Protection - Malware/ Firmware/etc.

Protection - Malware/ Firmware/etc.

Cumbersome interface to add exceptions from scanning or pause protection

Defender of the month ✭✭✭

BACKGROUND

I have a handful of old files that are detected as having viruses. Some I am fairly sure do not contain threats (and I have just submitted a report to BD of apparent false positives). The others are old files (from the 1990s) that were once genuine threats, but are no longer practical threats any more on my system; I just like keeping them around.

What I want is for BD to not delete or quarantine or disinfect those particular files automatically when the files are not being run/opened (maybe being copied/moved, or having attributes changed). Ask me first. Or allow me to easily override/reverse the BD action.

Specifically, this month I copied all old files from a desktop to a USB drive, then attempted to copy them from the USB drive to my internal laptop SSD.

PROBLEMS

Obviously the first problem is the false positives. To be fair, that could happen occasionally with any AV product. And consider that I also want to retain a handful of files with genuine historical threats — I shouldn't expect AV companies to cater to that weird(?) preference.

What happens is that BD prevents the file from being copied to my SSD, and then also quarantines the file on the USB drive. When I restore the file from the quarantine to the USB drive, it is helpful that BD automatically adds an exception for this file on that path. But I still cannot copy it to my SSD.

So I might think of manually adding an exception.

I could try to copy the path from the BD Notifications list. But the second problem is that in the GUI the highlighting appears roughly two characters to the left of where the mouse is!!!

Then the third problem is that BD refuses to exempt a file/folder prospectively. In other words, if the file/folder doesn't already exist on the nominated path, then you cannot define an exception in BD. It's a classic Catch 22 situation: you cannot create the file without an exception, but you cannot create the exception without the file!

The fourth problem is that it doesn't seem possible to create a generalised exception. For example, if attempting to copy E:\LatestVersion\foo\bar\ClassLibrary1.exe to C:\User1\My Documents\work\Project Skyblast\foo\bar\ClassLibrary1.exe, it would be handy to be able to make an exception for "foo\bar\ClassLibrary1.exe". If there are numerous versions, then perhaps "foo\bar\ClassLibrary?.exe" or "foo\bar\ClassLibrary*.exe".

However, it seems that no wildcards can be used anywhere on the path — not in for the target file/folder name, nor in the higher-level folders/directories, nor for the drive letter (the letter assigned to a USB drive can change!). (And the path seems to have to be complete, so exceptions cannot be added like "ClassLibrary1.exe". I agree that it could be dangerous to do this, if the name is a common one, rather than, say, "9rct59TRx3pN1PphL87.exe".)

The fifth problem is that there is no obvious button to "pause protection" for a short period. Eventually (afterward!) I discovered that turning off the Bitdefender Shield effectively does this, but it was just a fluke that I found this out.

image.png

WORKAROUND

So what was my workaround?

  1. I plug in the USB drive and try to copy a collection of folders & files to my SSD.
  2. BD blocks copying of specific files with suspected threats to the SSD and quarantines the corresponding files that were already on the USB drive
  3. I restore the quarantined files on the USB drive.
  4. BD automatically creates exceptions for the restored files. But note that the exceptions are for a specific drive letter. This time the USB drive might be "E:". Next time I might plug in an additional USB drive beforehand, so that the USB drive of interest would then be assigned "F:" instead.
  5. Next I manually create an exception for the folder that is intended to contain the copied file. For example, create an exception for "C:\User1\My Documents\work\Project Skyblast\foo\bar", where "bar" is the folder into which I hope to copy "ClassLibrary1.exe".
  6. I copy the file to that now-exempted directory.
  7. (OPTIONAL) Now the exception can be manually revised to "C:\User1\My Documents\work\Project Skyblast\foo\bar\ClassLibrary1.exe".

Yes, it's very inconvenient!

ALTERNATIVE WORKAROUNDS

Two other possible routes would be to

  • pause protection from all files, by temporarily turning off the Bitdefender Shield; or
  • add a high level exception for "C:\" as step 0 in the above workflow, so that none of the copied files would be scanned.

Although they're simpler, both of those routes would be more risky than my actual workflow, .

Welcome!

It looks like you're new here. Sign in or register to get started.

Welcome!

It looks like you're new here. Sign in or register to get started.