Constant "threat secured" driving me insane

[zenperson]

I had the same problem yesterday. For hours, Avast, every 10 or 15 minutes, popped up saying that it had blocked Win32:Malware-gen from a windows app which appears to be something Windows based like an app or a widget. But, I can't figure out how to get rid of it... Today, it's not popping up yet so maybe it resolved itself. I wish you could turn off the warning in Avast at least...

[DavidR]

I had the same problem yesterday. For hours, Avast, every 10 or 15 minutes, popped up saying that it had blocked Win32:Malware-gen from a windows app which appears to be something Windows based like an app or a widget. But, I can't figure out how to get rid of it... Today, it's not popping up yet so maybe it resolved itself. I wish you could turn off the warning in Avast at least...

Read the post above yours, it was confirmed as a False Positive.

This would likely have been fixed fairly promptly and delivered automatically in a Virus Definitions > Streaming Update.

You can stop this, by adding an Exception for the URL location - However this comes with a strong warning, you have to realise there is a risk in this and you have to be 100% sure it is a false positive.  Or it could cause serious problems.

[YellowPC]

Here is the response from Avast:

The reported URL was checked by Avast virus specialists and based on the findings the detection was removed. The website is now marked as clean in the Avast virus database. This change may take up to 24 hours to take full effect. Please accept my apology for the inconvenience caused.

If the detection persists after 24 hours, please update the Avast virus database and reply to this email with attached files:
1.   Take a screenshot of the Avast detection dialog (Threat Secured pop-up with See details - displayed at the bottom).
2.   A screenshot of the Avast virus database (open Avast Antivirus and go to Menu > About).

[nullager]

Suspect that this isn't a false positive.
Used PowerShell to uninstall 'yourPhone' from all accounts on a machine experiencing this symptom.
Symptom persisted until Avast quarantined the causal files.
Command used to uninstall was: Get-AppxPackage Microsoft.YourPhone -AllUsers | Remove-AppxPackage
Machine rebooted after PS uninstall.
This did not stop the symptomology.
Recurred every 12 to 13 mins when machine online and then all at once when machine taken offline then placed online.
Avast, please look into this.

[DavidR]

Suspect that this isn't a false positive.
Used PowerShell to uninstall 'yourPhone' from all accounts on a machine experiencing this symptom.
Symptom persisted until Avast quarantined the causal files.
Command used to uninstall was: Get-AppxPackage Microsoft.YourPhone -AllUsers | Remove-AppxPackage
Machine rebooted after PS uninstall.
This did not stop the symptomology.
Recurred every 12 to 13 mins when machine online and then all at once when machine taken offline then placed online.
Avast, please look into this.

They did look into it, this reply is from one of the Avast Virus Labs Team.

Hello,
thank you for the report. It is false positive, we will fix it.

Milos

If you look at the images in Reply #4 the action was initiated by svchost.exe

Your comment that after this removal action the alerts didn't stop, doesn't support it not being an FP.  Ensure that you have the latest Virus Updates and check if it continues.

If it does take a screenshot of the Avast Alert and attach it.

[ikulb]

This problem has started for me today. There was a pending Avast update, but it persists after updating.

[DavidR]

The file in the alert url appears to be a little different, but generally the same URL, I don't know what the streaming update is/was.  I don't think I have any file streaming service enabled on my system so I haven't come across this before.

Do you happen to know what was being streamed ?

You can report it as a possible false positive - Reporting a Possible False Positive File or Website - https://www.avast.com/false-positive-file-form.php.
You should get a response in a day or two.

In the Remarks, give a brief summary of problem and giving a URL link of this post/topic would help greatly (they will see the history and screenshots, that you couldn't attach to your report..

[Milos]

Hello,
thank you for notice. It ws a FP and is fixed now.

Milos

[DavidR]

Thanks for the prompt response Milos.