Author Topic: how to pre-populate the Avast exclusions list and how to push it to pcs  (Read 4002 times)

0 Members and 1 Guest are viewing this topic.

rkode

  • Guest
Avast:      8.0.1497.0
Virus definition:   130918-5

We would like to pre-populate an Avast exclusions list with object we know are good and don;t want Avast to identify as false positives.
And once populated, how to we get this list installed on our pcs ?
As in what is the file called and where do we copy it on the target pc ?

Thanks in advance for considering this.

Offline Para-Noid

  • Avast Evangelist
  • Starting Graphoman
  • ***
  • Posts: 6700
  • Trust only what you test yourself!
Re: how to pre-populate the Avast exclusions list and how to push it to pcs
« Reply #1 on: September 20, 2013, 08:19:41 PM »
What do you mean by an "exclusion list"?

If you mean infected URL's there isn't one. It would be difficult to make one as new infections are hitting any number of websites almost, if not by the minute. If you mean files, a lot of that is cloud based. avast has streaming updates to keep the user safe with the most up-to-date protection.  :)
Dell Inspiron, Win10x64--HP Envy Win10x64--Both systems Avast Free v17.9.2322, Comodo Firewall v8.2 w/D+, MalwareBytes v3.0, OpenDNS, Super Anti-Spyware, Spyware Blaster, MCShield, Unchecky, Vivaldi Browser and, various browser security tools.

"Look before you leap!" Use online scanners before you click on any link.

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 89116
  • No support PMs thanks
Re: how to pre-populate the Avast exclusions list and how to push it to pcs
« Reply #2 on: September 20, 2013, 09:52:26 PM »
You don't say what it is that you want to exclude or why ?

If these are files (?) that you consider avast is incorrectly alerting on, the best policy is to submit them to the virus labs for analysis and correction of the signatures. That way you don't require an exclusion for it and it could help other avast users.

Excluded files or URLs as such can't be imported, only entered manually, however like most things in life there are workarounds, but they aren't simple either.

They are mostly preserved in the various .ini files of avast. Having identified what it is you want to exclude, you could add one manually in the various shields or settings, check the .ini files and see where the data is stored and in what format. Then it would be possible to manually edit the .ini file inserting the exclusion/s.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.3.6108 (build 24.3.8975.762) UI 1.0.801/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

rkode

  • Guest
Re: how to pre-populate the Avast exclusions list and how to push it to pcs
« Reply #3 on: September 20, 2013, 10:40:54 PM »
Thanks so much for the reply.

Good questions.

I'll do my best to respond.
There are a number of .dlls in our application base that, the avast application id's as possibly infected, when the .dlls are loaded into memory.
We know that the .dlls are NOT infected.

In reading other postings on the forum, an exception list has been mentioned.
Apparently, with some versions of Avast (I don't know which ones.  The posts that I read didn't mention the version.  Or I missed it.), when a dialog is displayed referencing a possibly infected object, one can right click on it and the posting says it will be added to an exception list.
So that Avast no longer will consider that object a threat.

What we would like to do is set up and configure the Avast application on a pc here in our lab.
Update this exception list (if it exists) with the names of the .dll's that we want Avast to ignore.

Then, when Avast is installed on our users pc, we will add the exception list from our LAB pc, to the user pc.

We don't necessaraily want our users to be able to choose an "ignore" option. (So if it really does exist, we will need to figure out a way to disable it.)
But, we DO want the ability to decide which objects on the target pcs, we want Avast to ignore.
And it sure sounds like the "exception list" mentioned in other posts (if I understood them correctly), fills the bill.

So, I was hoping that someone more experienced with the Avast product than I have, might know a bit about this exception list and be able to explain how to populate it and then propagate it to other pcs.

Thanks once again for the reply.
I DO appreciate any help\advice I can get.



Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 89116
  • No support PMs thanks
Re: how to pre-populate the Avast exclusions list and how to push it to pcs
« Reply #4 on: September 20, 2013, 11:15:20 PM »
If you can attach a screenshot of any alerts (just some common examples not all of them) you are getting as that give us an idea which shield is doing the action and any related exclusion.
EDIT: are these dlls detected if you scan them outside of memory ?

Are your dlls digitally signed as that generally goes a long way as far as alerts go, if they aren't commonly used files (FileRep not high), etc.

It is possible to exclude some memory alerts, but this is commonly related to on-demand scans (on other security based applications loading signatures into memory) and not actually when it is loaded into memory.
« Last Edit: September 20, 2013, 11:17:00 PM by DavidR »
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.3.6108 (build 24.3.8975.762) UI 1.0.801/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Offline Para-Noid

  • Avast Evangelist
  • Starting Graphoman
  • ***
  • Posts: 6700
  • Trust only what you test yourself!
Re: how to pre-populate the Avast exclusions list and how to push it to pcs
« Reply #5 on: September 20, 2013, 11:34:57 PM »
The easiest way would be to exclude via the "global exclusions".
There is "no" universal exclusion list. As David mentioned making
exclusions would be the best route, or sending the files to the virus lab.

If you are worried that if someone uses your software and the result could be a false positive,
the best suggestion is to submit the files to the avast virus lab.

This might help https://support.avast.com/Tickets/Submit/RenderForm

« Last Edit: September 20, 2013, 11:37:31 PM by Para-Noid »
Dell Inspiron, Win10x64--HP Envy Win10x64--Both systems Avast Free v17.9.2322, Comodo Firewall v8.2 w/D+, MalwareBytes v3.0, OpenDNS, Super Anti-Spyware, Spyware Blaster, MCShield, Unchecky, Vivaldi Browser and, various browser security tools.

"Look before you leap!" Use online scanners before you click on any link.

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 89116
  • No support PMs thanks
Re: how to pre-populate the Avast exclusions list and how to push it to pcs
« Reply #6 on: September 21, 2013, 02:17:17 AM »
Sorry but until we determine what is to be excluded and why, there is no easiest way.

If you read the full topic #Reply 3 talks about dlls loaded into memory and I don't think global exclusions would cover that (if they are loaded by a different process).
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.3.6108 (build 24.3.8975.762) UI 1.0.801/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Offline Para-Noid

  • Avast Evangelist
  • Starting Graphoman
  • ***
  • Posts: 6700
  • Trust only what you test yourself!
Re: how to pre-populate the Avast exclusions list and how to push it to pcs
« Reply #7 on: September 21, 2013, 10:16:09 PM »
Sorry but until we determine what is to be excluded and why, there is no easiest way.

If you read the full topic #Reply 3 talks about dlls loaded into memory and I don't think global exclusions would cover that (if they are loaded by a different process).
That's the reason I gave a link to submit the file(s) to avast.
Dell Inspiron, Win10x64--HP Envy Win10x64--Both systems Avast Free v17.9.2322, Comodo Firewall v8.2 w/D+, MalwareBytes v3.0, OpenDNS, Super Anti-Spyware, Spyware Blaster, MCShield, Unchecky, Vivaldi Browser and, various browser security tools.

"Look before you leap!" Use online scanners before you click on any link.