Author Topic: How to stop Avast from blocking and deleting a certain executable?  (Read 48175 times)

0 Members and 1 Guest are viewing this topic.

Offline Someone0001

  • Newbie
  • *
  • Posts: 2
According to Avast, a certain executable has a virus in it and so it completely whipes it out when ran. However, I know it's safe, and it's not just a matter of trusting here: I really know it is. I've made Avast to exclude it when scanning, but that doesn't stop Avast from policing the executable, unfortunately. How can I completely exclude the executable, not just from being scanned but from being policed by Avast at all? I don't mind dropping Avast's shields when unzipping the file, but dropping the shields every time I need to run it, that's not a good idea.

Offline DavidR

  • Avast √úberevangelist
  • Certainly Bot
  • *****
  • Posts: 84749
  • No support PMs thanks
Re: How to stop Avast from blocking and deleting a certain executable?
« Reply #1 on: August 15, 2011, 05:39:57 PM »
Well avast doesn't wipe anything out, the default action is to move to the chest, unless the user has changed the settings to delete the detected file/s ?

- What is the infected file name, where was it found e.g. (C:\windows\system32\infected-file-name.xxx) ?

Where did you exclude this file and what was the full text of your exclusion ?

You could also check the offending/suspect file at: VirusTotal - Multi engine on-line virus scanner and report the findings here, post the URL in the Address bar of the VT results page. You can't do this with the file securely in the chest, you need to extract it to a temporary (not original) location first, see below.

Create a folder called Suspect in the C:\ drive. Now exclude that folder in the File System Shield, Expert Settings, Exclusions, Add, type (or copy and paste) C:\Suspect\*
That will stop the File System Shield scanning any file you put in that folder.

Windows 10 Home 2004 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 21.2.2455 (build 21.2.6096.648) UI 1.0.608/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Offline Someone0001

  • Newbie
  • *
  • Posts: 2
Re: How to stop Avast from blocking and deleting a certain executable?
« Reply #2 on: August 15, 2011, 08:09:48 PM »
Thank you. The last part of your post was what I was looking for. I excluded it in Settings (next to Help Center on Avast's "main page") first, which was obviously wrong. Never saw there were settings for the shields. Thank you very much ;D

Offline ady4um

  • Massive Poster
  • ****
  • Posts: 2667
Re: How to stop Avast from blocking and deleting a certain executable?
« Reply #3 on: August 15, 2011, 08:16:47 PM »
I excluded it in Settings first, which was obviously wrong.
It was not "wrong". That exclusions/exceptions list is for "scans".
Quote
Never saw there were settings for the shields.
The shields' exclusions/exceptions list is there so to avoid detecting false positives (as an example) while using you system as usual (as oppose to detecting during "scans"). As you said, this is what you were looking for; but still, the other list is not "wrong".
ADD/REMOVE PROGS -> avast -> CHANGE/REMOVE -> REPAIR & REBOOT
Avast! 7 FAQ | FAQ & KB | Docs | Removal Utils | Configure Mail Shield | report FP | License Registration | UNSECURED?

Offline DavidR

  • Avast √úberevangelist
  • Certainly Bot
  • *****
  • Posts: 84749
  • No support PMs thanks
Re: How to stop Avast from blocking and deleting a certain executable?
« Reply #4 on: August 15, 2011, 08:18:28 PM »
Thank you. The last part of your post was what I was looking for. I excluded it in Settings (next to Help Center on Avast's "main page") first, which was obviously wrong. Never saw there were settings for the shields. Thank you very much ;D

You're welcome.

Exclusion should never be the only action, confirmation it is an FP, followed by reporting it to avast for correction. This helps all avast users as opposed to exclusion of the file that only helps the one avast user.

####
If only GData and avast detect it - GData uses avast as one of its two scanners so counts as 1 detection and almost certainly an FP.
Send the sample to avast as a False Positive:
Open the chest and right click on the file and select 'Submit to virus lab...' complete the form and submit, the file will be uploaded during the next update.

@@@@
- In the meantime (if you accept the risk), add the full path to the file to the exclusions lists (see Note below):
File System Shield, Expert Settings, Exclusions, Add and
avast Settings, Exclusions

Restore it to its original location, periodically check it (scan it in the chest), there should still be a copy in the chest even though you restored it to the original location. When it is no longer detected then you can also remove it from the File System Shield and avast Settings, exclusions lists.

Note: When using the Browse button it only goes down to folder level accept that. Now open the entry in the exclusions and change the \* to \file_name.exe where file_name.exe is the file you want to exclude.
Windows 10 Home 2004 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 21.2.2455 (build 21.2.6096.648) UI 1.0.608/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security