Treating the problem rather than the symptom is the way to go here. First confirm the FP or Detection using VT as mentioned. If confirmed as an FP send the sample to avast for analysis (exclude if you accept the risk) and the detection is likely to be corrected (quickly). This helps all avast users.
You don't say what version of avast your friend is using 4.8 or 5.0 ?
If 5.0:
Check the offending/suspect file at:
VirusTotal - Multi engine on-line virus scanner and
report the findings here the URL in the Address bar of the VT results page. You can't do this with the file securely in the chest, you need to extract it to a temporary (not original) location first, see below.
Create a folder called
Suspect in the
C:\ drive. Now exclude that folder in the
File System Shield, Expert Settings, Exclusions, Add, type (or copy and paste)
C:\Suspect\* That will stop the File System Shield scanning any file you put in that folder.
If only GData and avast detect it - GData uses avast as one of its two scanners so counts as 1 detection and almost certainly an FP.
Send the sample to avast as a False Positive:
Open the chest and right click on the file and select 'Submit to virus lab...' complete the form and submit, the file will be uploaded during the next update.
- In the meantime (if you accept the risk), add it to the exclusions lists (see note below):
File System Shield, Expert Settings, Exclusions, Add and avast Settings, Exclusions Restore it to its original location, periodically check it (scan it in the chest), there should still be a copy in the chest even though you restored it to the original location. When it is no longer detected then you can also remove it from the File System Shield and avast Settings, exclusions lists.
Note: don't exclude the folder this file is in but exclude the file (or it leaves too big a hole in security, copy and paste the full path to the file into the exclusions.
