Dear Forum,
As a User of programs virtualized with Spoon Studio, I run into frequent problems with false positives from Avast. As a search for "Spoon" here quickly revealed, this is a frequent problem and many users all over the world experience it, and, alas, it has no real solution yet. One russian guy seems to have given up on Avast, if google translate did not misguide me.
Here are my observations:
- Spoon launches "Stubs" in a stubs directory. In theory, this directory could be whitelisted, but Avast, in contrast to other AV SW like 360° et al fails to understand the program is launched from the stubs directory and not c:\Program Files, which would mean I have to whitelist c:\Program Files, which seems a bad idea, not?
- Further, this requires End User Interaction. I can do this, but the many people simply using these programs can not. I cannot Teamview them all, can I?
- Of course, I reported the offending stub programs as false positives without effect in months
- When I upload one of these stubs to virustotal, I get false positives from a few obscure, irrelevant AV SW, but not from Avast. I suspect Virustotal is only analyzing the file data, not its behaviour at run time, as a full avast installation does. For some AV SW, I can suppress false positives by disabling monitoring runtime behaviour, leaving scanning for virus patterns on.
Any feedback helping me to resolve this problem welcome.
Thanks.
K.
