Loading...

Knowledge Center


How to use wildcards when creating exclusions in Endpoint Security, MOVE AV Multi-Platform, or VirusScan Enterprise
Technical Articles ID:   KB54812
Last Modified:  6/28/2018
Rated:


Environment

McAfee Endpoint Security (ENS) Adaptive Threat Protection (ATP) 10.x
McAfee ENS Threat Prevention 10.x
McAfee Management for Optimized Virtual Environments (MOVE) AntiVirus (AV) Multi-Platform 4.x
McAfee VirusScan Enterprise (VSE) 8.x

For details of ENS supported environments, see KB82761.
For details of MOVE supported environments, see KB74865.
For details of VSE supported environments, see KB51111.

Summary

This article explains the rules for using wildcards when creating exclusions with ENS, MOVE AV Multi-Platform, or VSE.

Using wildcards when creating exclusions
Wildcards (?, *, **) are helpful in creating exclusions, but certain rules apply. See examples below.
  • The question mark (?) wildcard is used to represent a single character in the exact position where it is placed in the path or file name.
     
  • The asterisk (*) wildcard is used to represent one or more characters, and does not cross a folder boundary.
     
  • The double asterisk (**) wildcard is used to represent one or more characters, and does cross folder boundaries.
     
  • System Environmental Variables such as %SystemRoot% can be used in exclusions. User Environmental Variables such as %UserProfile% cannot be used, because the on‑access scanner runs under the Windows Local System account.

To show the difference between the * and ** wildcards, C:\Users\Will* would match path names such as C:\Users\William, C:\Users\Willamina, and C:\Users\WillAnderson. It does not match any subfolder of those names. C:\Users\Will** would match the previous folders and all their subfolders.
 
Wildcard examples
 
Example Comments
**\Temp\test.docx
Exclude a specific file in a folder named Temp anywhere on the system.
**\test.docx
Exclude a specific file anywhere on the system.
\**\test.docx
Exclude a specific file in any folder on a specific drive.
Users\**\Documents\Microsoft User Data\ 
Exclude any folder under Users and any folder under User Data (select also exclude subfolders).
C:\Documents and Settings\**\Favorites\
Exclude the Favorites folder for all users.
C:\**\Favorites\
Exclude any folder named Favorites on drive C.
**\Temp\**
Exclude the Temp folder in any location, on any drive.

In this example the following directories would be excluded:
  • C:\temp
  • D:\windows\temp
  • c:\documents and settings\Administrator\Local Settings\temp
**\Temp\*.tmp
Exclude any file with a .tmp extension in a folder named Temp anywhere on the system.
**\*.html
Exclude any file with a .html extension anywhere on the system.
C:\Windows\Temp*\inifile?.*
Exclude all files named inifileX, where X is any valid character for a file name, in any folder name beginning with Temp under C:\Windows.
\**\*.tmp
Exclude all files with the .tmp extension (*.tmp) in any folder on a specific drive.
 
In this example, any *.tmp files on the D: drive are excluded:
 
D:\**\*.tmp

Rate this document

Beta Translate with

Select a desired language below to translate this page.

Glossary of Technical Terms


 Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.