Avast WEBforum

Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: coffent on May 20, 2021, 10:54:19 PM

Title: Need explanation of "Threat blocked" message
Post by: coffent on May 20, 2021, 10:54:19 PM

I got a popup window saying "Threat blocked.  We've blocked UNINSTALLEXCHANGE.PS1 because it was infected with IDP.ALEXA.53", and saying "File path:  [my program folder]\AVAST\SETUP\UNINSTALLEXCHANGE.PS1" and "Process:  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe".

There is no file named UNINSTALLEXCHANGE.PS1 in the folder ...\AVAST\SETUP.  Was it there before and Avast has moved it?  Is UNINSTALLEXCHANGE.PS1 an Avast file?  If so, why would it be infected?  The only changes I've made to Avast have been to accept their periodic updates.

What does "Process" signify?  Did powershell.exe call UNINSTALLEXCHANGE.PS1?  While I installed Windows Powershell on my computer a couple of years ago, I've used it rarely if at all, and certainly not recently, and definitely didn't try to access an Avast file, which before now I didn't even know existed.

Title: Re: Need explanation of "Threat blocked" message
Post by: rocksteady on May 21, 2021, 10:48:13 AM

You may wish to read this thread: https://forum.avast.com/index.php?topic=237825.0

Title: Re: Need explanation of "Threat blocked" message
Post by: coffent on May 21, 2021, 09:05:35 PM

Thanks for the suggestion.  One suggestion at the link you supplied was to send the file to VT (https://www.virustotal.com) for evaluation.  I couldn't find any way to find the file in Avast's "Virus Chest" so I opted to have Avast restore the file.  However it doesn't seem to have done so, as it doesn't exist at the specified location.  I ran another scan using Avast and it turned up nothing this time.

Title: Re: Need explanation of "Threat blocked" message
Post by: DavidR on May 21, 2021, 10:43:24 PM

Quote from: coffent on May 21, 2021, 09:05:35 PM

Thanks for the suggestion.  One suggestion at the link you supplied was to send the file to VT (https://www.virustotal.com) for evaluation.  I couldn't find any way to find the file in Avast's "Virus Chest" so I opted to have Avast restore the file.  However it doesn't seem to have done so, as it doesn't exist at the specified location.  I ran another scan using Avast and it turned up nothing this time.

For future reference, there is an option in the virus chest to Send for analysis.