Add file to exceptions system-wide

[Sm4sH]

I want to add a file to exceptions which exists several times (40 times) on my system. It is always the same file with the same name,
can't Kaspersky be told to ignore the file in general (i.e. not to delete it even when copying etc.) or do I now have to add 40 rules? ^^
I use Kaspersky Standard.

 

 

[harlan4096]

Welcome to Kaspersky Community.

 

Can You provide versions K. Standard? Also, attach captures of the exception created, and the details full details of the detection.

[Sm4sH]

For what? It's a simple question. Is it possible and if so, how?
Why do I have to make captures? I have not created any exceptions that I can capture.

[harlan4096]

Ah ok, sorry, I misunderstood You.

 

There are different types of exclusions, see below, in the capture:

 

 

The 1st option it is to add a specific exclusion for a malware detection, and the second one, it is to create monitoring Intrusion Prevention Exclusions, encrypted traffic exclusions, etc.

 

Apart from those, You can also create exclusions for the Web AV module, and other additional modules: Anti-Banner, Private Browsing,...

[Sm4sH]

Thank you.

I have created an exception (see screenshot) but as soon as I copy the file, for example to a USB stick, it is blocked and automatically deleted.

Kaspersky is not interested in the exception.

I just want Kaspersky to ignore a file and ignore it completely. No matter whether during a scan or copying etc...

Have I created the exception correctly? If yes, where is the problem and if no, please, how do I do this?

 

[harlan4096]

I think In Object, You have to add the specific detection name, with or without ask symbols (* ?) if needed)...

 

https://support.kaspersky.com/help/Kaspersky/Win21.18/en-US/201385.htm

 

Example:

 

[Sm4sH]

I think that was the solution... I looked in the last “Delete” message, copied the name and created the exception that way:

 

It looks like it's working now. Thank you very much ?

Will keep an eye on it. Regards

[harlan4096]

Great!

You can also try to add it to Trusted app, and enabled all the options inside.

[Sm4sH]

Kaspersky deletes the File again...

Tthis is not a Virus. Please send this to your Kaspersky People to to add it as an exception.

Virustotal check says the same... ^^

https://www.virustotal.com/gui/file/1393b9feba5a29b598c72bd008546d58bd0d3db342fb267e3fe075eb241eedee/detection

 

Edited January 23 by Sm4sH

[harlan4096]

I need the original file, send me it via personal message, upload to cloud service and send me the link to download.

[harlan4096]

Nothing can't be done:

 

Quote

 

Hello,

This detection is correct.
Thank you for your inquiry to Kaspersky.

Best regards, Malware Analyst

 

Try creating an exclusion with the mask: *HEUR:HackTool.Script.KMSAuto.gen* in Object field.

[Sm4sH]

Like that? .. It doesn't work - will be deleted again.

 

 

[harlan4096]

*HEUR:HackTool.Script.KMSAuto.gen*

[Sm4sH]

Like this? ..doesn't work also.. do i need to restart my PC or Kaspersky etc..?

 

 

[harlan4096]

 

Specify there the file.

[Sm4sH]

Nope.. same

 

Edited January 23 by Sm4sH

[harlan4096]

No, here:

 

 

The file detected.

[Sm4sH]

You mean the path to the individual file?
If so, that's not what I want... I have the file multiple times on the system and besides, if I copy it from a to b, it will be deleted again I think.

Just want to tell Kaspersky... no matter where the file is and how many there are, always ignore it... can't be that difficult ?

[harlan4096]

I can't understand why so many times the same file in the system ?‍♂️?

 

Yes, it can be difficult since that file it is considered as malware, and K. analysts won't remove that detection. I guess that is a Windows activator.

[Sm4sH]

You don't need to understand that either, it's just the way it is. There are reasons why I have them several times on the system or in different folders and it can't be that you don't take them off the list if it's not a virus or malware. ?

Anyway... at least I as a user should be allowed to decide or add the file to the exceptions. You have the option to do this in the settings, don't you?
It should just work ? which it doesn't.
I also have other exceptions and why doesn't the exception work?

Please tell me exactly how to do this, otherwise I'll have to switch off my Kaspersky and that's not the point.

Test it yourself how it works and send me a screenshot please.
Then I'll add it to my system.

 

...Nothing can't be done ^^

Edited January 23 by Sm4sH

[AlexeyK]

9 часов назад, Sm4sH сказал:

Please tell me exactly how to do this

It's very easy to do.

1. Type file hash SHA256: 1393b9feba5a29b598c72bd008546d58bd0d3db342fb267e3fe075eb241eedee

2. Select "All components". All other fields are empty.

3. Don't forget to save all changes.

4. Enjoy your file from any folder. ?

Screenshots:

Спойлер

 

[harlan4096]

Probably, and I think it is by design, in some scenarios of scanning, still will continue to be detected... for example, if You manually scan the file or the folder.

[AlexeyK]

55 минут назад, harlan4096 сказал:

in some scenarios of scanning, still will continue to be detected... if You manually scan the file or the folder.

Not the folder, only excluded file (or several highlited files) via the context menu. If you scan the folder, the exception will still be applied.

[Sm4sH]

Thanks for the explanation, so it did work after all, I just did exactly that to test it.
So I manually checked the file for viruses via the context menu.
A small misunderstanding. ?

Then I know and I can live with it, that's fine.
The file is not deleted when the folder is scanned and copying it also works.

Thank you all for the great help.