Avast 2015 maybe preventing system update - Win 8.1

[REDACTED]

Hi,

Every so often I get the following message in Avast Free AV 2015:

File Reputation Warning: The file you are downloading is very new or very rare........

I have attached the details in an image.  It seems like it could be the W8.1 automatic updates???  Bit of a worry if it is but I wanted to check first.

Thanks
Paul

[REDACTED]

Does no-one else get this then??

I guess I could add a web exclusion for https://*windowsupdate.com* however, if anyone was minded they could setup a website called someting like https://imgivingyouavirus.windowsupdate.com and that would not then be scanned.

No point specifying this one individual update server as I suspect that Microsoft have hundreds all prefixed with different addresses.


Cheers,
Paul

[RejZoR]

That's because you have a file reputation setting enabled which is disabled by default. I don't think there is any easy way around it and is only partially related to HTTPS scanning feature (because without it, it wouldn't even be scanning this stream).

[REDACTED]

Hi,

Thanks for that.  Being that the Windows update is such an integral part of the operating system I feel that this needs to be incorporated into the File Reputation logic somehow.  If Reputation is there as an option then barfing at the operating system standard functions makes it pretty useless really.  Why bother having it at all if it's next to useless.

Just a personal opinion of course.

Cheers,
Paul

[bob3160]

The extra protection is nice but it's too easy for the average user to block a critical program.
Windows Updates aren't items that you AV should be questioning when received from the
correct source.
Maybe the source is what should be authenticated, not the files in the case of Windows updates.

[RejZoR]

Hi,

Thanks for that.  Being that the Windows update is such an integral part of the operating system I feel that this needs to be incorporated into the File Reputation logic somehow.  If Reputation is there as an option then barfing at the operating system standard functions makes it pretty useless really.  Why bother having it at all if it's next to useless.

Just a personal opinion of course.

Cheers,
Paul

Since those files apparently aren't signed by Microsoft, that's the main problem. Otherwise avast! bases its findings only on the file age in the cloud and since it's new, you'll get the warning. If the files were signed by Microsoft signature and were new, avast! wouldn't alert you about them.

[REDACTED]

Understood.  It doesn't fix the problem that a feature of Avast is breaking the standard windows updates and it should not do this.  If the files aren't signed then Avast should be able to understand what is a legitimate windows update and what is not.

[REDACTED]

I have logged this with Avast support to see if they can resolve or advise.