[Free] Allowing a virus when a popup appears? (Urgent)

[Fatih54102]

Anyway which antivirus program is most suitable for me

maybe you want one with no realtime protection? .... then you can do the work with no warning popups

no because i work with real viruses too. there should be realtime protection but also allowing option. Just like MSE.

[Aventador]

If you are working with real malware then use a VM offline. Better choice is use a dedicated offline machine. Its that easy. Nothing else needs to be addressed.

[Fatih54102]

If you are working with real malware then use a VM offline. Better choice is use a dedicated offline machine. Its that easy. Nothing else needs to be addressed.

i am using real viruses and my development stuff combined in one pc(VM Offline is a good alternative but it steals time too, as if I open virus I have to reset virtual disk of vm), also i get viruses from internet and so i am not sure whether it is real virus or not.

[ram1220]

 I thought Avast used to have an "ignore" option. Am I wrong? I wouldn't mind having an "ignore" option myself for the files Avast flags that I know are false positives. But then again I also know what I am doing.

[DavidR]

It has a No Action (not Ignore) option in the file system shield settings , but that won't allow it to be run, it leaves it in place and takes no other action. If you try to run it again it will still alert/block it from running.

It has a Do Nothing option in the on-demand scan settings, that to just leaves the file in place and if you try to run it the file system shield will jump on it again.

The only Ignore option is in the anti-rootkit scan when a suspect/hidden file is found. This is I believe more because there can be many legit instances of hidden drivers/system files, so rather than delete (the only other option). There are no user configurable settings for the auto anti-rootkit scan about 8 minutes after boot.

[Fatih54102]

Hello,
I am using MSE now, but it can not detect crypted viruses.
So I want to switch back to Avast. But is this option added with latest beta or something else?!

[Fatih54102]

It has a No Action (not Ignore) option in the file system shield settings , but that won't allow it to be run, it leaves it in place and takes no other action. If you try to run it again it will still alert/block it from running.

It has a Do Nothing option in the on-demand scan settings, that to just leaves the file in place and if you try to run it the file system shield will jump on it again.

The only Ignore option is in the anti-rootkit scan when a suspect/hidden file is found. This is I believe more because there can be many legit instances of hidden drivers/system files, so rather than delete (the only other option). There are no user configurable settings for the auto anti-rootkit scan about 8 minutes after boot.

Thing I want is adding the Ignore option (placed in anti-rootkit scan) into the classic real-time detection popup.
Please do this as MSE is awful. At least add an option and hide it (to not get attention of dumb users) so that I will be able to use this feature.
Consider this even Microsoft added this option to MSE years ago, and viruses could not exploit this feature. Do like that please.

[DavidR]

Ignore is an option in the anti-rootkit scan that runs 8 minutes after boot.

Outside of that scan it is a normal on-access scan (not a specific anti-rootkit scan) alerting on a signature associated with a rootkit, in these cases the normal file system shield settings apply.

In all honesty exclusion isn't the way to go if you consider something a false positive:
1. confirm by using a multi-engine scanner, such as virustotal.com and report your findings.
2. if avast is the only AV detecting this then, submit as a false positive for analysis and correction
3. once the signature is corrected (if confirmed an FP) there is no need for exclusion. That not only helps you but all other avast users if they have the same file.

[Fatih54102]

Ignore is an option in the anti-rootkit scan that runs 8 minutes after boot.

Outside of that scan it is a normal on-access scan (not a specific anti-rootkit scan) alerting on a signature associated with a rootkit, in these cases the normal file system shield settings apply.

In all honesty exclusion isn't the way to go if you consider something a false positive:
1. confirm by using a multi-engine scanner, such as virustotal.com and report your findings.
2. if avast is the only AV detecting this then, submit as a false positive for analysis and correction
3. once the signature is corrected (if confirmed an FP) there is no need for exclusion. That not only helps you but all other avast users if they have the same file.

Did the team add Ignore button (works like MSE's) ?

[davexnet]

I recommend the original poster of this topic goes to wilderssecurity.com, or similar,
and makes an open-ended question to the appropriate forum.

State the problem, but do not "load" the question with what you think the solution should be.

You might get some better answers this way.