Avast WEBforum
Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: HansDelbruck on January 14, 2020, 05:25:57 PM
-
I was in Windows Explorer and ran an .exe file and Avast popped up and tried to block it and asked me if I wanted to create an exception for it, and I did. I figured I could remove it later as it was a one time thing.
But then later I went looking for it and I could not find it. I followed the directions here: but it was not listed there.
https://support.avast.com/en-us/article/Antivirus-scan-exclusions
I went to the Avast folder under "Program Data" and there was a file called "exclusions.ini". In there was the file listed, but I didn't want to mess with it under the assumption that there must be a "correct" way to remove the exception other than modifying a file manually like this.
So what am I doing wrong?
-
Hi,
Could you run a repair of Avast, please.
https://support.avast.com/en-ww/article/Repair-Antivirus
If the issue persists, then please add a screenshot (of "exceptions") and
could you also provide a support file id.
Please follow these steps:
1. Open - Avast Premium Security > Click on - Menu > Settings > General > Troubleshooting > Select - Enable debug logging (at the bottom)
2. To generate the support file, please see this link.
https://support.avast.com/en-ww/article/Submit-support-file
-
I ran the repair and no change. Issue still persists.
I would do a screenshot of the exceptions page but I really feel that it is quite unnecessary because it is a blank page. It just looks like a normal page on a PC that has no exceptions. It just has a big green button that says "add exceptions.
If you meant that exclusions.ini file I was talking about then this is what it has in it...
[Global]
ExcludeHashes="C:\profile\file.exe"<sha256=XXXXXXXXX>
I changed the name of the file and the long string of numbers that was the actual hash and replaced it with a bunch of x's. That file.exe is the file that I added the exception for that is not showing up.
Other than this there is another issue. I used to have a few different options for manual scans when I went to "protection-> Virus Scans" but now I have only custom scans.
-
What is C:\profile\.........? Is that really the full path or did you mean C:\Users\username\......exe?
I've never seen C:\profile even as a hidden system file and Googling does not help identify what it might be?
-
That's the path to the file that I tried to open. The files was in a folder called "profile" which is in my C: drive. It is an encrypted file that was encrypted with a program that created a self decrypting (.exe) file. When I clicked on the file I got the Avast blocking it.
-
...and could you also provide a support file id.
Please follow these steps:
1. Open - Avast Premium Security > Click on - Menu > Settings > General > Troubleshooting > Select - Enable debug logging (at the bottom)
2. To generate the support file, please see this link.
https://support.avast.com/en-ww/article/Submit-support-file
-
I have Avast Free. It looks like if you have free you can't do that. It does not allow you to submit a ticket in order to submit your debug file. It provides a link to the knowledge base or back to this forum for support.
-
So ... is anyone else having this kind of problem? Is this a known issue?
-
I have Avast Free. It looks like if you have free you can't do that.
Follow instructions: https://support.avast.com/article/33/ and post your File-ID here afterwards.
-
I have Avast Free. It looks like if you have free you can't do that. It does not allow you to submit a ticket in order to submit your debug file. It provides a link to the knowledge base or back to this forum for support.
-
So ... is anyone else having this kind of problem? Is this a known issue?
You can't contact support. You can submit your support file and post your ticket # here.
We'll alert Avast once you've submitted the file and posted the ticket#.
-
OK so here we go. I ran the tool and sent all my info to Avast. The number is L37XV. Does that sound right?
-
So again, the file in question is called exclusions.ini and it has a file listed in it. Inside the program there is nothing listed in the settings section called Exceptions. So the problem I have is that there are no exceptions listed under exceptions list there is an exception listed in that file so how do you get rid of that?
FYI the exclusions.ini file cannot be deleted. I tried.
-
The number is L37XV.
OK, now you need to wait for r@vast.
-
In the mean time ... does anyone have any knowledge of the exclusions.in file? Do everyone have one? If you have one does it show the exceptions that are listed in your exceptions list? Is you exceptions list empty?
Anyone is free to jump in. I think if I could get some feedback from some people we could figure this out.
-
Its found in the, usually hidden, system folder: ProgramData:-
"C:\ProgramData\AVAST Software\Avast\exclusions.ini"
Opens in Notepad or Wordpad and other similar programs.
-
Yeah, that's the file.
My questions are:
1. Why does it get created if the files listed within it are not listed in the Exceptions page of settings? I'm assuming that this is a bug of some kind or something went wrong and this is not correct behavior. I am assuming that if you click to add an exception for file that that exception is supposed to be listed in the exceptions page. But it is not getting added/listed on the exceptions page.
2. How is anyone supposed to know that this file or the entries in it, are even there?
3. I cannot delete the file so how do I "reset" the exceptions/exclusions?
-
As is usual with files which consider themselves important the default full permissions are for System and Admin only whilst Users only have Read and Read & execute permissions. I'm no way knowledgeable about such matters but it appears that if the System is set as the Owner even if your have admin rights the System settings prevent you from modifying or deleting it.
If you think about it the AV exclusions.ini is important - if it could be modified by an outside source easily then malware could exclude itself from AVAST scans.
You could change the permissions or more likely the Owner status using the Properties > Advanced if you really wanted to so your user account had full permissions for that file. But I strongly recommend you do not.
The answer to your second question: it is because AVAST do not want you or anything else to fiddle with it accidentally or deliberately for the reason previously stated. :)
It might not be a Global Exclusions that added it to the the exclusions.ini, what about the various AVAST shield Settings > Exclusions? Have you checked them?
The AVAST exclusions list seems to be a bit flakey, I've had the whole thing reset to default (no exclusions) when, apparently, adding too many entries. I do not even know if this is what did it for sure but that was the only explanation offered.
-
The file is also probably protected by Avast Self Defense.
(https://screencast-o-matic.com/screenshots/u/Lh/1580688930993-6354.png)
I'd wait for further clarification from Avast before removing it.
-
Yeah, that would make sense for it to protect that file if that file is where exclusions are listed. It would be a bad thing if a virus could list itself in there as an exclusion, so it would make sense for it to be difficult to edit.
However the problem remains that there is an exclusion listed n there that I wanted to be temporary and would like to remove now. Since it is only listed in that file and no where else I have no way of editing it. And had I not found this file I would not even be aware that this exception even existed. So something is wrong here and needs to be addressed. This appears to be a bug in how exceptions/exclusions get listed.
Checking another(different) PC there is no exclusions.ini file at all. The file does not exist on another PC I have, for what that's worth. So maybe it gets created IF you create an exclusion.
-
That would be normal practice.
You may have answered this earlier but can you confirm you have checked the other Shield (File System , Web. P2P etc) > Settings > Exclusions lists for that entry?
-
I do not have any other shields installed. I only see one place where there is an exceptions setting.
Settings->General->Exceptions
Other than in the hidden exclusions.ini file that you would only know about if you knew about it and looked inside.
-
The file is also probably protected by Avast Self Defense.
(https://screencast-o-matic.com/screenshots/u/Lh/1580688930993-6354.png)
I'd wait for further clarification from Avast before removing it.
If you uncheck that box, you should now be able to edit or delete that file.
Don't forget to again check the Self-Defense option after making changes.
-
Hello HansDelbruck,
if you still have exclusions.ini, can you please send it to me: petr.blatny@avast.com. I would like to find out, why it is not shown in the UI. Thank you.
Petr
-
I can do better than that ... here it is ...
[Global]
ExcludeHashes="C:\Temp\file_txt.exe"<sha256=bad7xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx>
That is all that is in that file. That's it.
-
OK I tried an experiment. I have a file let's call "file.exe". It's an encrypted file created by an encryption program; a self decrypting .exe file.
experiment 1
1. I go into file explorer and double click the file
2. Avast has a popup in the lower right corner that says that it will not allow me to run this file because it might be dangerous unless I create an exception and it provides a link at the bottom to do that.
3. I click the link and (I guess) it automatically creates the exception and then allows the program to run.
**From that point forward - no more warnings. Every time I run the program it runs and I never get asked again.
Avast has created a line for that program, including the name/path and a SHA hash, in the exclusions.ini file. Yet, if i go into settings->exceptions there is nothing - blank page.
-
experiment 2
1. Instead of double clicking the file in Windows Explorer I open Avast first and go to the exceptions page and manually add the file I want to open before I open it.
2. Now Avast adds the file name and path in the exclusions.ini file, but no hash.
3. I open the file and no warnings as there is an exception. Works fine.
4. I go back to Avast settings and manually remove the exceptions from the exceptions page.
5. Now I check the exclusions.ini file and it is empty - no files listed.
-
So what is going on? Seems like a bug to me. If you click a file and it creates an exception that exception does not get added to the exceptions page and thus you can never ever remove it.
-
OK so I have dome everything requested of me ... installed a program, sent all the support info I was asked to send, answered every question I was asked to answer ... where is tech support? Has anyone at Avast even looked into this? This appears to be a bug in their software.
I mean if you plan on not answering me then why make me jump through all these hoops and install programs and send all kinds of files and then in the end don't answer my question? >:(
This does not seem that difficult for someone at Avast who can look into the code of this thing and see why this is placing exceptions in a file with no way to remove them and not even let the user know that the exception is even there. Initially I thought this would be a simple 2 second answer from a programming aspect.
-
You could send Petr the .ini file as requested. :)
-
Um seriously? Did you see that I posted the entire file right here in the post right underneath his? There is nothing else to the file. Copy what I posted and save it as a text file and name it "exclusions.ini"
It is beginning to look like DMV here. Instead of actually trying to help someone they look to see if you are missing a form so they can send you home and you have to come back the next day so they can check again and see if you have your farm equipment registration form.
Look if they don't want to help people that's fine. They don't have to, but then say so. Don't jerk people around and keep asking for stuff you don't need to diagnose my problem just to get out of helping me. What do you want next? Urine sample?
It's beginning to look like they try to anger people so they post something angry and the topic gets locked. Is that the plan? Because 62 more posts like this and I might say something I don't mean.
So far people keep asking me for stuff but offer zero ideas. It does not appear as though anyone from Avast has looked at anything. Unless you are an Avast employee?
-
Wow, nothing? Seriously? This does not seem that difficult.
When I first posted I really thought this would be a 2 to 3 post topic at best. I thought someone from Avast would either tell me the answer or say that this is a known bug and they are working on it for the next version. But i never expected to be asked for everything under the sun and then ignored. :-\
-
You could try the latest beta: https://forum.avast.com/index.php?board=15
-
You could try the latest beta: https://forum.avast.com/index.php?board=15
Does that fix or address the problem? Or is this hollow advice designed to divert attention ... again?
I appreciate the advice but it sounds like you have no idea if this beta does or does not do anything to address my issue. What I expected was someone who was actually looking into this ot see if they could replicate it and if this is a bug in the program that others may be experiencing. A flaw in the code that a user is bringing to their attention. But, so far at least, it does not seem like Avast is interested in actually finding out what is going on here.
-
Well, it works for me in the beta, it's up to you if you try it or not.
-
You could try the latest beta: https://forum.avast.com/index.php?board=15 (https://forum.avast.com/index.php?board=15)
Does that fix or address the problem? Or is this hollow advice designed to divert attention ... again?
I appreciate the advice but it sounds like you have no idea if this beta does or does not do anything to address my issue. What I expected was someone who was actually looking into this ot see if they could replicate it and if this is a bug in the program that others may be experiencing. A flaw in the code that a user is bringing to their attention. But, so far at least, it does not seem like Avast is interested in actually finding out what is going on here.
The last reply you received from Avast was a request to submit a file. You've never acknowledged that you sent that file.
Posting something here in the forum after receiving a request, doesn't guarantee that Avast has ever looked into anything else since they are waiting to receive a file.