Avast deleted half my main projects

[czardas]

I'm using free Avast. I did not upgrade for a day or two because I planned to backup all my projects for the last 10 years. When I tried to transfer my files onto a memory stick, most of the compiled PE Apps I created using AutoIt were deleted. I have not yet assessed the damage done, but I am hoping someone will be able to tell me how to recover these files. I was given an option to add the files to an exclusion list during the transfer, but this had no effect on the aggressive action taken by Avast. I beg the developers, please can you not do something about the default avast behaviour and make it easier to control the program's actions. Until I manage to assess the damage, I can't begin to think of upgrading. I may have to disable avast altogether.

[Secondmineboy]

Normally the files should not been deleted, they should be in quarantine.

Under Maintenance on the top, then choose Virus Chest.
If you havent changed the Avast settings.

[Pondus]

I planned to backup all my projects for the last 10 years.

10 years are bit long to wait before backup ... or?

malware experts are notified...

When I tried to transfer my files onto a memory stick, most of the compiled PE Apps I created using AutoIt were deleted.

did avast give a malware name to the detected files.... if so what?

[argus]

Hi,



> Check USB storage devices / removable drives


Download MCShield from one of the following links:

MyCity -  Official download link
Softpedija - Mirror download link

• Double click MCShield-Setup to install the application.
  
• Wait a few seconds to MCShield finish initial scan.

Recommendation to under General and Scanner tab you click on Defaults button to choose recommended options.

• Connect your USB storage devices to the computer one at a time. Scanning will be done automatically.

When all scanning is done, you need to attach a logreport that MCShield has created.

Start -> All Programs -> MCShield -> Logs

Attach here -> AllScans.txt

Explanation: USB storage devices are all the USB devices that get their own partition letter at connecting to the PC,
e.g. flash drives (thumb/pen drives, USB sticks), external HDDs, MP3/MP4 players, digital cameras,
memory cards (SD cards, Sony Memory Stick, MultiMedia Cards etc.), some mobile phones, some GPS navigation devices etc.

[czardas]

Okay that's helped a bit. Avast still deletes the restored exes after I try and run them. I appreciate the help. I don't know what the nest step is to get Avast to allow the files to run.

[Secondmineboy]

Disable Avast while the files are being restored.

After that set the files to exclusions.
Home Screen>Settings>Global Exclusions

[czardas]

I planned to backup all my projects for the last 10 years.

10 years are bit long to wait before backup ... or?

malware experts are notified...

When I tried to transfer my files onto a memory stick, most of the compiled PE Apps I created using AutoIt were deleted.

did avast give a malware name to the detected files.... if so what?

I have some older backups. I don't know what is in the folders. Win32-Evo-gen [susp]

[Pondus]

did you follow argus advice above?

[czardas]

did you follow argus advice above?

If you can explain to me why I would use 3rd party software to control my AV then I'm all ears. The idea that such a thing is possible casts extreme doubts on the reliability of the AV in question. I'm generally quite a trusting person (perhaps to my own peril), so naturally I did not try to override Avast using 3PS. If I were to attempt such a thing, it woulld be a very last resort and, I would feel uncomfortable with such experiments.

I am not into looking for exploits in AV software. I have better things to spend my time on.

Perhaps I'm wrong to take issue with this, but as I said I would only use 3rd party software as a last resort. It would of course be the ultimate in bad publicity for Avast. I think Avast is better than that. It just seems to have lost much of it's user interactivity over time.

[argus]

Perhaps I'm wrong

Yes, you 're wrong.

None antivirus will not solve such problems with worms, any AV.
MCShield uses an entirely different method than any AV software, that is why is benefits. MCS only targets worms on USB flash drive, mobile phone or any other memory card.
If you think there is ideal AV , you are very wrong.

The choice is yours, greeting.

[czardas]

It's the first time I've been tipsy for a while (last night when I made the above post). I don't understand what I need another program for to scan legitimate files. Why am I wrong?

What is wrong is the fact that Avast moves stuff to its virus chest without first asking. What's wrong is I have to come to a forum to get help to recover my work. What's wrong is that Avast is behaving like a virus.

I've had some problems with Avast, but it's been a good AV over the years. Why I can't just give it the hash of my PE apps that I want it to ignore I don't know. As soon as I move a file it get's flagged again. That doesn't make sense to me.

[argus]

I do not know that the infection comes.

[czardas]

I do not know that the infection comes.

It's okay. I do appreciate the help. This is a false positive problem, and a user interaction issue. It's actually quite a major problem which really needs to be addressed. I have been totally prevented from downloading files on some occasions. Now that's a problem. What if I needed those files for something important?

At the moment I do not feel confident enough to download the latest release of Avast. I would like some feedback from the dev team. I would like to know answers to the questions I asked about not being able to move my files around without first having to disable Avast. Why does a new installation not remember my preferences? Most importantly why using a hash like SHA-1 can't be employed so as not to forget which files have been added to exclusions?

I want to distribute some of my programs, but things like this prevent me from doing so. I do not want to start suggesting people disable their AV in order to run my programs, which are all portable applications BTW.

I don't think I'm being unreasonable.

[czardas]

Steven Winderlich, thank you for your help. This morning I have followed your instructions for one or two files and it worked. It's going to take me a while to fix this problem.

I would like to say that the method isn't exactly intuitive and most people would not be able to figure this out by themselves (I certainly couldn't). When browsing for files to exclude I only saw folders in the treeview. I had to type the full path into the input. I fear this work will need to be done again every time I update Avast, and every time I transfer my files. There must be a better solution than this.

When I got the message saying the files had been removed, the exclude option did not seem to register my mouse clicks. win xp sp3

Actually this only partly solves my problem. I need to disable avast to be able to move my files.

[Pondus]

if and when you have the time, take a look at this topic ...  http://forum.avast.com/index.php?topic=104046.0
especially the posts by dr_bora the creator of MCShield. he explains all the how/why