Avast WEBforum

Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: REDACTED on September 22, 2014, 12:09:38 PM

Title: False Positive on Simple VB.NET Program
Post by: REDACTED on September 22, 2014, 12:09:38 PM

Avast marks the EXE built by Visual Studio 2010 for a simple VB.Net solution I created this morning as a virus, preventing it from running, even when launched by Visual Studio for debug. (Win32:Evo-gen[Susp])

I could maybe add Visual Studio's "Projects" directory to the AV exclusion list, but I find I  am having to do this more and more and more recently for any code that I need to compile, be it Visual Studio, Eclipse CDT, or even just DevShed-C++.

It will very soon get to the point where I will be worrying that excluding so many directories and their sub-directories may leave me open to the situation where a virus *does* locate itself into one of these directories!

I note a rash of similar posts on these forums from sometime last year, I wasn't building VB stuff then but haven't had issues in the last few months until just recently, so I guess something in the virus definitions may have been added back where it shouldn't have been?

Is there anything I can do to prevent my VB programs from causing these false positives?

Title: Re: False Positive on Simple VB.NET Program
Post by: Milos on September 22, 2014, 03:11:19 PM

Hello,
send the detected samples for analyze, please. Use http://www.avast.com/contact-form.php

Thank you,
Milos

Title: Re: False Positive on Simple VB.NET Program
Post by: REDACTED on October 09, 2014, 01:02:30 AM

I have the same problem (with VS2013) and have submitted my program.  But even when I add it as an exclusion it still gets detected - why?

I'm aware that to achieve a good level of detection there will be cases of false positives and I don't mind that some newly compiled programs may be detected, but please MAKE FILE EXCLUSION WORK PROPERLY so that I can get on with my work without having to disable AV every time I do a build. >:(

Title: Re: False Positive on Simple VB.NET Program
Post by: Milos on October 09, 2014, 09:54:16 AM

Quote from: Barbarian on October 09, 2014, 01:02:30 AM

I have the same problem (with VS2013) and have submitted my program.  But even when I add it as an exclusion it still gets detected - why?

I'm aware that to achieve a good level of detection there will be cases of false positives and I don't mind that some newly compiled programs may be detected, but please MAKE FILE EXCLUSION WORK PROPERLY so that I can get on with my work without having to disable AV every time I do a build. >:(

Hello,
where did you put the exclusion? You have to put it to settings of the shield, which detected the file.

Milos

Title: Re: False Positive on Simple VB.NET Program
Post by: REDACTED on October 09, 2014, 10:31:07 AM

Quote from: Milos on October 09, 2014, 09:54:16 AM

where did you put the exclusion? You have to put it to settings of the shield, which detected the file.

When the detection occurred I clicked the link that said something like "Restore file and add to exclusions"

Title: Re: False Positive on Simple VB.NET Program
Post by: REDACTED on October 09, 2014, 10:57:22 AM

Just to clarify my previous post, I went into Scan>Quarantine (Virus Chest), right clicked on the entry for my program and chose "Restore and add to exclusions".  I then did a Rebuild in Visual Studio expecting everything to be OK, but the detection kicked off again.  Without any other action on my part the exclusion is also in Settings>Antivirus, (scroll down) Exclusions, File Paths.

Is there something I'm missing?