Avast WEBforum
Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: Rundvleeskroket on May 08, 2022, 01:00:43 AM
-
Hi. Avast Free ignores my exceptions. How do I fix this?
I run NiceHash on my PC. It uses a tool called NBMiner. I've been using this for over a year without much problems after initially setting an exception for the NiceHash folder. But now that exception seems to get ignored.
Every time I start the miner, Avast automatically quarantines the executable, despite having explicitly added exceptions for both the whole program folder and the specific executable. That last exception I added directly from the quarantine chest (restore and add exception). I got the 'happy to be back' notification. Yet, the very next time I tried running it, I got the same warning and the executable was again removed!
How do I stop this from happening? I already sent the executable for false positive analysis. But meanwhile I can't mine.
-
This is the warning I get and these are the exceptions I have set:
-
I just updated to the latest version of Nicehash, and the latest version of NBminer, and the behaviour remains.
Of note: I manually update the Avast program (virus updates are on auto). Hadn't done it in a couple of months (I know, I have reasons). Just did an update, and after that this problem started. So it is some change in the way Avast handles these files in the last several months that seems to be the cause.
I've sent both the old and the new version of NBminer for analysis. But the fact remains that even with explicit exceptions set to leave it be, Avast keeps quarantining the executable.
-
What the...
I disabled file shield. Even then the executable gets quarantined. Not only that, but now all my set exceptions are gone too!
What is going on?? Avast shouldn't unilaterally remove exceptions!
Also: how does a disabled file shield still quarantine and block files?
Edit: OK. So I re-added the exceptions. Enabled file shield. Started the miner. Got the warning. Miner was again quarantined. And AGAIN all my exceptions were removed!
This is maddening.
Edit 2: I enabled file shield. Disabled Anti-Exploit Shield. Just to test. Set it to never run until I told it to. Rebooted my PC. Anti-Exploit was again enabled. So that too doesn't listen.
But now with file shield and anti-exploit enabled, and for the 3rd time added all exceptions, I can run the miner. I don't dare touch anything and hope it'll still be running in the morning.
Another thing of note: after updating Avast and a reboot, and dealing with all these problems above, after an hour or so into this troubleshooting I got an Avast upsell screen telling me about the new features. Could it be that only after this screen the update is complete and only after a further reboot is actually working properly? Because that's insane. The screen usually comes within minutes after an update and reboot. Not over an hour later. That seems deliberate. And no mention of another reboot required. I just did it to see if it would help.
-
A couple hours after my last post, during the night, Avast once again quarantined the miner and my PC sat idle all night because of it.
I'm so sick of this. Why won't Avast respect my settings?
Edit: I've repaired the app and rebooted afterwards. Currently running the miner. I really hope Avast will not interfere today.
-
Even after an Avast repair and reboot, the miner was quarantined. Despite my explicit exceptions. Help.
-
Even after an Avast repair and reboot, the miner was quarantined. Despite my explicit exceptions. Help.
Hi, repost the screenshot from Reply #1 with Details enabled.
-
It says it's the anti-exploit shield.
But, even with anti-exploit disabled last night, the executable got quarantined. And even with the file shield completely disabled it keeps happening. Maybe this is part of the web shield? The config menu for Anti-exploit seems to suggest it's more general for all shields, as it sits above the different shield settings menu's.
-
I again disabled the Anti-Exploit Shield. And then all my exceptions were gone again. Restoring settings didn't bring them back. Had to manually add them again.
This is so frustrating.
-
Hi again, you can set tool scanning to "Ask" or even disable it in the shield settings.
-
I don't even have that section enabeled. I don't want Avast to scan for PuP's or do anything with them.
-
I don't even have that section enabeled. I don't want Avast to scan for PuP's or do anything with them.
Strange, wait for one of the devs...
-
It just removed the miner again. Warning screen said in details it was the anti-exploit shield that did it. Anti-exploit schield is unchecked in settings!
-
It just removed the miner again. Warning screen said in details it was the anti-exploit shield that did it. Anti-exploit schield is unchecked in settings!
You can submit a bug report in "About Avast". (Add a link to this thread)
-
I'll do that later. Have to run.
I just unquarantined the executable and added an exception from the chest. Disabled the whole Anti-Rootkit Shield that sits above the Anti-Exploit Shield.
Does the anti-rootkit shield ignore exceptions?
-
Just a general advice: https://blog.avast.com/exceptions-risks (Video from Bob: https://youtu.be/Dt_ZEBguelE)
-
I've been away all day. PC was on at home, mining.
I have now stopped and started the miner several times without issues.
What seems to be the problem:
1: The warning says it is the anti-exploit shield that has intervened. Whereas in reality it seems to be the anti-rootkit shield.
2: The anti-rootkit shield ignores all exceptions. Those only apply to the file shield.
3: Disabling the anti-exploit shield and/or the anti-rootkit shield, deletes all set exceptions! Even though they seemingly do not even apply to those shields.
Apparently there is no way to run a miner without disabling the anti-rootkit shield. This was not necessary with the version of Avast I was previously running, from a few months ago. And all versions in at least a year before that. But now it is.
Edit: I just submitted a bug report. I'm aware of the dangers of exceptions, but I've been running this software for over a year and so have millions of other people. Any problems would be big news fast. Just because miners are sometimes installed without consent does not mean miners are always unwanted, and there is no good way to allow for running mining software without disabling whole parts of Avast. And if Avast then doesn't even respect the exceptions set, things get very frustrating.
-
Since I disabled the anti-rootkit shield, Avast hasn't quarantined the miner again. So I think it's safe to say that is the cause.
A miner isn't a rootkit however. And the warning saying it's the anti-exploit shield that intervened is also incorrect communication, as stopping the anti-exploit shield does not stop the quarantining.
Lastly it is weird that Avast has an option to set exceptions, and still the anti-rootkit shield stops software explicitly excepted from monitoring.
These issues should be fixed.
-
Since I disabled the anti-rootkit shield, Avast hasn't quarantined the miner again. So I think it's safe to say that is the cause.
A miner isn't a rootkit however. And the warning saying it's the anti-exploit shield that intervened is also incorrect communication, as stopping the anti-exploit shield does not stop the quarantining.
Lastly it is weird that Avast has an option to set exceptions, and still the anti-rootkit shield stops software explicitly excepted from monitoring.
These issues should be fixed.
Hi,
Please provide a support file ID, https://support.avast.com/article/Submit-support-file
-
Hi. I can't.
It seems I need to submit logs via the support tool, to the support portal, to get an ID.
The support portal however seems to be for paid users only. I use Avast Free.
The support portal refers me back to this forum.
-
1. Download and run the support tool.
2. Post your File-ID here afterwards.
-
Avast turned the anti-rootkit shield back on on its own. I had it disabled and 'turned off until I turn it on again', but it still re-enabled it without my consent. And the very next time I started the miner, it quarantined the executable.
What's the point of settings if Avast just does whatever it pleases anyway?
-
1. Download and run the support tool. (https://s-install.avcdn.net/support-tool/avast/avastsupport.exe)
2. Post your File-ID here afterwards, so the devs can find/check it.
-
same problem ... but with nbminer 41.5
-
Hi,
it seems that this is also the case for "T-rex mining"
https://forum.avast.com/index.php?topic=319570.0
-
Well, it might help to provide the requested (Reply #18) logs... ;)
-
Do you need someone to upload the support file? Where should I upload or send it to? I'm having this same issue with t-rex where it ignores all my exceptions now. I'm getting sick of fighting with this and am ready to go with a different antivirus if this can't be fixed. If you just need the name of the file, here it is.
20220522_0243_WEP8P_1357545531
-
I disabled the anti-rootkit shield and that fixed mine for now as well. They really hide it though, rather than listing it with the other shields.
-
If you just need the name of the file, here it is.
20220522_0243_WEP8P_1357545531
Yep, should help - your File-ID is: WEP8P
-
I disabled the anti-rootkit shield and that fixed mine for now as well. They really hide it though, rather than listing it with the other shields.
Make sure you check regularly if it is still disabled. Mine keeps re-enabling itself. And it also keeps deleting my exceptions. Last time was a couple of days ago.
I haven't done the support tool thing, because I don't know what data that collects and sends. I'm apprehensive. So thank you for sending a report. I hope it helps all of us.
-
Hi,
Thank you for the support files. The fix will be available in the next VPS.
-
ok it work fine now :D
thx
-
ok it work fine now :D
thx
Thanks for the feedback.
-
*kick*
Avast updated, and after the update rootkit shield and anti-exploit shield were enabled again. The next time I started the miner, it got removed and quarantined.
Why is it so goddamn difficult for Avast to respect my chosen settings? And keep them over an update?
This behaviour is unacceptable.
-
Hi! I'm getting the same problem here. Avast keeps ignoring and deleting my exception list. Is there a solution?
There is a game I'm trying to run, but Avast doesn't let me.
-
I've found out something else that's related:
I have 3 shields active. File. Web. Mail.
If I then look in the system tray at shields control, it tells me 2 shields are disabled.
When I temporarily disable all shields, and then re-enable all shields, it says 5 shields will be re-enabled.
The two shields are anti-rootkit and anti-exploit. I can also enable those two from shields control when the other 3 are already active.
This means I can't disable shields and then only re-enable those shields that were active before. All shields get activated, even those that I explicitly disabled.
This makes this function useless.
-
Hi! I'm getting the same problem here. Avast keeps ignoring and deleting my exception list. Is there a solution?
There is a game I'm trying to run, but Avast doesn't let me.
Hi,
Can you provide a screenshot of the Avast detection message and support file ID, please?
https://support.avast.com/article/Submit-support-file
-
*kick*
Avast updated, and after the update rootkit shield and anti-exploit shield were enabled again. The next time I started the miner, it got removed and quarantined.
Why is it so goddamn difficult for Avast to respect my chosen settings? And keep them over an update?
This behaviour is unacceptable.
Hi,
Can you provide the file name of the miner and a support file ID, please?
https://support.avast.com/article/Submit-support-file
-
The name of the miner is LolMiner.exe, which is bundled with the NiceHash miner program.
Both are the latest version. Version number for the LolMiner executable is 19.0 1.51a
The problem isn't the miner. The problem is that Avast seems to re-enable certain shields that were set to 'stay off until I enable them again'.
Also of course on a more fundamental level the problem is that Avast treats miners as rootkits and/or exploits. With no way to tell Avast that yes indeed this PC isn't infected, but I chose to have that software installed.
I have added an exception, but I keep anti-rootkit and anti-exploit shields disabled because Avast (at least used to) quarantine the executable even if exceptions were set. Anti-rootkit shield ignores exceptions. And it shouldn't!
-
Hi! I'm getting the same problem here. Avast keeps ignoring and deleting my exception list. Is there a solution?
There is a game I'm trying to run, but Avast doesn't let me.
Hi,
Can you provide a screenshot of the Avast detection message and support file ID, please?
https://support.avast.com/article/Submit-support-file
Hi,
Sure.
-
Hi! I'm getting the same problem here. Avast keeps ignoring and deleting my exception list. Is there a solution?
There is a game I'm trying to run, but Avast doesn't let me.
Hi,
Can you provide a screenshot of the Avast detection message and support file ID, please?
https://support.avast.com/article/Submit-support-file
Hi,
Sure.
Hi,
Thank you for the screenshots. This is a false positive. The detection will be disabled in the next virus definitions update. (https://support.avast.com/article/update-antivirus/)
-
The name of the miner is LolMiner.exe, which is bundled with the NiceHash miner program.
Both are the latest version. Version number for the LolMiner executable is 19.0 1.51a
The problem isn't the miner. The problem is that Avast seems to re-enable certain shields that were set to 'stay off until I enable them again'.
Also of course on a more fundamental level the problem is that Avast treats miners as rootkits and/or exploits. With no way to tell Avast that yes indeed this PC isn't infected, but I chose to have that software installed.
I have added an exception, but I keep anti-rootkit and anti-exploit shields disabled because Avast (at least used to) quarantine the executable even if exceptions were set. Anti-rootkit shield ignores exceptions. And it shouldn't!
Hi,
Please provide the support file ID so that we can look further into this issue. https://support.avast.com/article/Submit-support-file
-
Hi,
I'm not keen on doing that. I don't know what information is sent when I do.
I think a vicious circle is at play. Because Avast treats mining software as malware, it can only be installed by disabling shields. When re-enabling shields, all shields get activated, instead of just the ones that were previously active. This then includes anti-rootkit and anti-exploit shield. Which then delete mining software again. I set those shields to disabled, but then disable all via task bar options to reinstall the mining software, and when I then re-enable the shields there, it also re-enables anti-rootkit and anti-exploit.
Rinse and repeat.
I've set exceptions for folders and executables of mining software, but anti-rootkit and anti-exploit straight up ignore exceptions and quarantine files regardless. At least they did for a very long time. So now even if they don't, I don't trust they won't again in the future. Every Avast update is a gamble.
If Avast had an option to allow for mining software, and didn't ignore previous shield states when re-enabling, none of this would probably be an issue. These problems are a result of Avast not behaving logically or consistently.
-
@Rundvleeskroket,
The related detection was disabled. Can you update your virus definitions and see if this helps? https://support.avast.com/article/update-antivirus/
-
What do you mean exactly?
I'm running the latest version of the software and definitions. Should I re-enable those two shields and see if the exceptions are respected, or do you mean that the exceptions should no longer be needed at all for mining executables?
I don't trust that the behaviour will be consistent from update to update, so I've opted to keep anti-rootkit and anti-exploit disabled.
At this point I'm not 100% sure if an update re-enables the disabled shields, or it is the cycle of disable and enable (via task bar) needed to install new versions of miner software, doing that. The problem remains the same: I can't even download the installer without it getting blocked/quarantined. So I have to disable shields for a moment. Same for installation. When I the go to re-enable it also enables those two shields because there is no option to just re-enable the shields I already had running.
I get that mining software can be problematic and Avast has to be cautious. But users who want to mine should be able to tell Avast to not freak out when downloading an installer or trying to install and run said software. So that we can use mining software without having to disable anything, even for a few minutes.
Avast removing exceptions though is just not right.
-
What do you mean exactly?
I'm running the latest version of the software and definitions. Should I re-enable those two shields and see if the exceptions are respected, or do you mean that the exceptions should no longer be needed at all for mining executables?
I don't trust that the behaviour will be consistent from update to update, so I've opted to keep anti-rootkit and anti-exploit disabled.
At this point I'm not 100% sure if an update re-enables the disabled shields, or it is the cycle of disable and enable (via task bar) needed to install new versions of miner software, doing that. The problem remains the same: I can't even download the installer without it getting blocked/quarantined. So I have to disable shields for a moment. Same for installation. When I the go to re-enable it also enables those two shields because there is no option to just re-enable the shields I already had running.
I get that mining software can be problematic and Avast has to be cautious. But users who want to mine should be able to tell Avast to not freak out when downloading an installer or trying to install and run said software. So that we can use mining software without having to disable anything, even for a few minutes.
Avast removing exceptions though is just not right.
If your virus definitions are up to date and you enabled anti-rootkit and anti-exploit, LolMiner.exe should no longer be detected.
To investigate the issue with exceptions, we would need at least this file: arpot.log
C:\ProgramData\Avast Software\Avast\log\arpot.log
-
Lolminer should no longer be detected by those shields with or without exceptions in place?
What about NBminer.exe? That's the other executable that kept getting deleted.
If it was false positives, then what is to stop Avast from quarantining the next version of the executables?
I've looked at arpot.log and it is mostly fine, but it does contain identifiers I would rather not share, such as mining-addresses. Is the log still of use to you if I were to substitute those? And where would I then send it?
Thanks.
-
Lolminer should no longer be detected by those shields with or without exceptions in place?
What about NBminer.exe? That's the other executable that kept getting deleted.
If it was false positives, then what is to stop Avast from quarantining the next version of the executables?
I've looked at arpot.log and it is mostly fine, but it does contain identifiers I would rather not share, such as mining-addresses. Is the log still of use to you if I were to substitute those? And where would I then send it?
Thanks.
Both miners, irrespective of exceptions.
Please upload the log to the Avast FTP server: https://support.avast.com/article/FTP-file-upload
-
Hi.
I've removed all my exceptions for miners, and reactivated rootkit shield and anti-exploit shield.
When I tried to start NiceHash the main Nicehashminer.exe got blocked!
Then I added an exception with a wildcard to exclude everything in the Nicehash folder, which includes the subfolders with the miners.
Sadly, lolminer.exe, despite having an exception for all the subfolders containing the mining executables, also still gets blocked and quarantined!
Anti-rootkit / Anti-exploit still straight up ignore exceptions. Only with those shields de-activated can I run the software.
To add to that: I have set all shields to ASK before deleting or quarantining. That too gets ignored. Avast quarantines regardless!
So, to recap; anti-exploit and anti-rootkit shield both still detect lolminer.exe, and even with exceptions quarantine it, ignoring both exceptions and my preferences to ask what to do when finding 'malware'.
That means we're back to where we started; Avast says one thing, but does another :/
-
@Rundvleeskroket,
Please provide the log.
-
I've uploaded a zip of arpot.log to ftp.avast.com/incoming
-
I've uploaded a zip of arpot.log to ftp.avast.com/incoming
Hi,
Some improvements have been made for exclusions. Please update your virus definitions (update VPS #221007) and see if there is still an issue with exclusions for you.
-
I updated definitions to VPS 221007-8
After enabling anti-exploit and anti-rootkit shield and running Nicehash, lolminer.exe was immediately quarantined. Details state it was anti-exploit shield that did it. Exact same popup as posted above.
This is still with exclusions in place, and all shields set to ASK. Both get ignored!
The main Nicehashminer.exe and nbminer.exe were allowed to run, but I dare not try without exclusions set. Those exclusions that supposedly shouldn't even be necessary.
-
I updated definitions to VPS 221007-8
After enabling anti-exploit and anti-rootkit shield and running Nicehash, lolminer.exe was immediately quarantined. Details state it was anti-exploit shield that did it. Exact same popup as posted above.
This is still with exclusions in place, and all shields set to ASK. Both get ignored!
The main Nicehashminer.exe and nbminer.exe were allowed to run, but I dare not try without exclusions set. Those exclusions that supposedly shouldn't even be necessary.
Hi,
Another update for exclusions was released yesterday. Please update your virus definitions.
-
Hi.
VPS 221012-6
I enabled anti-rootkit shield and anti-exploit shield, and ran Nicehash. Now both nbminer and lolminer can run.
I then deleted the exception for C:\Users\Username\AppData\Local\Programs\NiceHash Miner\* and Avast blocked and threw an alert for every single executable and DLL in the folder. Literally dozens of popups!
At least it asked, so that's progress. But the exception for the folder and subfolders is still very much required.
So; I'll have to keep the exception in place despite being told here it wouldn't be necessary. It absolutely is!
I'll keep anti-rootkit shield and anti-exploit shield enabled for now and see what happens.