Windows Exclusions for User Folders

Hi,

I know that more recently the endpoint software has started to accept such exclusions at least for the server version of SAV as managed by Sophos Central.

http://docs.sophos.com/sophos-cloud/customer-dashboard/help/en-us/webhelp/index.htm#concepts/ExclusionsVariables.htm#concept_dxh_vsf_pp

I believe the new on-access driver and service capable of such exclusions is coming to the regular endpoint line in 10.6.4.  Maybe one to confirm with Support but it should be soon.

The other question would be what under the "Nuance" directory are you trying to exclude, is it some form of 'database' file that is constantly being changed and hence may need to be repeatedly scanned?  I'm always a little sceptical about third-party software vendors recommendation and understanding of exclusions.  What are they guarding against?  Performance issues? Is there a public article recommending this, does it say why? Maybe the issue they have seen in the past which gave rise to the article was with one particular product in a particular scanning configuration, i.e. scan all files and scan inside archives.  Have you witnessed an issue without an exclusion?

I can understand the use case of a piece of software which expects to receive malware samples and there is a directory to exclude to prevent detections.  This is more common for gateway products.  I can also understand software such as Metasploit where you might have detectable sample files in a directory.

Regards,

Jak

Jak,

There is a support document that Nuance provided saying to exclude this folder I don't have access to it right now, but the reason that the vendor says to exclude it that they claim scanning affects the performance of the Dragon Dictation Software. The Nuance folder stored in the users appdata folder is where Dragon will download their "voice profile" each time the log in to use the software. It will then upload any changes to the "voice profile" that may have been made when they are finished using the software. According to Nuance, when active scanning is being done it affects the performance of the software. 

Since this folder was excluded with our last AV software and we are still in the build phase of getting Sophos Endpoint setup I haven't ever seen this be an issue.

Basically I was given a bunch of different support documents for all of the different software being used here and told to add all the recommend exclusions for AV scanning into Sophos Endpoint as part of our build phase. I'm not even sure if all these exclusion settings apply to Sophos endpoint or not.

Jak,

There is a support document that Nuance provided saying to exclude this folder I don't have access to it right now, but the reason that the vendor says to exclude it that they claim scanning affects the performance of the Dragon Dictation Software. The Nuance folder stored in the users appdata folder is where Dragon will download their "voice profile" each time the log in to use the software. It will then upload any changes to the "voice profile" that may have been made when they are finished using the software. According to Nuance, when active scanning is being done it affects the performance of the software. 

Since this folder was excluded with our last AV software and we are still in the build phase of getting Sophos Endpoint setup I haven't ever seen this be an issue.

Basically I was given a bunch of different support documents for all of the different software being used here and told to add all the recommend exclusions for AV scanning into Sophos Endpoint as part of our build phase. I'm not even sure if all these exclusion settings apply to Sophos endpoint or not.