Avast WEBforum

Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: mijewen on December 31, 2021, 03:55:57 PM

Title: Global file exception
Post by: mijewen on December 31, 2021, 03:55:57 PM
Autohotkey is a script interpreter that I use extensively.  I have over a hundred scripts that I have written - all text files, but with filenams of    filename.ahk.   One of these scripts starts at boot time (in my startup file), and it is called atb.ahk.  This script interprets certain key combinations to kick other autohotkey scripts into action, but Avast sees all xxx.ahk scripts as being infected and moves them to quarantine.

My problem is that every time I try to run a script, avast goes "dong dong dong" and says it has some virus in it, and transfers it to quarantine.  That means that when the computer boots, atb.ahk is no longer where the startup expects to find it, so it doesn't start automatically.  It also means that every time I try to run any other script, whether from a key combination in atb.ahk or by clicking it in Explorer,   I have to go through the same  "dong dong dong"  procedure, after which it is no longer where I expect to find it, but in quarantine.  That's a real nuiscance, because there are a lot of these scripts, and I depend on them.

I have tried to set an exception of "*.ahk", and when it doesn't work, I assume that the global exception didn't take, and try to set it again, but Avast tells me that it already has this exception.  As I have just had the "dong dong dong" treatment, however, the global exception clearly doesn't work.

Is there a way around this (apart from scrapping Avast)?
Title: Re: Global file exception
Post by: Pondus on December 31, 2021, 04:00:57 PM
https://forum.avast.com/index.php?topic=14433.msg1289438#msg1289438


Title: Re: Global file exception
Post by: mijewen on January 01, 2022, 02:25:18 AM
The link takes me to a page of 8 further links, which are entitled ...
Report a suspected false positive - not my case
Report a malicious sample - not my case
Reporting malware samples to the Avast Threat Lab - that's not what I'm trying to do.
Submitting files from the Virus Chest to Avast Virus Lab - ditto
Uploading files to the Avast FTP server - ditto
What Do I Do If an Engine Detects My Safe File as a Threat? -  please re-read my problem description
Support: Avast file whitelisting - this held some initial promise - but it takes me to a page that does not offer advice
Support: Avast Clean Guidelines - ditto

So thanks for the link, Pondus, but I really don't understand why you sent it.
Title: Re: Global file exception
Post by: DavidR on January 01, 2022, 02:38:31 AM
1.  Report a suspected false positive - not my case
2.  Report a malicious sample - not my case

Well it has to be one or the other !

Hotkey by its nature can do many things and the file isn't digitally signed.
It may not be the file in and of itself, but the actions taken that may be an issue, this is possibly a very good reason why you should submit it as doing nothing will achieve nothing.
Title: Re: Global file exception
Post by: Pondus on January 01, 2022, 03:11:33 AM
Quote
So thanks for the link, Pondus, but I really don't understand why you sent it.
If you think your file(s) are wrongly detected by avast, then you report them as False positive and detection will be removed by avast lab


Title: Re: Global file exception
Post by: mijewen on January 01, 2022, 01:26:55 PM
DavidR, 
Pondus,

it seems that I did not express myself well in my opening post.  What I want is that Avast will totally ignore any file with an
extension of ".ahk".   Don't check it for viruses, don't even look at it.

I tried making a file exception of   *.ahk   and the exception seems to be accepted by Avast (because if I try to make the same exception again, Avast says it already has that exception), but it doesn't work.  .ahk files are still tested and found to have malware.
They haven't.  They are text files that I wrote myself in an editor.
Title: Re: Global file exception
Post by: Asyn on January 01, 2022, 03:10:07 PM
- Which Avast..? (Free/Premium/One)
- Which version/build of Avast..?
- OS..? (32/64 Bit..? - which SP/Build..?)
- Other security related software installed..?
- Which AV(s) did you use before Avast..?
Title: Re: Global file exception
Post by: DavidR on January 01, 2022, 03:26:28 PM
DavidR, 
Pondus,

it seems that I did not express myself well in my opening post.  What I want is that Avast will totally ignore any file with an
extension of ".ahk".   Don't check it for viruses, don't even look at it.

I tried making a file exception of   *.ahk   and the exception seems to be accepted by Avast (because if I try to make the same exception again, Avast says it already has that exception), but it doesn't work.  .ahk files are still tested and found to have malware.
They haven't.  They are text files that I wrote myself in an editor.

I too will expand, excluding a file from being scanned, as far as I'm aware wouldn't prevent its actions being checked when Autohotkey runs those commands in the file.

I have never used Autohotkey, so I can't speak from personal experience.
Title: Re: Global file exception
Post by: mijewen on January 03, 2022, 03:39:40 AM
Thanks Pondus - I agree.  Every time an AutoHotKey script is run, the interpreter must be in memory to interpret it, but Avast does not call out the interpreter (which starts at boot time) - it flags the script file, and it is the script file that gets put in quarantine.  If I then try to run a different script file, it also gets flaggand quarantined, but the interpreter does not.

Asyn, to answer your questions

- Which Avast..? (Free/Premium/One) - Free
- Which version/build of Avast..?         -21.2.2455 (build 21.2.6096.705)
- OS..? (32/64 Bit..? - which SP/Build..?) - Windows 7/64 pro  SP1
Avast is under Program Files (as opposed to Program files (x86)), so I presume it's a 64 bit version.
- Other security related software installed..? - none that I have installed knowingly.  I think there is an anti-malware in Windows
- Which AV(s) did you use before Avast..?    - can't remember - it's a lot of years ago

This all probably seems a bit odd, so here's the story.

I have been running Windows-7 for many years (I think it's about 8 years), but I recently had a boot failure.  I removed the drive and fitted another drive, formatted it and put a Win-7 OS on it from the installation DVDs.  This installation is only a month old.  It allows me to browse the web, send emails, etc. - do some of the essential stuff.  I can't run many of the programs on the original drive, however (on USB).  For example, Excel says "This program must be installed before it can be used"

The original drive is readable (but not bootable) on USB, so I copied the Program Files (also Program files (X32/86) to the "new" drive.  Avast seems to be working as before, but is picking on my script files, which it wasn't before, so I thought a global exception for all .ahk files would fix it.

It probably seems to you that getting this info is a bit like pulling teeth, for which I apologise - but I really thought that somebody would give me a simple procedure to set a global file exception for all ahk files, and that would get me going again.  It will be temporary in any case, as  for several reasons, I am going to get another laptop -  though I will probably still be using this one for a couple of months while I "move into" the new one.
Title: Re: Global file exception
Post by: Asyn on January 03, 2022, 09:05:08 AM
Update to the latest version (21.11): https://forum.avast.com/index.php?topic=310650.0
Title: Re: Global file exception
Post by: mijewen on January 04, 2022, 12:47:29 AM
Asyn,  that's surprising, because the version I have says "Your PC is protected.  Antivirus is fully enabled and up to date."
(http://C:\Users\mik\Documents\Junk\Avast up to date.png)
Title: Re: Global file exception
Post by: mijewen on January 04, 2022, 01:10:55 AM
Asyn, I have spent a while trying to find out how to bring the software up to date, but I can't see how to do it manually.  Previously, it has always done it automatically, but my guess is that it does that when it is out of date.  However, it claims to be up to date.

I just found, under Settings / Update
"Virus definitions are up to date.  Release date was Jan 4, 202212:05AM  (Version 220103-4)"

"Your application is up to date.  Release date was March 22, 2021  7:22 AM  (Version 21.2.2455 -build 21.2.6096.705)"
Title: Re: Global file exception
Post by: DavidR on January 04, 2022, 02:41:55 AM
Have you tried a manual program update (rather than wait for an automatic program update) from the Avast Tray icon (see attached image) ?

If that results in being told your program is up to date - try an avast Repair.
AvastUI > Menu > Settings > General > Troubleshooting > APP Repair - Restart after completion.
Title: Re: Global file exception
Post by: mijewen on January 09, 2022, 04:21:58 PM
Solved!  I discovered under <myName>/Settings, it is possible to make an exception of a folder, rather than a file, so I put all of my *.ahk files into an "autohotkey_scripts" folder and made an exception of that, and it appears to work the way I wanted.

If somebody had been able to tell me that in December, we could all have saved some effort.
Title: Re: Global file exception
Post by: Asyn on January 09, 2022, 04:27:16 PM
Thanks for the feedback. ;)