Exclude RAM FS process and volumes from ESET scanning

3 posts

Kazimierz Guest
6 Aug

Can RAM FS, which has a volatile volume S: and a persistent volume T: with a drip.img file saved on system shutdown, have the ramfs.exe process, the drip.img file and the S: and T: volumes excluded from scanning in ESET HOME Internet Security without compromising the security of the computer?

Ann SoftPerfect
6 Aug

Yes. Here is what each exclusion will mean:

  • Excluded volumes Real-time scanners charge at every file operation, and on a RAM volume that overhead can dominate the work itself. In our tests we saw cases where the scanner filter, rather than the scanning, cost most of the throughput. In ESET this means a performance exclusion for each drive, not a detection exclusion.
  • Excluded image file Every save rewrites it, and the scanner would inspect that large file to no purpose, since it is a container in our own format and nothing inside can be recognised or extracted. It doesn't affect your protection.
  • Excluded process All reading and writing of the image is performed on behalf of ramfs.exe, so excluding it covers the whole save and load in one step - worth having if your image is large.

The resulting effect on the level of your security is that anything on an excluded path is not automatically examined when it is created or run. If your S: and T: hold caches, temporary files and build output (that is, the data that your own machine produced, or that came from other software you already trust), the exposure is negligible.

What you should avoid is downloading or extracting material from the internet straight onto an excluded volume and then running it from there, as that is exactly the moment when the scanner would otherwise step in and protect you.
If having a dedicated fully-scanned volume for downloads is not what you want, you can maintain a reasonable level of security by excluding such volume from real-time scanning and then running on-demand scans over that entire volume at intervals and also manually scanning all downloaded files when they arrive.

Kazimierz Guest
6 Aug

When I used SoftPerfect RAM Disk, I had the process, *.img, and R: excluded from ESET scans, and everything worked very well. I'll do the same for RAM FS, considering your advice. RAM FS works great for me, so I am going to buy it.

Reply
Shown with your post. Sign in to keep the same name every time.
(optional, never shown)
Only needed if you want notifications about replies.
Drag files here, paste a screenshot, or . Images up to 10 MB. Text, log and zip files up to 2 MB. Up to 5 files per post.
You can edit your post until someone replies.