User Manual

10
Real-time file system protection module could result in a
slower system. Therefore, we recommend that you leave the
default ThreatSense parameters unchanged for all modules
except Computer scan.
6.1.4.1 Objects
The Objects section allows you to define which files will be
scanned for infiltrations.
Files – scans all common file types (programs, pictures,
audio, video files, database files, etc.).
Symbolic links - (On-demand scanner only) scans files that
contain a text string that is interpreted and followed by the
operating system as a path to another file or directory.
Email files - (not available in Real-time protection) scans
email files.
Mailboxes - (not available in Real-time protection) scans
user mailboxes in the system. Incorrect use of this option
may result in a conflict with your email client. To learn more
about advantages and disadvantages of this option, read
the following knowledgebase article.
Archives - (not available in Real-time protection) scans files
compressed in archives (.rar, .zip, .arj, .tar, etc.).
Self-extracting archives - (not available in Real-time
protection) scans files which are contained in self-extracting
archive files.
Runtime packers - unlike standard archive types, runtime
packers decompress in memory. When this is selected,
standard static packers (e.g. UPX, yoda, ASPack, FGS) are
also scanned.
6.1.4.2 Options
In the Options section, you can select the methods used
during a scan of the system. The following options are
available:
Heuristics – Heuristics use an algorithm that analyzes the
(malicious) activity of programs. The main advantage of
heuristic detection is the ability to detect new malicious
software which did not previously exist, or was not included
in the list of known viruses (virus signatures database).
Advanced heuristics – Advanced heuristics is comprised of a
unique heuristic algorithm, developed by ESET, optimized
for detecting computer worms and trojan horses written in
high-level programming languages. The program's detection
ability is significantly higher as a result of advanced
heuristics.
Potentially unwanted applications – These applications are
not necessarily intended to be malicious, but may affect the
performance of your computer in a negative way. Such
applications usually require consent for installation. If they
are present on your computer, your system behaves
differently (compared to the way it behaved before these
applications were installed). The most significant changes
include unwanted pop-up windows, activation and running
of hidden processes, increased usage of system resources,
changes in search results, and applications communicating
with remote servers.
Potentially unsafe applications – These applications are
commercial, legitimate software that can be abused by
attackers if installed without user consent. This classification
includes programs such as remote access tools, for this
reason this option is disabled by default.
6.1.4.3 Cleaning
Cleaning settings determine the manner in which the scanner
cleans infected files. There are 3 levels of cleaning:
No cleaning – Infected files are not cleaned automatically.
The program will display a warning window and allow you
to choose an action.
Standard cleaning – The program will attempt to
automatically clean or delete an infected file. If it is not
possible to select the correct action automatically, the
program will offer a choice of follow-up actions. The choice
of follow-up actions will also be displayed if a predefined
action could not be completed.
Strict cleaning – The program will clean or delete all
infected files (including archives). The only exceptions are
system files. If it is not possible to clean a file, you will
receive a notification and be asked to select the type of
action to take.
Warning: In the Default Standard cleaning mode, entire
archive files are deleted only if all files in the archive are
infected. If an archive contains legitimate files as well as
infected files, it will not be deleted. If an infected archive file is
detected in Strict cleaning mode, the entire archive will be
deleted even if clean files are present.
6.1.4.4 Extensions
An extension is the part of a file name delimited by a period.
The extension defines the type and content of a file. This
section of the ThreatSense parameter setup lets you define
the types of files to be excluded from scanning.
By default, all files are scanned regardless of their extension.
Any extension can be added to the list of files excluded from
scanning. Using the Add and Remove buttons, you can enable
or prohibit the scanning of desired extensions.
Excluding files from scanning is sometimes necessary if
scanning certain file types prevents the program from
functioning properly. For example, it may be advisable to
exclude the .log , .cfg and .tmp extensions.