Real-time file system protection
Real-time file system protection controls all malware-related events in the system. All files are scanned for malicious code when they are opened, created, or run on your computer. By default, Real-time file system protection launches at system start-up and provides uninterrupted scanning.
In special cases (for example, if there is a conflict with another real-time scanner), real-time protection can be disabled by disengaging Start Real-time file system protection automatically in Advanced setup (F5) under Real-time file system protection > Basic.
ESET Mail Security is compatible with machines using Azure File Sync agent with cloud tiering enabled. ESET Mail Security recognizes files with attribute FILE_ATTRIBUTE_RECALL_ON_DATA_ACCESS.
Media to scan
By default, all types of media are scanned for potential threats:
•Local drives – Controls all system hard drives.
•Removable media – Controls CD/DVD's, USB storage, Bluetooth devices, etc.
•Network drives – Scans all mapped drives.
We recommend that you use default settings and only modify them in specific cases, such as when scanning certain media significantly slows data transfers.
Scan on
By default, all files are scanned upon opening, creation, or execution. We recommend that you keep these default settings, as they provide the maximum level of real-time protection for your computer:
•File open – Scanning when files are opened / accessed.
•File creation – Scanning when files are created / modified.
•File execution – Scanning when files are executed.
•Removable media access – Scanning when accessing removable storage. When removable media that contains a boot sector is inserted in the device, the boot sector is immediately scanned. This option does not enable removable media file scanning. Removable media file scanning is located Media to scan > Removable media. For Removable media boot sector access to work correctly, keep Boot sectors/UEFI enabled in ThreatSense parameters.
Enables you to exclude specific processes. For example, processes of the backup solution, all file operations attributed to such excluded process are ignored and considered safe, thus minimizing the interference with the backup process.
Real-time file system protection checks all types of media and is triggered by various system events such as accessing a file. Real-time file system protection can be configured to treat newly created files differently than existing files. For example, you can configure Real-time file system protection to more closely monitor newly created files.
To ensure a minimal system footprint when using real-time protection, files that have already been scanned are not scanned repeatedly (unless they have been modified). Files are scanned again immediately after each detection engine database update. This behavior is controlled using Smart optimization. If Smart optimization is disabled, all files are scanned each time they are accessed.
To modify this setting, press F5 to open Advanced setup and expand Computer > Real-time file system protection. Click ThreatSense parameters > Other and select or deselect Enable Smart optimization.
Additional ThreatSense parameters
You can modify detailed options of the Additional ThreatSense parameters for newly created and modified files or Additional ThreatSense parameters for executed files.