Author Topic: add *.VIR to exclusions?  (Read 7576 times)

0 Members and 1 Guest are viewing this topic.

darkfader

  • Guest
add *.VIR to exclusions?
« on: March 24, 2006, 01:03:16 AM »
I had set up this rule:
"repair if failed move" (with just the add .vir enabled)
But it kept adding .vir extension. Perhaps add .vir to exclusion list by default or add a hint in the settings dialog for the move action?

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67194
Re: add *.VIR to exclusions?
« Reply #1 on: March 24, 2006, 01:07:59 AM »
Perhaps add .vir to exclusion list by default
I won't like this...

or add a hint in the settings dialog for the move action?
I'd rather this.
Or if they add the 'moved' folder of avast installation to the exclusion list.

Anyway, better will be sending the file to Chest.
It won't harm your system, will be safe, and you won't be warned of further infection.
I think it's wiser than moving an infected file into your computer.
The best things in life are free.

Offline igor

  • Avast team
  • Serious Graphoman
  • *
  • Posts: 11849
    • AVAST Software
Re: add *.VIR to exclusions?
« Reply #2 on: March 24, 2006, 09:50:17 AM »
What exactly did you set and what exactly did you want to achieve? Can you rephrase, please?

darkfader

  • Guest
Re: add *.VIR to exclusions?
« Reply #3 on: March 25, 2006, 02:05:47 AM »
When the resident scanner finds a virus, it can be set to automatically add the ".vir" extension to the filename. When it scans it a second time, it adds it again...
For example. infected.exe becomes infected.exe.vir and then becomes infected.vir.vir and so on. This is a problem imho.
There are two solutions:
- add an exception for blocking *.vir files. (or instruct the user to add it manually)
- add a check if the filename already contains a .vir extension and omit adding it again.

Offline igor

  • Avast team
  • Serious Graphoman
  • *
  • Posts: 11849
    • AVAST Software
Re: add *.VIR to exclusions?
« Reply #4 on: March 28, 2006, 04:39:16 PM »
Ah, I see. Well, you are right... the thing is that the whole Move/Rename action is rather questionable. The preferable action is Move to Chest - which protects the file from being detected subsequently.

Regarding the solutions:
1. Adding *.vir to the list of exclusions is certainly possible, but I wouldn't do that by default. The list of exclusions is not exactly optimized for bigger list (i.e. it's not recommended to put tens of different masks there - it may slow down the scanner), so the smaller the number of default exclusions, the better (especially when the Move/Rename action is used only rarely).
2. Sounds interesting... I'll probably add this check; I hope it won't cause any problems...