Exclusion List Help Needed

[spidyr2k]

I have an app named MediaJoin that keeps getting pegged as having the Win32:VB-CC[wrm].  I scanned the install zip file and the extracted folder at Jotti and nothing found.  I have added the zip file, program file, and shortcuts to the exclusion list, but any activity with MediaJoin creates a detect.  Would appreciate help to get avast to ignore activity with this app...I really like using it and had no problems until I installed avast.

[mauserme]

This is just a guess but maybe Win32:VB-CC[wrm] is not in the files you are scanning/excluding.  It might have downloaded to a different location.

Have you tried scanning your entire hard drive?

[DavidR]

- What avast! version and VPS file (virus database) number, e.g. 0436-4 (see about avast!)
- What was the virus name, what was the filename, where was it found
  example (C:\windows\system32\infected-filename.xxx)?

From the information above, e.g. the file name detected you should be able to have a detailed exclusion, you also need the exclusion added to the resident scanner Standard Shield, Customize, Advanced and not just the Program Settings, Exclusions.

If you are getting a virus warning that you believe is a false positive, then if you can zip and password protect ('virus', will do) the suspect file and send it to virus @ avast.com (no spaces), or send from the chest.

Give a brief outline of the problem (possibly a link to this thread), the fact that you believe it to be a either a new, undetected virus or false positive and include the password in the body of the email. Some info on the avast version and VPS number (see about avast {right click avast icon}) will also help.

If it is indeed a false positive, add it to the exclusions lists (Standard Shield, Customize, Advanced and Program Settings, Exclusions) and check scan it periodically using the ashQuick scan (right click scan), when it is no longer detected then remove it from the exclusions.
Also see (Mini Sticky) False Positives

[spidyr2k]

avast version 4.6 home edition
vps file version 0606-4

MediaJoin.exe......C\Program Files\Camtech\MediaJoin............Win32:VB-CC
~GLH0008.TMP....C\Program Files\Camtech\MediaJoin.............Win32:VB-CC

Sent a zipped file containing the suspect application to virus@avast.com with details and comments as suggested.

Plan to do a full scan tonight...see if the bug was dropped somewhere else.

Thanx, buds

[DavidR]

Is it not possible to expand the column (drag the column heading separator to the right, see example image) so you can see all the text in the path, so you can see the file name and use that in the exclusion.

Have you checked the windows Event Viewer, Anti Virus section, it too should record some details.

[spidyr2k]

here's the event viewer info:

Event Type:   Warning
Event Source:   avast!
Event Category:   Client
Event ID:   90
Date:      2/10/2006
Time:      8:04:36 PM
User:      N/A
Computer:   MY_DELL
Description:
Sign of "Win32:VB-CC [Wrm]" has been found in "C:\Program Files\Camtech\MediaJoin\~GLH0008.TMP" file. 

And......
Event Type:   Warning
Event Source:   avast!
Event Category:   Client
Event ID:   90
Date:      2/11/2006
Time:      7:45:41 AM
User:      N/A
Computer:   MY_DELL
Description:
Sign of "Win32:VB-CC [Wrm]" has been found in "C:\PROGRA~1\Camtech\MEDIAJ~1\MediaJoin.exe" file. 

[DavidR]

That is strange as it is even picking up the temp files also.

if you have these as your exclusions:
C:\Program Files\Camtech\*\mediajoin.exe
C:\Program Files\Camtech\*\*.tmp

That should cover the program and any tmp files whilst your working (try and see you may need to modifyl the path slightly), but you may also need to think of an exclusion if it also alerts on saved files.