Full Anti-Virus scan not respecting excluded folders
Since there is no way to exclude disks from being scanned, I included the root of volumes I didn't want scanned in the Protection Exclusion list. This worked in the Beta. The entire volumes were not scanned with a full scan. I tried the same thing in the release version and found that subfolders in the excluded root folder are being scanned. This means I can't allow a full scan. Does anyone else see this problem?
Steve, I hear you about the slow scan. I have a computer with 3 Windows systems each on a separate disk. There are also 3 data disks. I'm at a point where I'm just about ready to give up on TI 2021.
Paul,
I did some testing on this. I found that it is possible to exclude entire disks however, it is not intuitive.
I am including screenshots with descriptions below:
After selecting Settings - Advanced - Set up - Add exclusion - Add folder, select the drive you wish to exclude then click on Select folder as shown in the screenshot below.
The selected drive will then be added to the exclusion list. You can see that I have excluded 3 of my 8 total drives in the screenshot below.
Once you have all your exclusions selected click the Save button to keep the chosen exclusions. Back on the Settings screen click the OK button to save changes and return to the Overview/Activity screen of the Protection section. At this point you can run your scan.
Below is a screenshot of my Full scan showing that my 3 exclusions were honored the total data remaining on the 5 drives included in the scan is 331.4GB. Total data on the 3 excluded drives is 17.8GB. If I take 332 divide by 40 I get 8.3GB per minute. The only question is, what is the file size limit that Cyber Protect uses to exclude files from a scan? Additionally, I do not have the Scan archives option checked.
Hope this helps
Bob,
That is exactly how I did it. That method worked well in the beta versions. When I ran the full scan in the release version, I saw that folders from my D: were being scanned. So I had to cancel the scan immediately. The same problem happened on two different Windows 10 systems. I have now removed TI 2021 from all my systems.
This wasn't the only problem I encountered. The Anti-Ransomware protection component kept turning itself off after a day or so and couldn't be turned back on. At that point I said enough is enough so I'm done with it.
Paul,
Wow, my experience has been nothing like that at all. Can't even fathom why you have.
Bob,
Here's the full story. TI 2021 didn't go well right from the beginning of the first beta install. It was not able to keep the Anti-Ransomware component running for more than a day. When the release version came, I did a compete uninstall and cleanup before installing it. Again the Anti-Ransomware component would turn itself off after a day or so. After doing another clean install, I found the Anti-Ransomware component would be turned off after the first reboot. At that time I realized that the system was set to have app and browser control turned off. I thought that may have been the problem so I turned it on in Windows Security. Then I did another clean install. Now the Anti-Ransomware component stayed on after a number of reboots. I was happy and thought the problem was solved. The following day I booted up the system and found the Anti-Ransomware component was again turned off. I did see that a definitions update had occurred. Maybe that is at the root of the problem. At that point I decided I was bagging my head against a stone wall and gave up.
BTW, the same thing happened on another Windows system.
Paul,
Strange indeed sir. I can report that I installed TI 2021 on another of my systems. I set exclusions for all the secondary drives in the machine and then ran a scan. I watched the scan from start to finish, all 1 hour of it, and only witnessed files on C drive being scanned. The app did report and show all other drives as excluded.
One difference I can see between us is that I have a third party app installed as my security provider. ATI honors this and so antivirus is turned off. I can manually turn on the ATI antivirus by first turning off my other antivirus. Do you have a third party app installed on your PC's?
On this second machine I in addition to the scan above I ran two more. One after I removed Hyper V from my machine as having it enabled was causing wild spikes in CPU and memory usage. I saw an immediate 50% drop in numbers when I did that. The second scan was after I disabled my third party apps antivirus.
Performance and resource use was improved and more inline with what I expected to see. Turning off and on ATI antivirus works fine for me. By the way, I run scans with ATI even with the antivirus disabled. This is akin to Windows periodic scans and made possible by the services being loaded in memory. I kind of like the ability to have options in this respect myself. I guess others do not see it that way though.
Bob,
No third party anti-virus or malware apps. are on this system. That certainly may be at play here.
Also at play may be the Windows 10 version. This system is on 2004. Last night I decided to try TI 2021 on a Windows 10 system I have in VM. It is on version 1507 (the first Windows 10 version). The Protection seems to be working well on that system. All protection stays on after a reboot. This morning I ran it and allowed TI to get a protection definitions update. All Protection is staying on. I was also able to run a successful anti-virus full scan. I can't test excluding other drives on this system because the additional drive in the VM is so small it would be scanned way too fast to see during the scan.
It is interesting to see how ATI and Windows Security Center interact on this old Windows version. Windows Defender has been completely disabled. When I attempt to run it I get a pop-up message that Windows Defender has been turned off. Windows Security Center reports that ATI is in charge of anti-virus monitoring. It also reports that there is no Malware protection and keeps sending messages to the Notification area to that effect. ATI reports that Malware protection is turned on.
Paul said:
It is interesting to see how ATI and Windows Security Center interact on this old Windows version. Windows Defender has been completely disabled. When I attempt to run it I get a pop-up message that Windows Defender has been turned off. Windows Security Center reports that ATI is in charge of anti-virus monitoring. It also reports that there is no Malware protection and keeps sending messages to the Notification area to that effect. ATI reports that Malware protection is turned on.
This is interesting. What happens if you turn off ATI protection? What should happen is that Defender should assume protection automatically, there will be some delay but should be under 1 minute.
Will Defender run with ATI turned off? It should. You might need to run updates for Defender to get it to scan. After the scan, assuming you can and do run it, what happens when you turn on ATI protection? Do things look different in Security Center? I think they should and I think that it should stop sending the Malware notifications. I think there are occasions where turning on ATI protection does not fully register itself with Windows creating symptoms like reporting that there is no malware protection for example.
I'm posting back to Steve's thread on my tests of yesterday if you care to look.
Turning off ATI Protection did reactivate Windows Defender as it should have. Windows Defender was able to run and do a scan. Turning ATI Protection back on returned to the exact same behavior. Windows Defender was disabled and a notification popped up saying no Spyware app. found. Windows Security Center showed no Spyware app., but ATI showed Malware protection was on.
ATI 2021 Protection certainly works better in Windows 1507 than it does in Windows 2004. All I would have to do is "Dismiss" the Spyware warning in Windows Security Center and all would be good.
What you describe sounds very much like a registration issue in the product.
I made a major discovery today. I found what is causing the Protection problems for TI 2021 where Ransomware and Illicit Protection is turned off and can't be turned back on. I found that it takes about 5 seconds after Windows starts for the Acronis Active Protection icon to appear in the system tray. If I attempt to run the main TI GUI BEFORE the AAP icon appears in the system tray, the Protection problem is triggered. Once the program is in that state, there is no way to fix it. Restarting Windows and waiting for the AAP icon to appear in the system tray doesn't help. The only way to get Protection fully working again is to uninstall and reinstall TI 2021. I have reproduced this behavior on two different Windows 10 systems. If I wait until the AAP icon appears in the system tray before running the TI main GUI, all is well with Protection. I've tracked this for two days now.
I also found that the drives I excluded in the AV scan were respected as they should be. The problem has been solved for me.
Well, glad you found the issue Paul but, an uninstall/reinstall is an extreme measure to fix what I would say is a minor issue as you describe. It also seems odd to me that you are the only one whom has reported this particular problem.
After your reinstall do you still see the same behavior in respect to having a delay in the appearance of the Protection icon in the System Tray? I have not seen this myself on either of the machines I have TI 2021 installed on.
Uninstall/reinstall may be extreme, but it's the only way I found to fix the issue. Maybe it's a matter of deleting a data base file or xml configuration file, but the program has become way too complicated to find something like that.
I find it takes 6.5 seconds on my system from the time the desktop appears to the time the AAP icon appears in the system tray. How long does it take to see the icon on your system? If you are able to start the TI GUI before the icon appears in the system tray I'd be very interested in what happens with Protection.
I was able to reproduce the problem with build 30480.
Paul,
On the system I have been testing (the new one) When the desktop shows the icon is already present and accounted for. I thought maybe that was just a fluke ever sense you mentioned the issue so I have been watching. I have restarted, shutdown and startup several times today and the behavior is always the same. Sorry I cannot test it.
I will try on my second machine though. Just got home a few minutes ago so haven't got around to it yet. I agree with your assessment of ATI becoming very complicated. It is next to impossible to pinpoint the cause of issues now.
Thanks Enchantec, I used your method to disable scanning and it worked great. I was having the same problem everyone else is having. Full scan takes a ridiculously long time.