Bug - Avast 5.0.507 - Restore from chest doesnt work

[mohan]

Bug Subject : Restoring a file from chest doesnt work.

Environment :
Avast 5.0.507
Win XP3,
CIS 4.0.141842.828 (Firewall & Defense on, Av deactivated), all other anti spy/malware on demand.

Description :
Avast marked hxxp://www.nirsoft.net/utils/asterwin.html as a PUP, tried to restore back from chest, didnt work. The file was not restored.

Or perhaps the file was restored but Avast again identifies it as malware hence back it goes in to the chest (no alert shown though)

Cheers

[igor]

What was the location of the file? Certainly not http... something.

[Dch48]

I set all my scanner options to ask before taking an action on detection. I don't want anything being quarantined automatically or even worse, silently. I also would like to see an option to ignore or add to exclusions when something is detected. Why are those options not present?

[doktornotor]

So have you downloaded it already or what? If avast blocked connection to the download, there's nothing to restore at all.

[DavidR]

I set all my scanner options to ask before taking an action on detection. I don't want anything being quarantined automatically or even worse, silently. I also would like to see an option to ignore or add to exclusions when something is detected. Why are those options not present?

Your post isn't related to the problem discussed in this topic, "Restore from chest doesnt work."

So I suggest that you start your own topic, you have also asked that question in another topic though and one of the Alwil team has answered it, Alwil won't put a single click option to Ignore (allow to run) or exclude a file it considers infected to prevent the accidental selection by a user.

[Dch48]

Bug Subject : Restoring a file from chest doesnt work.

Environment :
Avast 5.0.507
Win XP3,
CIS 4.0.141842.828 (Firewall & Defense on, Av deactivated), all other anti spy/malware on demand.

Description :
Avast marked hxxp://www.nirsoft.net/utils/asterwin.html as a PUP, tried to restore back from chest, didnt work. The file was not restored.

Or perhaps the file was restored but Avast again identifies it as malware hence back it goes in to the chest (no alert shown though)

Cheers

This makes my post very relevant to the topic. If you set the option to ask, the file will not go back in the chest without an alert. If that is what happened.

[DavidR]

Sorry 'mohan' is talking about restoring a file that is 'in the chest' and here you are trying not to have avast send it to the chest or take any other action.

Setting it to ask, the file is in limbo, neither on your system or in the chest as avast's web shield has blocked it. When the file we are seeing as reported is a web URL indicating it is a file which was on-line, so there is no way avast could restore a file to an on-line location.

Unfortunately we have had no response from 'mohan' to the questions about the files origin, so anything on that point is speculation on all parts. So until that is determined this really can't progress.

[mohan]

Thanks Guys, appreciate you picking this one up so quickly.

The file was on disk, locally extracted under C:\Sandbox\ (which is my temp working area)

@ Dch48 - Thanks, generally have it set to Ask but was testing features and default behavior before I recommend 5.0 to a few colleagues.

Cheers

@DavidR & Igor - thanks guys your active crawling iis what makes the forum a better place - Keep it up guys.

[Dch48]

Sorry 'mohan' is talking about restoring a file that is 'in the chest' and here you are trying not to have avast send it to the chest or take any other action.

Setting it to ask, the file is in limbo, neither on your system or in the chest as avast's web shield has blocked it. When the file we are seeing as reported is a web URL indicating it is a file which was on-line, so there is no way avast could restore a file to an on-line location.

Unfortunately we have had no response from 'mohan' to the questions about the files origin, so anything on that point is speculation on all parts. So until that is determined this really can't progress.

  No I was not trying to have the program do anything. He suggested the possibility of the file going back into the chest after being restored and that happening without an alert, thus making it appear that it was never restored. I was just saying that if you have the option set to ask, that can't happen.

[mohan]

Guys don't know, maybe something odd with my install cant tell 
I've got these 2 FP's and they are in the chest.
http://forum.avast.com/index.php?topic=63599.0
http://forum.avast.com/index.php?topic=63598.0

My File System Shield - Expert Settings -
- Actions - Viruses, PUP, Suspicious tabs - All options are set to Ask.
  The show notification option is checked
- Sensitivity is High fr Heuristics and the option for code emulation and scan for PUP is checked.

I have added as exclusions the path where I want to restore them (same path as the location where they were identified)

Am trying to restore them from the chest (using the restore option, have also tried the extract option) but I do not get any notification and neither is the file extracted.

Have also tried using the in built submission mechanism but oddly that too doesn't work, though have input all data required by the submission dialog.

I think perhaps my options are possibly odd and hence the behavior presented.

Could you assist

Regards

[CharleyO]

***

Since you are using a slightly older version, try updating avast to version 5.0.594 which is the latest stable release version. This might help the problem.


***

[mohan]

@CharleyO - Currently using Avast AV free - 5.0.594.

[CraigB]

Probably not best to have your heuristic's set to high either, normal is better.

[CharleyO]

***

Sorry, mohan, but I was going by the topic title.   


***

[mohan]

@DavidR

As updated on http://forum.avast.com/index.php?topic=63598.msg538242#msg538242

Am trying to restore them from the chest (using the restore option, have also tried the extract option) but I do not get any notification and neither is the file extracted.

Have added the destination folder to exclusions to be on a safe side. But no luck.

Please could you guide here too.