Avast Web Shield: threat blocked, but where is the exception created?

[markinson]

Hello everyone! 
I'm using Avast Free Antivirus version 17.6.2310 (build 17.6.3625.0; virus definitions: 170920-4); O.S. Win10.
With this version of the antivirus, since a few weeks, it happens that the "Web Shield" module (I believe it!) warn me of downloading a threat while picking up some software that, however, is sure to be absolutely virus/malware free.

The "Threat blocked" pop-up window offers two options:
(1) Stop connection
(2) More options> create an exception

At this point, I decide to create an exception, but (here is the question) where is this exception placed?
In other words: the exceptions created in this way, where can they be reviewed and/or controlled and/or eliminated?

I searched in several sections of the program, including:
(a.1) "General"> "Exclusions"> "File paths"
(a.2) "General"> "Exclusions"> "URLs"
(a.3) "General"> "Exclusions"> "CyberCapture"
(a.4) "General"> "Exclusions"> "Hardened Mode"
(b) "Components"> "Web Shield"> "Customize"> "Exclusions"
however I could not find the (few and checked) exceptions created through the "Threat blocked" pop-up window.

Any suggestions?
Thank you!
 
Markinson

P.S.
I have created the same discussion in the Italian section (my language), to try to be as understandable as possible. 

[Pondus]

warn me of downloading a threat while picking up some software that, however, is sure to be absolutely virus/malware free.

What does the warning popup from avast say?

you may post a screenshot

[markinson]

Hallo and thanks for the immediate response!
The message is in Italian, but I'm sure you understand (attached to this post).

[Pondus]

So just a file reputation warning

FileReputation = New file, not seen among avast users so suspicious

Anyway FRST.exe is often blocked by security programs evry time it is updated

Malware removal team in this forum also use FRST diagnostic tool     >>  https://forum.avast.com/index.php?topic=194892.0

[markinson]

Yes, I agree.
But the exception that is created, when (and if) I decide to create it, where is it put up? 

[Pondus]

Do not know

[markinson]

ahi, that's the "problem" ... not a "big" problem, only a little one (for me)!

I'm enough curious ... 

Anyway, thanks for your answer!

[DavidR]

Your attached image would appear to be from the Web Shield - FileRepMalware, isn't hard and fast malware, just that not many avast users have downloaded it.

If you put it in:
(a.2) "General"> "Exclusions"> "URLs"
That really should cover it as it is a URL location being indicated.
or
(b) "Components"> "Web Shield"> "Customize"> "Exclusions"
if the (a.2) isn't working with it.

Can you post the exact text that you are inputting into the exclusion
 ?
I don't see anything in the English language Alert window example (relating to the web shield) that offers creating an exclusion, see attached image.

[markinson]

Sorry for delay! And thank you so much for your attention.
Two questions.

(1)

I don't see anything in the English language Alert window example (relating to the web shield) that offers creating an exclusion, see attached image.

Check my new attached, named "Avast RegSeeker_Screeshot_003-001.jpg".
You have to click on "More options", than you can "create exception".
But, if you do that (if you create an exception), you can't find anymore this exception!

I mean, second question ...

(2)

Can you post the exact text that you are inputting into the exclusion?

I don't create an exception by myself.
I create an exception (or exclusion) by the "More options > Create exception" button, in the "avast - Threat blocked" pop-up window, detected by "Web Shield".

But, once I've created - in that way - the exception, this disappeared! I can't find this exception elsewhere inside avast options or settings.

... and sorry for my English! 
markinson

[markinson]

"screeshot" ... I mean "screenshot". 

[DavidR]

OK I hadn't actually seen that (create exception) when I captured my screenshot some time ago.

If it didn't place it in the regular exclusions that you can view, my only guess would be that it would have been put into one of the .ini files in the C:\ProgramData\AVAST Software\Avast\ folder in that folder are two that may contain it exclusions.ini and WebShield.ini.

That said if you are still getting the alert, then it may not be in then. Either that or there is a bug were the exclusion isn't working.  I have seen only one other topic were someone is reporting an exclusion not working, but I haven't got any details on that topic.

Your English is just fine.

[markinson]

Something more.
I just done a try.
I downloaded, once again (from Softpedia), Farbar Recovery Scan Tool (FRST) 19.09.2017.0 (x86) and, as you see in the attach, I received one again the "Threat blocked" pop-up window because the "Web Shield" module detected a suspicious element.
But, and this is the "problem", I'm sure that when I downloaded the same Farbar Recovery Scan Tool (FRST) 19.09.2017.0 (x86) this afternoon, I created an exception by the "More options" button.
So, it's as avast forgot the exception created some hours ago (for exactly the same program - FRST x86).
Thanks a lot for your patience! 

[markinson]

If it didn't place it in the regular exclusions that you can view, my only guess would be that it would have been put into one of the .ini files in the C:\ProgramData\AVAST Software\Avast\ folder in that folder are two that may contain it exclusions.ini and WebShield.ini.

Great!
Probably it's something right there.
I'll explore!

Thanks for your replies!
... and "my" (the online translator, indeed!) it's not so good! 
Cheers from Italy. 

[DavidR]

You're welcome.
When you explore the exclusions.ini and WebShield.ini, use notepad or the avast self-defence module may get into action.

Something else you might want to do is go into your browser and clear browser history as you may well be loading the page that the alert happened to and subsequent attempts to open it could be blocked even if you have an exclusion.

[Milos]

Hello,
use https://www.avast.com/false-positive-file-form.php, please.

Milos