Unable to restore file after reported false positive

[masterryan]

Hi

So I downloaded an update to "HEVC Video Extensions from Device Manufacturer" and avast detected it as a malware (codecpacks.HEVC.exe) and it got quarantined in Virus Chest. I sent avast the file and it came back to be a false positive. However, I can't seem to be able to restore the file. I already tried repairing the app as suggested here:
https://forum.avast.com/index.php?topic=220142.msg1467785#msg1467785
https://blog.fonepaw.com/avast-virus-chest-wont-restore.html

Haven't tried clean install as I'm afraid it will also remove the file in Virus Chest.  My version of Avast is already up to date and it has been more than 24 hours since I got the email of the reported false positive. Note that I updated Avast to the version mentioned below (application update) after the file was quarantined so not sure if that would have caused this issue. Please advice.

System info:
Windows 10 x64 1909
Avast Free Antivirus 20.10.2442

Thanks in advance!


P.S. Also not very sure how to upload image so would really appreciate it if someone could link a thread about it.

[DavidR]

Use the "Attachments and other options" below the text window.

[masterryan]

Thanks for your reply. Here are the screenshots

[masterryan]

Perhaps I could be put in touch with Avast staff who could help me with this issue? Thanks!

[Pondus]

However, I can't seem to be able to restore the file.

Have you tried to download it again?

[masterryan]

Download the AV? Are you referring to just using the uninstaller and not the Clean Install? Not sure if that will remove the file from the virus chest, which is ultimately what I'm trying to avoid.

[Pondus]

So I downloaded an update to "HEVC Video Extensions from Device Manufacturer"

The file avast quarantined

I sent avast the file and it came back to be a false positive.

So you should be able to download it again if avast lab said it was a FP

If that work you can just delete the file in quarantine

[masterryan]

I think that is a system file so I can't just download or delete it just like that. Thanks for your suggestion anyways

This topic seems somewhat relevant to what I'm facing https://forum.avast.com/index.php?topic=245006.0 but based on what I understand, they didn't have issues restoring the file. I'm able to extract the file but not able to restore it. Don't think I can extract it to the WindowsApps folder since its hidden though.

[masterryan]

I'll try but I doubt it will help since its a system file but not in the OS (WindowsApps folder). Also I tried restoring an actual malware (a pdf containing malicious javascript) and restoring to Desktop works. Maybe because I don't have enough permissions to restore it to the particular folder, even though I already run avast as administrator.

[DavidR]

I don't know where you got this from "update to HEVC Video Extensions from Device Manufacturer" ?

I also don't know what you are trying to do to get this error (your attached images) ?

Surely given its original location, the WindowsApps folder, are you not able to go to the Microsoft Store (APP Store) and install it from there ?

I don't use the Windows Store, I have isolated my system from it, so I can't help in that regard.

[masterryan]

I don't know where you got this from "update to HEVC Video Extensions from Device Manufacturer" ?

I got this from the Windows Store when I updated the app.

Based on these few articles I read online, it seems like the app is not longer free so I'm not sure if I would have to pay if I were to uninstall it.
https://answers.microsoft.com/en-us/windows/forum/apps_windows_10-winapps-appscat_tools/hevc-video-extensions-from-device-manufacturer/50b3ac5d-b53b-4bac-b188-a84518129651
https://www.reddit.com/r/Windows10/comments/j58y6f/no_longer_free_windows_10_hevc_video_extensions/

Thus, I am planning to shift the .exe file back manually since automatic restoration doesn't seem to work. However, even after I gained full control of the WindowsApps folder as per this guide:

https://www.maketecheasier.com/access-windowsapps-folder-windows-10/

I still get an error message as shown in the attached screenshot that I don't have sufficient permissions.

[DavidR]

I guess the WindowsApps still has a higher level of protection to install something into it.

I don't use the Windows Apps store so have nothing in there but I get the same permissions popups.