Real-time file system protection

Real-time file system protection checks all types of media and triggers a scan based on various events. Using ThreatSense technology (described in ThreatSense engine parameter setup), Real-time file system protection may vary for newly created files and existing files. Newly created files can be more precisely controlled.

By default, all files are scanned upon file opening, file creation or file execution. We recommend that you keep these default settings, as they provide the maximum level of Real-time protection for your computer. Real-time protection launches at system startup and provides uninterrupted scanning. In special cases (for example, if there is a conflict with another Real-time scanner), Real-time protection can be terminated by clicking the ESET Cyber Security Pro icon ECS_icon located in your Menu Bar (top of the screen) and selecting Disable Real-time File System Protection. Real-time file system protection can also be disabled from the main program window (click Setup > Computer and switch Real-time file system protection to DISABLED).

The following types of media can be excluded from the Real-time scanner:

Local drives – system hard drives

Removable media – CDs, DVDs, USB media, Bluetooth devices, etc.

Network media – all mapped drives


We recommend that you use default settings and only modify scanning exclusions in specific cases, such as when scanning certain media significantly slows down data transfers.

To modify advanced settings for Real-time file system protection, go to Setup > Enter application preferences ... (or press cmd+,) > Real-Time Protection and click Setup... next to Advanced Options (described in Advanced scan options).