ClamWin Free Antivirus Forum Index
ClamWin Free Antivirus
Support and Discussion Forums
Reply to topic
Filters tab - Why both include and exclude..?
Monotype


Joined: 30 Apr 2006
Posts: 62
Reply with quote
Hello!

One thing that I've been wondering about for a while now is why there are both a listbox for "Exclude Matching Filenames" AND a listbox for "Scan Only Matching Filenames"?

How can you both scan every filetype except for a exceptionlist AND only scan the files in a include-list at the same time? What about the filetypes that are now listed in either the included or the excluded list?

To say it short; How can one both use a whitelist and a blacklist at the same time? Shouldn't you be able to choose if you want to use the whitelist OR the blacklist? I really can't figure out how to use the Filter function as it is today.

Thanks in advance.
View user's profileSend private message
budtse


Joined: 14 Jan 2006
Posts: 372
Location: Belgium
Reply with quote
Hi,

You've got a point in saying only one list would be needed, if you had two radio buttons allowing you to chose between "Exclude these files" and "scan only these files".

Only one of these lists should be filled in. Normally this would be the exclude lists, since you would definitely want to scan unknown file types.

I don't know what happens if you fill in both, i assume the exclude lists overrules the include list.
Alch, can you confirm this ?

budtse
View user's profileSend private message
Monotype


Joined: 30 Apr 2006
Posts: 62
Reply with quote
budtse wrote:
Hi,

You've got a point in saying only one list would be needed, if you had two radio buttons allowing you to chose between "Exclude these files" and "scan only these files".

Only one of these lists should be filled in. Normally this would be the exclude lists, since you would definitely want to scan unknown file types.

I don't know what happens if you fill in both, i assume the exclude lists overrules the include list.
Alch, can you confirm this ?

budtse


It would be a lot better with radiobuttons, yes.

However, why is it important to scan non-executables too? It feels like most virii's located in executables.

If it's important, then I have a question: Are somebody working on anything to speed up the file scanning progress at the moment, or is it any plans to try to do this in the future? If it's possible that is (since ClamWin uses ClamAV engine).

The thought of on-access scanning in ClamWin actually scares me a bit, because many AV:s takes pretty much performance out of your computer, and since ClamWin doesn't scan files very fast, this may mean that ClamWin on-access will slow down the system pretty much. Or?

Thanks in advance.
View user's profileSend private message
alch
Site Admin

Joined: 27 Nov 2005
Posts: 1748
Reply with quote
there is a good reason for having both exclude and include. It is normal to configure the scanner to llok into a certain folder only but exclude some of the filtypes. Exclusion filter has precedence over inclusion.
View user's profileSend private message
winny


Joined: 09 Aug 2006
Posts: 4
Reply with quote
I completely agree with only scanning filetypes that could be a threat.

CA's eTrust AV product has a radio button to only scan executable files which speeds up scan times enormously. I have taken these details from the registry and added them to my clamwin.conf file.

includepatterns = *.386|CLAMWIN_SEP|*.ADE|CLAMWIN_SEP|*.ADP|CLAMWIN_SEP|*.ADT|CLAMWIN_SEP|*.ASX|CLAMWIN_SEP|*.BAS|CLAMWIN_SEP|*.BAT|CLAMWIN_SEP|*.BIN|CLAMWIN_SEP|*.BONGO|CLAMWIN_SEP|*.CBT|CLAMWIN_SEP|*.CHM|CLAMWIN_SEP|*.CLA|CLAMWIN_SEP|*.CMD|CLAMWIN_SEP|*.COM|CLAMWIN_SEP|*.CPL|CLAMWIN_SEP|*.CRT|CLAMWIN_SEP|*.CSC|CLAMWIN_SEP|*.DLL|CLAMWIN_SEP|*.DOC|CLAMWIN_SEP|*.DOT|CLAMWIN_SEP|*.DRV|CLAMWIN_SEP|*.EXE|CLAMWIN_SEP|*.HLP|CLAMWIN_SEP|*.HTA|CLAMWIN_SEP|*.HTM|CLAMWIN_SEP|*.HTT|CLAMWIN_SEP|*.INF|CLAMWIN_SEP|*.INS|CLAMWIN_SEP|*.ISP|CLAMWIN_SEP|*.JS|CLAMWIN_SEP|*.JSE|CLAMWIN_SEP|*.LNK|CLAMWIN_SEP|*.MDB|CLAMWIN_SEP|*.MDE|CLAMWIN_SEP|*.MSC|CLAMWIN_SEP|*.MSI|CLAMWIN_SEP|*.MSO|CLAMWIN_SEP|*.MSP|CLAMWIN_SEP|*.MST|CLAMWIN_SEP|*.OCX|CLAMWIN_SEP|*.PCD|CLAMWIN_SEP|*.PIF|CLAMWIN_SEP|*.POT|CLAMWIN_SEP|*.PPT|CLAMWIN_SEP|*.PRF|CLAMWIN_SEP|*.REG|CLAMWIN_SEP|*.RTF|CLAMWIN_SEP|*.SCF|CLAMWIN_SEP|*.SCR|CLAMWIN_SEP|*.SCT|CLAMWIN_SEP|*.SHB|CLAMWIN_SEP|*.SHS|CLAMWIN_SEP|*.SYS|CLAMWIN_SEP|*.URL|CLAMWIN_SEP|*.VB|CLAMWIN_SEP|*.VBE|CLAMWIN_SEP|*.VBS|CLAMWIN_SEP|*.VSD|CLAMWIN_SEP|*.VSS|CLAMWIN_SEP|*.VST|CLAMWIN_SEP|*.VXD|CLAMWIN_SEP|*.WIZ|CLAMWIN_SEP|*.WSC|CLAMWIN_SEP|*.WSF|CLAMWIN_SEP|*.WSH|CLAMWIN_SEP|*.XLA|CLAMWIN_SEP|*.XLS|CLAMWIN_SEP|*.XLT|CLAMWIN_SEP|*.XLW

Would be nice if something like this could be selected via the gui.

Hope this helps.
View user's profileSend private message
Filters tab - Why both include and exclude..?
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
All times are GMT  
Page 1 of 1  

  
  
 Reply to topic