Hello to all. It seems that I can't find information to some elementary questions. What is exactly scanned in the following scenario:
Use predefined scan "Select folders to scan", and select some subdirectory, for example "c:\Documents and Settings". Now deselect some subdirectory, for example "c:\Documents and Settings\All Users". At that moment, parent directory, "c:\Documents and Settings", will no longer be listed in "Selected paths" window. Does that mean that files in directory "c:\Documents and Settings" will not be scanned any more? It seems that, generally, for whatever directory level have deselected subdirectory, files in that directory (or its parents directories) will not be scanned any more, although they were previously selected. I am not quite sure, but I think I have missed virus that way. Can somebody confirm this? What are the selection rules for arbitrary combinations of selected and deselected directories on several levels of subdirectory structure?
There is also another, related question. Is there easy way to scan only files and not any of the subdirectories? It is almost impossible to fill long exclusion list of all subdirectories which will only be used for single test scan, and then doing that again and again for next directory.
Why do I need it? Sometimes, because of timing or other restrictions, it is necessary to avoid immediate full scan of everything. Because of that, first thing I have to do is understand what was affected with some infection and, if possible, to learn at least something of virus behavior. For that, I do many small scan tests (what user rights were used for infection or, for example, to see if single temporary cleaned directory will be infected again), which must be very fast. Exhaustive scan is not necessary at that point, but it is imperative that I know exactly what subset of files and directories I am actually scanning. I can't find that in the manual. If I am right about my assumption, it is dangerous, nonintuitive behavior.