User guide

Additional ThreatSense parameters for executed files

Advanced heuristics on file execution – By default, Advanced heuristics is used when files are executed. When

enabled, we strongly recommend keeping Smart optimization and ESET Live Grid enabled to mitigate impact on

system performance.

Advanced heuristics on executing files from removable media – If you wish to exclude some removable media

(USB) ports from being scanned by advanced heuristics on file execution, click Exceptions... to open the

removable media drive exclusions window. In this window, you can customize the settings by selecting or

deselecting the check boxes that represent each port.

4.1.1.1.2 Cleaning levels

Real-time protection has three cleaning levels (to access, click Setup... in the Real-time file system protection

section and then click Cleaning).

No cleaning – Infected files will not be cleaned automatically. The program will display a warning window and allow

the user to choose an action. This level is designed for more advanced users who know which steps to take in the

event of an infiltration.

Standard cleaning – The program will attempt to automatically clean or delete an infected file based on a

predefined action (depending on the type of infiltration). Detection and deletion of an infected file is signaled by a

notification the bottom-right corner of the screen. If it is not possible to select the correct action automatically, the

program provides other follow-up actions. The same happens when a predefined action cannot be completed.

Strict cleaning – The program will clean or delete all infected files. The only exceptions are the system files. If it is

not possible to clean them, the user is prompted to select an action by a warning window.

Warning: If an archive contains a file or files which are infected, there are two options for dealing with the archive.

In standard mode (Standard cleaning), the whole archive would be deleted if all the files it contains are infected

files. In Strict cleaning mode, the archive would be deleted if it contains at least one infected file, regardless of the

status of the other files in the archive.