Avast WEBforum

Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: anthony2816 on December 06, 2006, 10:31:47 PM

Title: "Suspicious whitespace sequence"?
Post by: anthony2816 on December 06, 2006, 10:31:47 PM

When I download text or pictures from Usenet (using Agent), I keep getting Avast popups saying "Suspicious whitespace sequence".  What is this, and how can I make it stop?

Title: Re: "Suspicious whitespace sequence"?
Post by: Rick F on December 06, 2006, 10:59:29 PM

avast can be tagging your download suspicious because some viruses use the trick of inserting spaces between a file name of an attachment like this...

Info.txt                                                                            .exe

Since the window in which the names are displayed has a size limitation, it's possible that the .exe extension will not be displayed and will be clipped, making the user think that it's a TXT file, instead of an EXEcutable and possibly hostile.

Hope this helps.

Title: Re: "Suspicious whitespace sequence"?
Post by: anthony2816 on December 06, 2006, 11:44:48 PM

Thanks!  Unfortunately, that doesn't seem to apply to downloads from newsgroups.  Is there some way to stop Avast from popping up on these?

Title: Re: "Suspicious whitespace sequence"?
Post by: DavidR on December 07, 2006, 12:05:05 AM

Well you can increase the white space count in the Internet Mail provider, Heuristics, change the slider to Custom, that will allow access to the Customize... button.

Now you can increase the Maximum admissible length of sequence (which I think is preferable to unchecking the Whitespace check completely, see image.

Title: Re: "Suspicious whitespace sequence"?
Post by: anthony2816 on December 07, 2006, 03:52:19 AM

Thanks; I'll try that.  Even though this is the Internet Mail setting, it'll affect downloading from newsgroups with the Forte Agent newsreader?

Title: Re: "Suspicious whitespace sequence"?
Post by: oldman on December 07, 2006, 07:03:57 AM

It should as long as it is turned on. See the image in DavidR's post above. The NNTP tab.

Title: Re: "Suspicious whitespace sequence"?
Post by: DavidR on December 07, 2006, 01:35:43 PM

Quote from: anthony2816 on December 07, 2006, 03:52:19 AM

Thanks; I'll try that.  Even though this is the Internet Mail setting, it'll affect downloading from newsgroups with the Forte Agent newsreader?

If agent's newsreader is using Network News Transfer Protocol (NNTP), which it would appear to be as it being scanned, then yes, NNTP is monitored by the Internet Mail provider.