Avast WEBforum
Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: Fatih54102 on July 25, 2013, 09:00:42 PM
-
Hello, avast asks me what to do when a virus detected.
Block
Remove
Move to Quarantine
here i want to add "Allow" setting.
This is real important to me, if i can not do i will neither buy avast(now it seems the best av for me with best ui) nor using free version(testing).
I can wait update for 1 month but this is important(directly related to my bussiness) so i may not wait more.
PLEASE do not suggest adding exclusions list. it is the same but it steals my time so much.
Best Regards...
-
why would you allow a virus to be run.....
-
I don't think its to allow malware to run as much as it could be false positives. The urgency will clearly not be addressed. I highly doubt Avast will all of a sudden make new version with this request built in. 99% of antiviruses do not have an "allow" option. A HIPS program or a firewall does have either block or allow. What trouble are you having? Is Avast detection a legit program as malicious? The reason an "allow" option is not there is to protect users from themselves. What is the average user comes across a piece of malware and clicks "allow"by accident? Then the are infected. But who would they blame? Avast of course and not themselves. This is why programs such as a HIPS are for advanced users only.
-
as i said it is important for bussiness-specific reasons.(if you want to more information, p.m. me)
comodo and mse have this option but i think they are worse than avast.
maybe developers added a registry entry to allow this option?
---
in my opinion this is annoying because you can add a file to exclusion list but can not directly allow by selecting allow.
also i want to say that avast has the best free virus program gui. simple and useful.
-
Lol..................MSE also has the worst detection rate on the market. Comodo Internet Security by default removes malware related threats automatically. Firewall and HIPS alerts are different. Watch this video and when CIS pops up a malware alert there is no option to allow it. Unless your speaking of after you run a full scan? You only need to run a full scan with Avast about once a month or so.
http://www.youtube.com/watch?v=9pGpXoNTGwo
-
I don't think its to allow malware to run as much as it could be false positives. The urgency will clearly not be addressed. I highly doubt Avast will all of a sudden make new version with this request built in. 99% of antiviruses do not have an "allow" option. A HIPS program or a firewall does have either block or allow. What trouble are you having? Is Avast detection a legit program as malicious? The reason an "allow" option is not there is to protect users from themselves. What is the average user comes across a piece of malware and clicks "allow"by accident? Then the are infected. But who would they blame? Avast of course and not themselves. This is why programs such as a HIPS are for advanced users only.
i really must have this option because i work with files which make falsepositive to all virus-programs. for example i made a simple resource extractor(which extracts files from .rsrc of an exe file); avast detect this as 'Dropper' but indeed it is not.
Another example: some people obfuscates their .net framework programs to make it nearly impossible to read with reflector, but avast detects this as obfuscated so i can not run quickly. It is very good showing file obfuscated but it is really annoying as i can not run that quickly.
-
Well then maybe you should be using a work machine offline. Do all your software designing on a dedicated offline machine which needs no antivirus. A machine that is strictly for designing software. I honestly do not know what to tell you. I am not an Avast software engineer but as I previously stated I highly doubt Avast will urgently grant your request.
-
Lol..................MSE also has the worst detection rate on the market. Comodo Internet Security by default removes malware related threats automatically. Firewall and HIPS alerts are different. Watch this video and when CIS pops up a malware alert there is no option to allow it. Unless your speaking of after you run a full scan? You only need to run a full scan with Avast about once a month or so.
http://www.youtube.com/watch?v=9pGpXoNTGwo
Thats why i do not like MSE. Comodo is a good alternative but it is not good as much as avast.
I remember that i did a few tweak to comodo then it asked to me what to do (allowing enabled).
Is there any developer in this forum? Could you call them here?
Because without this option, it makes avast be impossible to suitable with developers-programmers.
(Sorry for bad english)
-
Well then maybe you should be using a work machine offline. Do all your software designing on a dedicated offline machine which needs no antivirus. A machine that is strictly for designing software.
Problem is there. i do not have another computer.
And developing within virtual machine is a very laggy and bad idea.
-
Again I will say and the video backs it up that Comodo does not have an "allow" option when malware is detected. Also by default the HIPS module is off. So unless it was a behavior blocker alert then that is different. Best bet is to email Avast and ask them to add your idea into the next build. But I assure you it wont cause its to dangerous. When Avast detects your software is it a virus alert or a behavior blocker alert?
http://www.avast.com/en-us/contacts
-
(http://i.imgur.com/4nxO3Y0.png)
-
Again I will say and the video backs it up that Comodo does not have an "allow" option when malware is detected. Also by default the HIPS module is off. So unless it was a behavior blocker alert then that is different. Best bet is to email Avast and ask them to add your idea into the next build. But I assure you it wont cause its to dangerous.
http://www.avast.com/en-us/contacts
But if they dont add it is a bad point for developers.
I think devs(like me,not classic) are not using avast.
It would be good if they add a registry entry to allow this option visible.
-
What version of Avast are you using? Again adding an allow option is a like giving a loaded gun to a child. We have several software engineers at my work. They all develop things inside a VM. I have used just about every antivirus out there When malware is detected I have never seen an allow option. Maybe a dev will grant your request but dont hold your breath. Your request is a very dangerous idea.
-
Avast Software has for some considerable time refused to have this one click option to Allow, as it is just too prone to accidentally allowing a virus to run.
They have to consider the 180+ million users when considering options like this and air on the side of safety over convenience for the few. That is why they have gone down the deliberate addition to an exclusion list.
Allowing some means of circumventing this, registry entry or otherwise could possible be introducing a security hole, that could be exploited.
-
Very good explanation DavidR.
-
@Fatih54102, others gave you excellent advice and reasons.
Here's my idea - take a shot at it, it might do what you need.
Make a special directory for development to hold your code, executable trials, supporting files (.dll, .jpg, etc) the whole thing.
Add that directory, instead of a specific .exe file (as I suspect you tried) to exclusions in Avast.
See what happens.
I suspect Avast will alert anyway, as you use various Windows resources, but that's only a guess.
-
Lol..................MSE also has the worst detection rate on the market. Comodo Internet Security by default removes malware related threats automatically. Firewall and HIPS alerts are different. Watch this video and when CIS pops up a malware alert there is no option to allow it. Unless your speaking of after you run a full scan? You only need to run a full scan with Avast about once a month or so.
http://www.youtube.com/watch?v=9pGpXoNTGwo
Well at least MSE actually partakes in independent pointless tests where as comodo does not.
So your favoritism toward comodo is totally unfounded.
It really depends on what sort of internet user you are.
Your point of view on MSE is also incorrect when you take into consideration the user habits.
I have used MSE myself and never came across malware at all.
-
Please stick the subject at hand which is trying help Faith. Thanks.
If you never cam across malware then how did you ever know MSE detecting anything? ::) I love people that say that. I used NIS for 2 years. Never an infection. Why? NIS never detected anything in those 2 years. Its called safe surfing habits and common sense. So just cause your antivirus kept you malware free doesn't mean its working. It also means you never came across any malware to begin with.
-
Thanks for support.
I tried to send something to support:
Fatih
User
Posted on: 26 July 2013 10:24 AM
Explanation.png (41.16 KB)
> Hello,
>
> Unfortunately I'm not sure if I understand your issue / request. Do you want to stop popups if a malware is found or allow them? Anyway you may use exclusion list if you need exclude some application/folder/file.
>
> Best regards,
>
> Avast Software a.s. 2nd level support team
>
> Tomas
Hello firstly thank for quick help,
---
Summary: i need allow option in virus found popup in order to allow viruses(falsedetected).
I can not add every program to exclusion list as it steals my time(i need time for my bussiness) and it does not allow completely, for example if i run a false-detected program even if i add to exclusion list; Avast blocks program because program tried to extract a resource.For this two reason i can not use exclusion list.
If you do not understand still, take a look of attached picture.
---
as i said i MUST need allowing option in a virus-malware found popup appears in order to allow virus. This is important for my bussiness because i develop programs like 'Resource Extractor'. Or if i use obfuscator for obfuscating code (You know .Net(C#,vb.net,F#,..) programmes' codes can be seen through .net reflectors, so you must hide your code by obfuscating them). There are many examples like these.
This lack is the first i found in Avast, thanks for support.
===
If you can not add this option directly, you may add a setting to enable it or add a security control which shows another popup to confirm selecting 'allow' option like this 'You selected allow option, do you want to continue?'
Please this is important for developers like me, iam also seeing many people who does not like this lack.
You should not forget that not only basic users use avast, home developers use too.
Despite of this, it is very good application.
********************
Tomáš Zajíc
Staff
Posted on: 26 July 2013 09:24 AM
Hello,
Unfortunately I'm not sure if I understand your issue / request. Do you want to stop popups if a malware is found or allow them? Anyway you may use exclusion list if you need exclude some application/folder/file.
Best regards,
Avast Software a.s. 2nd level support team
Tomas
********************
Fatih
User
Posted on: 25 July 2013 09:51 PM
Related Picture: http://i.imgur.com/4nxO3Y0.png
Hello, iam a developer and i work with files which antiviruses gives false alert. For example obfuscators, i can not use avast if i obfuscate file; it shows a popup that says obfuscated file found(virus) , if i add file exclusion list it steals my time about 1-2 minute. and i work 1000~ these files daily and now it is impossible to use avast as antivirus.
It would be very good if there is a option "Allowing" if a virus detected popup appears.
I think avast is very good choice but if it will not be added, i will not buy avast like many developers(who works with extractors,obfuscators,...) .
If you say it is a bad idea because it is dangerous, then you can add a ini file or registry entry in order to add 'allow' option.
I know many developers use microsoft security essentials for this annoying lack.
-
Please stick the subject at hand which is trying help Faith. Thanks.
If you never cam across malware then how did you ever know MSE detecting anything? ::) I love people that say that. I used NIS for 2 years. Never an infection. Why? NIS never detected anything in those 2 years. Its called safe surfing habits and common sense. So just cause your antivirus kept you malware free doesn't mean its working. It also means you never came across any malware to begin with.
Avast is better than MSE but without this option, it becomes useless for me. But in my opinion it is still the best.
-
Lol..................MSE also has the worst detection rate on the market. Comodo Internet Security by default removes malware related threats automatically. Firewall and HIPS alerts are different. Watch this video and when CIS pops up a malware alert there is no option to allow it. Unless your speaking of after you run a full scan? You only need to run a full scan with Avast about once a month or so.
http://www.youtube.com/watch?v=9pGpXoNTGwo
Well at least MSE actually partakes in independent pointless tests where as comodo does not.
So your favoritism toward comodo is totally unfounded.
It really depends on what sort of internet user you are.
Your point of view on MSE is also incorrect when you take into consideration the user habits.
I have used MSE myself and never came across malware at all.
Yeah Microsoft is more understanding, but it have also bad points such as can not stop auto-updating system.
-
@Fatih54102, others gave you excellent advice and reasons.
Here's my idea - take a shot at it, it might do what you need.
Make a special directory for development to hold your code, executable trials, supporting files (.dll, .jpg, etc) the whole thing.
Add that directory, instead of a specific .exe file (as I suspect you tried) to exclusions in Avast.
See what happens.
I suspect Avast will alert anyway, as you use various Windows resources, but that's only a guess.
Dude i tried,tried even i searched this option 15 minute in avast interface. If I move to directory(i added directory to exclusion list) avast alerts still because running falsealerted virus extracted something.
I also work with real viruses to deal with them with a disassembler/debugger but this annoying lack really makes avast useless for developers like me.
Avast will gain more money if adds allowing to that popup.
-
Avast Software has for some considerable time refused to have this one click option to Allow, as it is just too prone to accidentally allowing a virus to run.
They have to consider the 180+ million users when considering options like this and air on the side of safety over convenience for the few. That is why they have gone down the deliberate addition to an exclusion list.
Allowing some means of circumventing this, registry entry or otherwise could possible be introducing a security hole, that could be exploited.
But it is really important to me(low level developers).
You are true it is not good to directly add but at least add a option to show it or show another popup to confirm selecting allow option like this: 'You have selected allow option, Do you sure?'
-
What version of Avast are you using? Again adding an allow option is a like giving a loaded gun to a child. We have several software engineers at my work. They all develop things inside a VM. I have used just about every antivirus out there When malware is detected I have never seen an allow option. Maybe a dev will grant your request but dont hold your breath. Your request is a very dangerous idea.
I am a low level developer(dealing with viruses,decompiling disassembling them, deobfuscating, block extracting). So at least add another popup to confirm selecting allow option,or add a setting to interface. If a dev does a specific build it would be very good.
-
I'm not an avast team member so cant say for sure but I cant see that your request would be granted, this would be a highly dangerous option being that many unknowing users are click happy and an option such as what you are requesting would just be asking for trouble imo.
My only suggestion for you would be if you are willing or wanting to openly allow viruses to run then disable your antivirus at your own risk.
-
Work offline in a VM. Nothing else to say. Avast is not going to grant 1 persons wish amongst millions of others. As I have previously stated I have never seen ANY antivirus with an "allow" option when it comes to malware.
-
Avast Software has for some considerable time refused to have this one click option to Allow, as it is just too prone to accidentally allowing a virus to run.
They have to consider the 180+ million users when considering options like this and air on the side of safety over convenience for the few. That is why they have gone down the deliberate addition to an exclusion list.
Allowing some means of circumventing this, registry entry or otherwise could possible be introducing a security hole, that could be exploited.
But it is really important to me(low level developers).
You are true it is not good to directly add but at least add a option to show it or show another popup to confirm selecting allow option like this: 'You have selected allow option, Do you sure?'
First I'm an avast user not employee, but having been an active member of these forums for a little over nine years. During this time I have seen multiple requests for such an option,which has essentially be declined over the deliberate action of adding to the exclusion lists.
The numbers of low level developers is infinitesimal when compared to avast users that aren't that savvy and could well do serious harm to their system by accidental/click happy response to dialogue windows. These are the people that avast are I feel more concerned with.
The more tech savvy users are generally going to find a way to work with the exclusions without too much pain.
An other possible option is to have a working folder which you can exclude the sub-folders and contents. But that too would come with risk if a live virus was to get in there.
-
Avast Software has for some considerable time refused to have this one click option to Allow, as it is just too prone to accidentally allowing a virus to run.
They have to consider the 180+ million users when considering options like this and air on the side of safety over convenience for the few. That is why they have gone down the deliberate addition to an exclusion list.
Allowing some means of circumventing this, registry entry or otherwise could possible be introducing a security hole, that could be exploited.
But it is really important to me(low level developers).
You are true it is not good to directly add but at least add a option to show it or show another popup to confirm selecting allow option like this: 'You have selected allow option, Do you sure?'
First I'm an avast user not employee, but having been an active member of these forums for a little over nine years. During this time I have seen multiple requests for such an option,which has essentially be declined over the deliberate action of adding to the exclusion lists.
The numbers of low level developers is infinitesimal when compared to avast users that aren't that savvy and could well do serious harm to their system by accidental/click happy response to dialogue windows. These are the people that avast are I feel more concerned with.
The more tech savvy users are generally going to find a way to work with the exclusions without too much pain.
An other possible option is to have a working folder which you can exclude the sub-folders and contents. But that too would come with risk if a live virus was to get in there.
If I open a folder and put the related files there, avast still blocks my action because false alerted programs try to extract something.
Anyway which antivirus program is most suitable for me? What is your advice? (Except avast)
-
Do you honestly think your going to get an answer from asking a question such as "Which antivirus is most suitable for me?" in an Avast forums. ::)
As I have previously stated I used everything out there. I have never seen any antivirus with an "allow' option when it comes to malware detection. People who suggest making a folder and excluding are incorrect. That is fine and dandy for fulls scans but not when it comes to file protection. Even if you work from within that excluded folder. Want the best answer?
Use a virtual machine. Or use a dedicated offline machine that does not ever connect to any other pc's or the internet.
-
Anyway which antivirus program is most suitable for me
maybe you want one with no realtime protection? .... then you can do the work with no warning popups
-
Anyway which antivirus program is most suitable for me
maybe you want one with no realtime protection? .... then you can do the work with no warning popups
no because i work with real viruses too. there should be realtime protection but also allowing option. Just like MSE.
-
If you are working with real malware then use a VM offline. Better choice is use a dedicated offline machine. Its that easy. Nothing else needs to be addressed.
-
If you are working with real malware then use a VM offline. Better choice is use a dedicated offline machine. Its that easy. Nothing else needs to be addressed.
i am using real viruses and my development stuff combined in one pc(VM Offline is a good alternative but it steals time too, as if I open virus I have to reset virtual disk of vm), also i get viruses from internet and so i am not sure whether it is real virus or not.
-
I thought Avast used to have an "ignore" option. Am I wrong? I wouldn't mind having an "ignore" option myself for the files Avast flags that I know are false positives. But then again I also know what I am doing.
-
It has a No Action (not Ignore) option in the file system shield settings , but that won't allow it to be run, it leaves it in place and takes no other action. If you try to run it again it will still alert/block it from running.
It has a Do Nothing option in the on-demand scan settings, that to just leaves the file in place and if you try to run it the file system shield will jump on it again.
The only Ignore option is in the anti-rootkit scan when a suspect/hidden file is found. This is I believe more because there can be many legit instances of hidden drivers/system files, so rather than delete (the only other option). There are no user configurable settings for the auto anti-rootkit scan about 8 minutes after boot.
-
Hello,
I am using MSE now, but it can not detect crypted viruses.
So I want to switch back to Avast. But is this option added with latest beta or something else?!
-
It has a No Action (not Ignore) option in the file system shield settings , but that won't allow it to be run, it leaves it in place and takes no other action. If you try to run it again it will still alert/block it from running.
It has a Do Nothing option in the on-demand scan settings, that to just leaves the file in place and if you try to run it the file system shield will jump on it again.
The only Ignore option is in the anti-rootkit scan when a suspect/hidden file is found. This is I believe more because there can be many legit instances of hidden drivers/system files, so rather than delete (the only other option). There are no user configurable settings for the auto anti-rootkit scan about 8 minutes after boot.
Thing I want is adding the Ignore option (placed in anti-rootkit scan) into the classic real-time detection popup.
Please do this as MSE is awful. At least add an option and hide it (to not get attention of dumb users) so that I will be able to use this feature.
Consider this even Microsoft added this option to MSE years ago, and viruses could not exploit this feature. Do like that please.
-
Ignore is an option in the anti-rootkit scan that runs 8 minutes after boot.
Outside of that scan it is a normal on-access scan (not a specific anti-rootkit scan) alerting on a signature associated with a rootkit, in these cases the normal file system shield settings apply.
In all honesty exclusion isn't the way to go if you consider something a false positive:
1. confirm by using a multi-engine scanner, such as virustotal.com and report your findings.
2. if avast is the only AV detecting this then, submit as a false positive for analysis and correction
3. once the signature is corrected (if confirmed an FP) there is no need for exclusion. That not only helps you but all other avast users if they have the same file.
-
Ignore is an option in the anti-rootkit scan that runs 8 minutes after boot.
Outside of that scan it is a normal on-access scan (not a specific anti-rootkit scan) alerting on a signature associated with a rootkit, in these cases the normal file system shield settings apply.
In all honesty exclusion isn't the way to go if you consider something a false positive:
1. confirm by using a multi-engine scanner, such as virustotal.com and report your findings.
2. if avast is the only AV detecting this then, submit as a false positive for analysis and correction
3. once the signature is corrected (if confirmed an FP) there is no need for exclusion. That not only helps you but all other avast users if they have the same file.
Did the team add Ignore button (works like MSE's) ?
-
I recommend the original poster of this topic goes to wilderssecurity.com, or similar,
and makes an open-ended question to the appropriate forum.
State the problem, but do not "load" the question with what you think the solution should be.
You might get some better answers this way.