Adding an Exception Directly from the Virus Chest

[phrab7]

Occasionally, I see something in the virus chest that I know isn't infected & would like to add it to the exceptions.  Although I know how to create an exception, I can't see the full path unless I hover the mouse over the virus chest entry.

However, there doesn't seem to be a way to copy the path, so I can easily create the exception.  I have to hover the mouse, write down the entire path on a piece of paper, & then add the exception.

Is there an easier way to do this?
Thank you in advance!

[DavidR]

You don't say what the file is nor what the detection was, so it is somewhat difficult to investigate.

I would suggest using the virus chest option, send for analysis.  If it truly is an FP then this would benefit all avast users who may experience it.  Periodically rescan it in the chest if it is no longer detected you could reasonably assume avast has corrected the FP and it can be restored.

There is another option to Restore, now previously there was an option to Restore and add an exception.  This option is no longer there in the latest XP/Vista version of avast, so I just wonder if the Restore option (rather than Restore As) would add an exception or not.

[phrab7]

You don't say what the file is nor what the detection was, so it is somewhat difficult to investigate.

I would suggest using the virus chest option, send for analysis.  If it truly is an FP then this would benefit all avast users who may experience it.  Periodically rescan it in the chest if it is no longer detected you could reasonably assume avast has corrected the FP and it can be restored.

There is another option to Restore, now previously there was an option to Restore and add an exception.  This option is no longer there in the latest XP/Vista version of avast, so I just wonder if the Restore option (rather than Restore As) would add an exception or not.

Thank you for your response.  I did send it for analysis & restored it.  However, I have forgotten the filename & only know the beginning of the path.  Basically, it's a general question as to the easiest way to add it as an exception.  Right now, I would have to hover the mouse over the file in the virus chest & copy on paper.
e.g.  I've attached an image of a file that's in the virus chest.  It's only an example & not the file I was talking about.   But if I wanted to create an exception for it, it would be difficult

[DavidR]

The file that remains in the virus chest is effectively a belt and braces backup in case the Restore happened to fail.

That image looks like an old restore point and I honestly don't know if Avast would be able to successfully integrate that back into the System Restore function.

Have you got avast scanning archive files ?
The reason I say this is I'm not sure if the System Volume Information folder and restore points wouldn't be considered archives.

Presumably this detection was as a result of running an on-demand scan ?
If so what scan was it ?

[phrab7]

The file that remains in the virus chest is effectively a belt and braces backup in case the Restore happened to fail.

That image looks like an old restore point and I honestly don't know if Avast would be able to successfully integrate that back into the System Restore function.

Have you got avast scanning archive files ?
The reason I say this is I'm not sure if the System Volume Information folder and restore points wouldn't be considered archives.

Presumably this detection was as a result of running an on-demand scan ?
If so what scan was it ?

Thank you again for your response.

It was a complete scan that put the example in the virus chest.  I'm not trying to restore that file or create an exception for it.  I only used it as an example of a file whose name was too long for me to memorize.  I just want to find a a quicker way to add an exception when a file is put in the virus chest.

[Cluster-Lizard2014]

You typically get that sort of thing happening if AVAST has detected a problem, be that PUP or something else more serious on a PC and a restore point was made before it was removed/quarantined. The System Volume Information folder is where restore points are kept. That means there is effectively a copy of the possibly dodgy file in the SVI folder which is why AVAST has flagged it up.

It can happen after you've added an exception for a false positive too because the path you've put in for that file does not include the new path to the SVI folder generated when you've created a new restore point. It can all get very silly as AVAST may even see the copying of the file as suspicious behaviour and flag it up as problem.

However losing a restore point is, usually, no big problem so there isn't any reason to want to restore even if it could be done. As DavidR indicated chances are that if you tried to use that it you'd get a message after the restore process that certain files could not be restored or the restore process would fail.

In short: you do not want to add the SVI or anything in it as an AVAST exception because if the infection was serious and the nasty had been saved as part of a restore point then the exception could hinder the clean up/removal of the infection. You do actually want AVAST to remove this SVI file for that reason.

Adding exceptions with AVAST (Free) has always been annoyingly awkward. You should have the option to add the path direct from the Virus Chest or, better, manually do it when the problem is first flagged after an on demand scan. The fact you can not just copy the paths from either has always been annoying.

I've had stuff I know is OK I've restored from the Virus Chest to the original location. You go to copy the path directly for adding to exclusions (hold down Shift when right clicking on the file to get the "Copy As Path" option) and just doing that can cause AVAST to flag it up again as a problem. It will send it back to the Virus Chest if you have the File Shield etc at default settings.   

I suppose there are logs for all this buried in AVAST somewhere but it should not be necessary to have to hunt them down when the information is already right in front of you.

 

[DavidR]

The file that remains in the virus chest is effectively a belt and braces backup in case the Restore happened to fail.

That image looks like an old restore point and I honestly don't know if Avast would be able to successfully integrate that back into the System Restore function.

Have you got avast scanning archive files ?
The reason I say this is I'm not sure if the System Volume Information folder and restore points wouldn't be considered archives.

Presumably this detection was as a result of running an on-demand scan ?
If so what scan was it ?

Thank you again for your response.

It was a complete scan that put the example in the virus chest.  I'm not trying to restore that file or create an exception for it.  I only used it as an example of a file whose name was too long for me to memorize.  I just want to find a a quicker way to add an exception when a file is put in the virus chest.

OK, but did you make any modifications to the default 'Full Virus Scan' ?

As I said I'm kind of hoping that the Restore function from the chest would create an exception, but it didn't appear to do so. 

I was running a test with the eicar.com file that I scanned and allowed it to be sent to the virus chest.  Restoring didn't create an entry in the normal location AvastUI > Settings > General > Exclusions and it did clear the file from the virus chest (not what it used to do. 

However I was able to run the eicar.com file without avast alerting again on it in the restore location.  It would appear that it is storing this exclusion elsewhere.

[phrab7]

Thank you both for your replies.  It seems that I've misled you as to the problem.  The images I posted have nothing to do with my issue, & I'm sorry if I wasn't clear.  I have no intention of restoring a System Restore point, nor of adding it as an exception.  I just want to be able to copy a path of an item (any item) that's in the virus chest to the Windows clipboard.

[schmidthouse]

Thank you both for your replies.  It seems that I've misled you as to the problem.  The images I posted have nothing to do with my issue, & I'm sorry if I wasn't clear.  I have no intention of restoring a System Restore point, nor of adding it as an exception.  I just want to be able to copy a path of an item (any item) that's in the virus chest to the Windows clipboard.

y

I believe I understand the confusion you are seeing caused by the example you used to try and explain your original question because you could not provide the actual original file (at least that's what I'm seeing while I followed this Topic.)
In any case, I'm not sure that what you want to do is possible.
I've not done alot of  adding exceptions as in my OS's systems I don't get any file hits on my scans.
Having said that, is it possible to Hover the mouse to get the total path and then write it down and proceed to adding as an exception. Don't know.

Edit: Hope I haven't added to the confusion.

[DavidR]

Thank you both for your replies.  It seems that I've misled you as to the problem.  The images I posted have nothing to do with my issue, & I'm sorry if I wasn't clear.  I have no intention of restoring a System Restore point, nor of adding it as an exception.  I just want to be able to copy a path of an item (any item) that's in the virus chest to the Windows clipboard.

My Reply #6 above your post isn't related to the system restore issue/confusion, but directly about a test I did.

This test with a benign anti-virus test file, eicar.com, it should answer the question on how to add to exclusions, as Restoration would appear to do that.  I suggest reading my previous post again.

[phrab7]

My Reply #6 above your post isn't related to the system restore issue/confusion, but directly about a test I did.

This test with a benign anti-virus test file, eicar.com, it should answer the question on how to add to exclusions, as Restoration would appear to do that.  I suggest reading my previous post again.

Thank you for your clarification.  It seems that Avast is adding an exception somewhere after a restore, which means you must be careful what you restore, especially since it may be difficult to find, since you don't know the path.

I just ran a test to see what Avast files change after a restoration, using a utility called InCtrl5, which records the state of all files when it's run & then again when it's run the 2nd time.

I recorded all files, & then restored a program from the virus chest which is not actually installed on my computer...PestPatrolV4.exe.  Then I ran InCtrl5 again.  As you noticed, Avast would no longer flag PestPatrolV4.exe as a virus.  InCtrl5 found 2 Avast files that had been changed after the restoration.

1) c:\Documents and Settings\All Users\Application Data\AVAST Software\Avast\lscache.dat
2) c:\Documents and Settings\All Users\Application Data\AVAST Software\Avast\chest\index.xml

So it appears that one of those files contains the "exception", but I'm unable to read either file.

[DavidR]

The second file basically contains the content of the chest, the index.xml is basically browser template type file (I viewed it in Firefox) and it can also be viewed in a text editor.  Any file Restored would not feature in this file content.

The .dat files are os based files and would require some sort of specialist tool to read.