Verify File Exclusions are Working

The exclusion list is for SEC.  Anti-virus.

We had Mcafee and they have a tool called Mcafee Profile Monitor (MPM).

You would launch MPM, then launch the application that you want to verify that file/folder exclusion where working.

This was a great tool as it allowed me to fine tone an application (vendors exclusion list) exclusions.

Does Sophos Anti-Virus a tool like this?

Hello Navar Holmes,

had Mcafee
ah, I see, different "culture". Sophos' motto is still Security made simple. We've got Sophos a very long time ago when malware and AV were simple. Nevertheless I missed the other vendor's options for granular control and it took some time to get used to the concept "you don't actually know 8and can't) how it works so don't insist on fiddling with it". Diminishing marginal utility. It's a little bit like all the assist systems in a car - if you're willing to fork out some extra money you get "more control" like selecting a sport mode. But - if I may put it this way - in a dicey situation the final decision is still the car's (though it will give you the impression that your driving skills kept it on the road) [:)]. 

Excuse the digression. I don't know what the MPM does exactly but I assume it gives you correct results. Less convenient but nevertheless useful is savtst32.exe (dunno why there's no longer an article). You'll find it on the \sec_nnn\tools\ directory. From the (one-item) Drive menu you can select an arbitrary location and an arbitrary filename. It writes an EICAR test string and you can test the result of different settings with it.

Christian

Hello Navar Holmes,

had Mcafee
ah, I see, different "culture". Sophos' motto is still Security made simple. We've got Sophos a very long time ago when malware and AV were simple. Nevertheless I missed the other vendor's options for granular control and it took some time to get used to the concept "you don't actually know 8and can't) how it works so don't insist on fiddling with it". Diminishing marginal utility. It's a little bit like all the assist systems in a car - if you're willing to fork out some extra money you get "more control" like selecting a sport mode. But - if I may put it this way - in a dicey situation the final decision is still the car's (though it will give you the impression that your driving skills kept it on the road) [:)]. 

Excuse the digression. I don't know what the MPM does exactly but I assume it gives you correct results. Less convenient but nevertheless useful is savtst32.exe (dunno why there's no longer an article). You'll find it on the \sec_nnn\tools\ directory. From the (one-item) Drive menu you can select an arbitrary location and an arbitrary filename. It writes an EICAR test string and you can test the result of different settings with it.

Christian