and / characters (delimiters of the names of files and folders in paths to files and folders). For example, the mask C:\Folder\**\*.txt will include all paths to files with the TXT extension located in folders nested within the Folder, except the Folder itself. The mask must include at least one nesting level. The mask C:\**\*.txt is not a valid mask.
The ? (question mark) character, which takes the place of any single character, except the \ and / characters (delimiters of the names of files and folders in paths to files and folders). For example, the mask C:\Folder\???.txt will include paths to all files residing in the folder named Folder that have the TXT extension and a name consisting of three characters.
You can use masks at the beginning, in the middle or at the end of the file path. For example, if you want to add a folder for all users to exclusions, enter the ?:\Users\*\Folder\ mask.
To exclude a predefined scope from scanning, select Predefined scope. In the drop-down list, select one of the standard scopes on the protected device.
If you want to exclude certain objects from scanning, select the Type of detected object check box and enter the name of the object type according to the Kaspersky Encyclopedia classification (for example, Email-Worm, Rootkit, or RemoteAdmin).
You can use masks with the ? character (replaces any single character) and the * character (replaces any number of characters). For example, if the Client* mask is specified, Kaspersky Industrial CyberSecurity for Nodes excludes Client-IRC, Client-P2P and Client-SMTP objects from scans.
To exclude an individual file from scanning, select the Object hash check box and add a hash from a file or a list of events.
If the file is modified, the file hash will also be modified. If this happens, the modified file will not be added to exclusions.
If necessary, in the Comment field, enter a brief comment on the scan exclusion that you are creating.
In the Protection components block, select the components that you want the scan exclusion to apply to.
The new exclusion will be added to the list. You can disable the exclusion at any time using the check box in the Status column.
In the Application Console tree, select the Kaspersky Industrial CyberSecurity for Nodes node and select Trusted zone from the context menu of the node.
The Configure Trusted zone settings window opens.
In the Exclusions section, click the Settings button next to the Scan exclusions block.
Click Add and select an action:
Category. You can group scan exclusions into separate categories. To create a new category, enter the name of the category and add at least one scan exclusion to the category.
New exclusion. Kaspersky Industrial CyberSecurity for Nodes adds a new scan exclusion to the root of the list.
New exclusion to selected category. To add a new scan exclusion to a specific category, select a category.
Select exclusion from list. To quickly configure Kaspersky Industrial CyberSecurity for Nodes on SQL servers, Microsoft Exchange servers, and System Center Configuration Manager, the application includes predefined scan exclusions. Also predefined scan exclusions have been added to support application set-up in Citrix and VMware virtual environments. You must select predefined scan exclusions depending on the purpose of the protected server.
To exclude a file or folder from scan, select the File or folder check box. Click the Select file or folder link to open a window, and in that window, select a file or folder by clicking Browse.
You can also enter the path manually. Kaspersky Industrial CyberSecurity for Nodes supports environment variables and the * and ? characters when entering a mask:
The * (asterisk) character, which takes the place of any set of characters, except the \ and / characters (delimiters of the names of files and folders in paths to files and folders). For example, the mask C:\*\*.txt will include all paths to files with the TXT extension located in folders on the C: drive, but not in subfolders.
Two consecutive * characters take the place of any set of characters (including an empty set) in the file or folder name, including the \ and / characters (delimiters of the names of files and folders in paths to files and folders). For example, the mask C:\Folder\**\*.txt will include all paths to files with the TXT extension located in folders nested within the Folder, except the Folder itself. The mask must include at least one nesting level. The mask C:\**\*.txt is not a valid mask.
The ? (question mark) character, which takes the place of any single character, except the \ and / characters (delimiters of the names of files and folders in paths to files and folders). For example, the mask C:\Folder\???.txt will include paths to all files residing in the folder named Folder that have the TXT extension and a name consisting of three characters.
You can use masks at the beginning, in the middle or at the end of the file path. For example, if you want to add a folder for all users to exclusions, enter the ?:\Users\*\Folder\ mask.
To exclude a predefined area from scan, select the Predefined scope check box. Click the select predefined scope link to open a window, and in that window, select one the standard scopes on the protected device.
To exclude the specific objects from scan, select the Type of detected object check box. Click the enter object names link, click the Add button, and in the displayed window, enter the name of the object type according to the Kaspersky Encyclopedia classification (for example, Email-Worm, Rootkit, or RemoteAdmin).
You can use masks with the ? character (replaces any single character) and the * character (replaces any number of characters). For example, if the Client* mask is specified, Kaspersky Industrial CyberSecurity for Nodes excludes Client-IRC, Client-P2P and Client-SMTP objects from scans.
To exclude an individual file from scan, select the Object hash check box. Click the enter object hash link to open a window, and in that window, enter a file hash.
If the file is modified, the file hash will also be modified. If this happens, the modified file will not be added to exclusions.
In the Rule usage scope block, select the components that you want the scan exclusion to apply to.
If necessary, in the Comment field, enter a brief comment on the scan exclusion that you are creating.
Save changes to add the exclusion to the list. You can disable the exclusion at any time using the check box next to the object.
Path mask examples:
Paths to files located in any folder:
The mask *.exe will include all paths to files that have the exe extension.
The mask example* will include all paths to files named EXAMPLE.
Paths to files located in a specified folder:
The C:\dir\*.* mask will include all paths to files located in the C:\dir\ folder, but not in the subfolders of C:\dir\.
The mask C:\dir\* will include all paths to files located in the C:\dir\ folder, including subfolders.
The mask C:\dir\ will include all paths to files located in the C:\dir\ folder, including subfolders.
The mask C:\dir\*.exe will include all paths to files with the EXE extension located in the C:\dir\ folder, but not in the subfolders of C:\dir\.
The mask C:\dir\test will include all paths to files named "test" located in the C:\dir\ folder, but not in the subfolders of C:\dir\.
The mask C:\dir\*\test will include all paths to files named "test" located in the C:\dir\ folder and in the subfolders of C:\dir\.
The mask C:\dir1\*\dir3\ will include all paths to files in dir3 subfolders one level into the C:\dir1\ folder.
The mask C:\dir1\**\dirN\ will include all paths to files in dirN subfolders in the C:\dir1\ folder at any level.
Paths to files located in all folders with a specified name:
The mask dir\*.* will include all paths to files in folders named "dir", but not in the subfolders of those folders.
The mask dir\* will include all paths to files in folders named "dir", but not in the subfolders of those folders.
The mask dir\ will include all paths to files in folders named "dir", but not in the subfolders of those folders.
The mask dir\*.exe will include all paths to files with the EXE extension in folders named "dir", but not in the subfolders of those folders.
The mask dir\test will include all paths to files named "test" in folders named "dir", but not in the subfolders of those folders.