Scan for viruses - List of exceptions doesnt keep Avast from false Alarms

[Rubik S. Cube]

By a manual scan do you mean, a right click scan from explorer (Explorer Scan) ?

No

If so, I don't know if that follows the avastUI > Settings > General > Exclusions (though this is a meant to be a Global Exclusion) as it is considered a Special Scan and it has its own Settings and Exclusions.

I use
avastUI > Menu > Scan > Scan for Viruses > (all previous options are localized, though) and select the exact same Scan, that is invoked by the schedule otherwise.

Sorry for late answer: was hospitalized and just missed your Q

[DavidR]

Since you used the AvastUI > Settings > General > Exclusions, that 'should' have applied to your on-demand scan.

If this still doesn't work ?
Can you copy the text that you entered into the exclusion.

I trust you are now on the mend.

[Rubik S. Cube]

If this still doesn't work ?
Can you copy the text that you entered into the exclusion.

Ah!
... much easier to look at the decompressed configuration files from *.avastconfig ... and they in fact look weird.

I did not try to resolve the problem just yet, but i can see outdated content in there, and contradictory settings. I would be confused :-)
Is there a proper description of the meaning of those files (avast.ini, exclusions.ini and more)?
They got messed up, probably way in the past, much earlier, than my first backup is.

Or is there a faster way to clean those up without the need to reinspect each and every dialog by hand?

[DavidR]

You could try Restoring Factory Defaults - AvastUI > Settings > Troubleshooting.

[Rubik S. Cube]

You could try Restoring Factory Defaults - AvastUI > Settings > Troubleshooting.

WOW, even after all those years, i missed this option! Thank you. Of course, i was intending to avoid that initially...
...but since the config was messed up big time after so many updates/years, i chose to revisit every dialog after cleaning up.

And so far, all seems well.
Thank you very much for this great reminder!!!

[DavidR]

You're welcome.

This feature wasn't introduced a long time ago, I think it was around early avast 2015 time frame.

[Rubik S. Cube]

<whispering:> Oh, my god. I posted too soon.
The config files look nice and clean, the scan took some time to finish... and then reported the excluded files again.
And i excluded the same files TWICE (once in general, then for the specific scan only).

So i am back to start again. :-(

[DavidR]

What is unique about the file or files that you are trying to exclude ?

How/when is it being run/detected ?
You never followed up on one of my questions/suggestions:
Can you copy the text that you entered into the exclusion.

[Rubik S. Cube]

What is unique about the file or files that you are trying to exclude ?

I renamed the files for the reason to not get confused by alarming messages.
Different reasons led me to do that.
examples include Adobe Flash installers (those include encrypted and compressed content), infected programs from known viruses (those are executed only with special care to not have them spread by accident), and many generic messages (PUP) from nirsoft programs, which i use only very rarely...

How/when is it being run/detected ?
This time, i ran it manually, since it would take a while for the scheduled time to arrive naturally

You never followed up on one of my questions/suggestions:
Can you copy the text that you entered into the exclusion.

from Exclusions.ini:
[Global]
ExcludeFiles=""ENCRYPTED *.*";"*.$x$";"INFECTED *.*";"VORSICHT *.*""
from Avast5.ini:
ScanExclusions=""*.$x$";"ENCRYPTED *.*";"INFECTED *.*";"VORSICHT *.*""

the next scheduled scan will be in 5 days and a can come back to report, what will happen.
I hope, my short answers demonstrate enough of cooperation and interest from my side. :-)

One idea pops up: sometimes i renamed the files in question, sometimes just a folder somewhere above in the filename/directory tree. Those do not seem to get respected any longer, although this approach kept the scans silent in earlier versions of Avast (sorry for not being more elaborate on this. i did not take note, when exaclty the messages appeared)

[DavidR]

Some Flash Installers come with

They don't appear to be in a format that would be recognised by the exclusions, what should be in there is the full path to the file name to be excluded and that isn't it.

I'm not talking of what is in the ini files but the actual text that you entered in the UI Exclusions.
See attached image1, these are some of my global exclusions, so you can see the format of the exclusion. In attachment image2 there is an extract of the exclusions.ini file ad you will see that reflects what is in my global exclusions.

This may be why the exclusion isn't working.

I don't know why you rename the files (unless you also change the file type) as that really shouldn't stop an alert as the scan is generally based on file type, but it can also tell what the file type is even if you have changed it along with the file name.

[Rubik S. Cube]

They don't appear to be in a format that would be recognised by the exclusions, what should be in there is the full path to the file name to be excluded and that isn't it.

I'm not talking of what is in the ini files but the actual text that you entered in the UI Exclusions.
See attached image1, these are some of my global exclusions, so you can see the format of the exclusion. In attachment image2 there is an extract of the exclusions.ini file ad you will see that reflects what is in my global exclusions.

This may be why the exclusion isn't working.

I don't know why you rename the files (unless you also change the file type) as that really shouldn't stop an alert as the scan is generally based on file type, but it can also tell what the file type is even if you have changed it along with the file name.

Oh my! A very lengthy and detailed reply just got lost on its way to the server without appearing. :-(

Since i don't have a copy here, i am not going to repeat it all. Only this:

I appreciate your willingness and devotion to help. And i understand, this is not going to fulfill my desire to help at improving the tool, as you cannot access their development environment (source control system, quality assurance process, aso). I was intending to help at making the tool more robust for everyone. But i do have much more serious concerns, that should not be addressed in this forum, especially not in front of an evangelist. :-)

Nonetheless, you did a good job and with my background of several years of technical support, i know how limited a single man's powers are to rectify problems caused by other people & structures.

Peace, buddy... :-)

[DavidR]

You're welcome.

1. Unfortunately it looks like you got bit by a forum bug that on occasions eats posts as they are sent - I use firefox add-on, Form History

2. There are less powers for that single man if they are just like you an avast user and not an employee of avast
Though we do try to push things forward.

[Rubik S. Cube]

You're welcome.

1. Unfortunately it looks like you got bit by a forum bug that on occasions eats posts as they are sent - I use firefox add-on, Form History

2. There are less powers for that single man if they are just like you an avast user and not an employee of avast
Though we do try to push things forward.

Thank you.
I will have a look into Form History (some day).
Once having been (at the time) the top technical guy in our country, working for a subsidiary of a U.S. computer business company, did NOT give me powers. But hey, you may be better at social bonding?

This is - more or less - my promised follow-up message:
Unfortunately, this time, the scheduled scan came up with plenty of messages (all kinds of), which was rather annoying, since all of them had already been checked and dismissed by myself and thus led to the aforementionned renaming. And with the message count being way above 100, this IS confusing and can easily have unwanted or new findings go unnoticed.

So i really am back to square one, Avast has been my choice for several years now, neglecting the problems i see in allowing access for such a tool into my computer. Unfortunately, some change during the last couple of months makes it simply unbearable, as it doesnt do, what i want anymore.

I will hold back the information about this decision of mine from my friends, who installed Avast following MY advice, as i still dont know of a viable alternative for myself.

BTW: The most ridiculous message from the last scan was: Some archive bomb has been reported, yet i did inspect and unpack the archive and all went well!

[DavidR]

As you probably know, a Decompression Bomb, is a file that is highly compressed, which could be very large when decompressed. This used to be a tactic long ago to swamp the system.

The name really is the most dangerous thing about this and I wish they would change it or simply not report it, a real PITA.

These highly compressed files are generally 'archive' files which are inert, don't present an immediate risk until they are unpacked. If you happen to select 'All packers' in your on-demand scans then you are more likely to come across this type of thing. Personally it is a waste of time scanning 'all packers' and that is why it isn't enabled by default.

For the most part archive files aren't scanned - but self extracting archives are - typically installation files are highly compressed and .exe file type so would be scanned.

The avast scan isn't actually saying it is an issue, I believe it is just reporting that file as it hasn't been scanned.