Author Topic: Making file a "exception"  (Read 43090 times)

Offline allskin

  • Newbie
  • *
  • Posts: 6
    • Personal Message (Offline)
Making file a "exception"
« on: September 22, 2008, 09:42:48 AM »
Hello,

First of all, sorry my english.

I have a file that i know that is not a virus but Avast detects as.

So, i want to add this file as a exception in "on-access protection".

How can i do it?

Thanks in advance

Offline Bluesman

  • avast! Evangelist
  • Advanced Poster
  • ***
  • Posts: 882
  • Gender: Male
  • Amiga Power!
    • Personal Message (Offline)
Re: Making file a "exception"
« Reply #1 on: September 22, 2008, 10:07:08 AM »
Hello,

First of all, sorry my english.

I have a file that i know that is not a virus but Avast detects as.

So, i want to add this file as a exception in "on-access protection".

How can i do it?

Thanks in advance

Welcome to the forum! :)

What file is it?

You need to use the Exclusion lists:

Standard Shield provider (on-access scanning):
Left-click on the avast-ball in the tray area, click on the provider icon at left and then click on "Customize".
Then go to the "Advanced" tab and click on the "Add" button...

For the other providers (on-demand scanning (such as the screensaver) or the Simple user interface):
Right-click on the the avast-ball, then click on "Program Settings"
Go then to the "Exclusions" tab and click on the "Add" button...

If you want it, you can use wildcards like ? and *
« Last Edit: September 22, 2008, 10:15:49 AM by Bluesman »
"The blues are the roots, everything else is the fruits" -Willie Dixon

Offline allskin

  • Newbie
  • *
  • Posts: 6
    • Personal Message (Offline)
Re: Making file a "exception"
« Reply #2 on: September 22, 2008, 10:17:23 AM »
Hello,

So, if the file is "madplay.exe", i can add only "madplay.exe" in the exclusion list?

I'v done this:



But when i try to use the file, the virus message appears.

Thanks


Offline Bluesman

  • avast! Evangelist
  • Advanced Poster
  • ***
  • Posts: 882
  • Gender: Male
  • Amiga Power!
    • Personal Message (Offline)
Re: Making file a "exception"
« Reply #3 on: September 22, 2008, 10:29:09 AM »
But when i try to use the file, the virus message appears

I have never used the exclusion lists, so I just guessing, maybe you need to add the full path to the file and not just the file name, like this:

c:\program files\madplay.exe

And also restart the computer, so you reset the memory (if the file is loaded in the memory)

If you know that the file is a false positive ( try it with VirusTotal . http://www.virustotal.com ), zip it and set an password on the archive, and send the file to virus@avast.com (and remember to write the password in the mail)
"The blues are the roots, everything else is the fruits" -Willie Dixon

Offline allskin

  • Newbie
  • *
  • Posts: 6
    • Personal Message (Offline)
Re: Making file a "exception"
« Reply #4 on: September 22, 2008, 10:39:37 AM »
Hello,

Yes, i'v tryed the full path but don't work and the file is not loaded in ram.

VirusTotal Report: http://www.virustotal.com/analisis/77d1f43d2f6a99e30db0900fea4cb094

I'll try to send a e-mail for virus@avast.com.

Thanks a lot.

Regards

Offline allskin

  • Newbie
  • *
  • Posts: 6
    • Personal Message (Offline)
Re: Making file a "exception"
« Reply #5 on: September 22, 2008, 12:28:40 PM »
Ok, e-mail sended to virus@avast.com

I'll wait for the answer.

Thanks

Offline DavidR

  • avast! Überevangelist
  • Certainly Bot
  • *****
  • Posts: 69207
  • Gender: Male
  • No support PMs thanks
    • Personal Message (Offline)
Re: Making file a "exception"
« Reply #6 on: September 22, 2008, 01:47:36 PM »
Since most of the detection in VT are either generic (-gen) or heuristic (suspicious) it is highly likely this is an FP.

What exactly did you enter in the exclusion for the path ?

Try this in your exclusions, c:\*\madplay.exe if it is on the c drive, the use of the * wild card means you don't have to put in the full path.
You have to exercise care when using wild cards so as not to leave holes in your security, but like this it should be OK>
Core2Duo E8300/ 4GB Ram/ WinXP ProSP3/ avast! free 2014 9.0.2018/ Outpost Firewall Pro9.1/ Firefox 28.0, NoScript, RequestPolicy/ MailWasher Pro/ DropMyRights/ MalwareBytes AntiMalware Premium 2.0.1/ WinPatrol+/ Drive Image 7.1/ SnagIt 10.0/ avast! mobile security

Offline allskin

  • Newbie
  • *
  • Posts: 6
    • Personal Message (Offline)
Re: Making file a "exception"
« Reply #7 on: September 22, 2008, 04:36:33 PM »
Hello,

i'v entered: C:\PROGRAM FILES\(Folder Name)\(Program Folder)\madplay.exe

EDIT: Used c:\*\madplay.exe and it works!

Thanks a lot one more time DavidR and Bluesman ;)

Regards
« Last Edit: September 22, 2008, 04:39:56 PM by allskin »

Offline DavidR

  • avast! Überevangelist
  • Certainly Bot
  • *****
  • Posts: 69207
  • Gender: Male
  • No support PMs thanks
    • Personal Message (Offline)
Re: Making file a "exception"
« Reply #8 on: September 22, 2008, 06:03:57 PM »
No problem, glad I could help.

Welcome to the forums.
Core2Duo E8300/ 4GB Ram/ WinXP ProSP3/ avast! free 2014 9.0.2018/ Outpost Firewall Pro9.1/ Firefox 28.0, NoScript, RequestPolicy/ MailWasher Pro/ DropMyRights/ MalwareBytes AntiMalware Premium 2.0.1/ WinPatrol+/ Drive Image 7.1/ SnagIt 10.0/ avast! mobile security

Online Tech

  • avast! team
  • Certainly Bot
  • *
  • Posts: 64879
  • Gender: Male
    • Personal Message (Online)
Re: Making file a "exception"
« Reply #9 on: September 22, 2008, 10:00:32 PM »
allskin, add the file to Chest (right clicking the Chest and choosing add) and scan it. Check back if after you update your avast installation the file is still being detected as infected.
If it's clean, you can remove the exception ;)
The best things in life are free.

Offline rogman49

  • Newbie
  • *
  • Posts: 17
    • Personal Message (Offline)
Re: Making file a "exception"
« Reply #10 on: September 23, 2008, 02:22:25 PM »
All,

I was having a similar problem as Allskin. I use a free software program to open / close dvd drives. Using it for years. After yesterday's virus update Avast started flagging it as a virus. I tried to add full path to exception list to no avail. I then used the C:\*\XXXXXXX.EXE and it worked fine. Wonder why full path name does not work? ???

Online Tech

  • avast! team
  • Certainly Bot
  • *
  • Posts: 64879
  • Gender: Male
    • Personal Message (Online)
Re: Making file a "exception"
« Reply #11 on: September 23, 2008, 02:44:27 PM »
I then used the C:\*\XXXXXXX.EXE and it worked fine.
Is it an example or the file is called XXXXXXX.EXE really?

Wonder why full path name does not work? ???
Sometimes it's invoked (run) by the short path (something like C:\Program~1\Files~1\name.exe).
The best things in life are free.

Offline rogman49

  • Newbie
  • *
  • Posts: 17
    • Personal Message (Offline)
Re: Making file a "exception"
« Reply #12 on: September 23, 2008, 03:11:41 PM »
Hi Tech,

The XXXXXXXX is an example. It is a simple program from RJL Software.  ;D

Online Tech

  • avast! team
  • Certainly Bot
  • *
  • Posts: 64879
  • Gender: Male
    • Personal Message (Online)
Re: Making file a "exception"
« Reply #13 on: September 23, 2008, 03:30:31 PM »
Hi Tech,

The XXXXXXXX is an example. It is a simple program from RJL Software.  ;D
So, you the real path should work if you write it down correctly.
The short (8.3) also can be necessary sometimes.
Sometimes, you need to boot to activate the exceptions.
The best things in life are free.

Offline DavidR

  • avast! Überevangelist
  • Certainly Bot
  • *****
  • Posts: 69207
  • Gender: Male
  • No support PMs thanks
    • Personal Message (Offline)
Re: Making file a "exception"
« Reply #14 on: September 23, 2008, 03:49:48 PM »
I was having a similar problem as Allskin. I use a free software program to open / close dvd drives. Using it for years. After yesterday's virus update Avast started flagging it as a virus. I tried to add full path to exception list to no avail. I then used the C:\*\XXXXXXX.EXE and it worked fine. Wonder why full path name does not work? ???

Since you don't give us the full path that you entered we can't possibly comment.

When avast detects it, you can actually copy and paste the full path from the alert window.

However exclusion is only masking a symptom and not treating the problem, you need to use virustotal to confirm it is a false positive and send a sample to avast rather than just exclude.
Core2Duo E8300/ 4GB Ram/ WinXP ProSP3/ avast! free 2014 9.0.2018/ Outpost Firewall Pro9.1/ Firefox 28.0, NoScript, RequestPolicy/ MailWasher Pro/ DropMyRights/ MalwareBytes AntiMalware Premium 2.0.1/ WinPatrol+/ Drive Image 7.1/ SnagIt 10.0/ avast! mobile security

 

Google Chrome

AVAST recommends using the FREE Google Chrome™ browser.

Download Google Chrome Now