Scan exclusions for antivirus applications

Usage and Config
1

I’ve tried to find what executables and maybe folders should be excluded on our workstations, in our antivirus application. We’re using

Trend Micro Apex One Security Agent 14.0.2146
BigFix Agent 9.5.15.71
BigFix Self Service Application 3.1.0
BigFix Remote Control 10.0.0.29
Also some admins are using the BigFix Console 9.5.15.71

All I can find is defunct links to the old IBM site that don’t work.

I would imagine
Client
C:\Program Files (x86)\BigFix Enterprise\BES Client
C:\Program Files (x86)\BigFix Enterprise\BES Client__BESData__Global__Cache\Downloads
C:\Program Files (x86)\BigFix Enterprise\BES Client\BESClient.exe
C:\Program Files (x86)\BigFix Enterprise\BES Client\BESClientUI.exe

Self-Service
C:\Program Files (x86)\BigFix Enterprise\BigFix Self Service Application
C:\Program Files (x86)\BigFix Enterprise\BigFix Self Service Application\BigFixSSA.exe
Console
C:\Program Files (x86)\BigFix Enterprise\BES Console
C:\Program Files (x86)\BigFix Enterprise\BES Console\BESConsole.exe
Remote Control
C:\Program Files (x86)\BigFix\Remote Control\Target
C:\Program Files (x86)\BigFix\Remote Control\Target\trc_gui.exe

Is there anything I’m missing?

  • List item
2

About Remote Control, if you are using the File Transfer session mode and EnableFileTransferSystemAccess is set to no then trc_ft.exe is executed with the priviledges of the current logged on user. So you probably need to add that too to the whitelist.

Note that there are also the processes trc_base.exe (service process) and trc_dsp.exe (display manager) but they run as Local System account.

1 Like
3

If registered in HCL BigFix Support site, this KB article also provides the details:
https://support.hcltechsw.com/csm?sys_kb_id=c8c6932e1b9bccd083cb86e9cd4bcb33&id=kb_article_view&sysparm_rank=24&sysparm_tsqueryId=aeaa8dba1bed9cd0086dcbfc0a4bcbb3

2 Likes