Author Topic: Exclusion does not work after the new Avast-update 6.0.1367  (Read 30962 times)

0 Members and 1 Guest are viewing this topic.

Kostronor

  • Guest
Exclusion does not work after the new Avast-update 6.0.1367
« on: December 07, 2011, 09:15:48 AM »
Hello guys,

i was using avast since years and i was always satisfied with what it does and was not doing, but since the new update, my exclusions are not working anymore.
I am myself handling with some files containing viruses and sometimes i need to execute them (i know what i do! ;) ) this has always been working with avast past the years.
I created a folder and excluded the whole folder with %path%/folder/*
but since this update, the filesystem-protection (Dateisystem-Schutz in German) keeps finding a virus. Interesting is, that the .exe itself is not threated only the files created by the .exe are found as virus. I have excluded the whole folder and every single file itself in both, the global settings and in the settings of the module, not i don't know what needs to be done to get this to work.

Help is appreciated
Sincerely
Kostronor

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67194
Re: Exclusion does not work after the new Avast-update 6.0.1367
« Reply #1 on: December 07, 2011, 12:08:26 PM »
Is %path%/folder/* a typo for %path%\folder\* ???
« Last Edit: December 07, 2011, 12:15:22 PM by Tech »
The best things in life are free.

Kostronor

  • Guest
Re: Exclusion does not work after the new Avast-update 6.0.1367
« Reply #2 on: December 07, 2011, 01:56:58 PM »
Is %path%/folder/* a typo for %path%\folder\* ???
It is something like:
C:\Users\Me\Desktop\folder\*

ady4um

  • Guest
Re: Exclusion does not work after the new Avast-update 6.0.1367
« Reply #3 on: December 07, 2011, 05:06:45 PM »
Which shield is identifying the malware? You may need to add exclusions / exceptions to other shields (and scans) too.

I would try also with several paths simultaneously like

Code: [Select]
C:\Users\Me\Desktop\folder
C:\Users\Me\Desktop\folder\
C:\Users\Me\Desktop\folder\*
C:\Users\Me\Desktop\folder\*.*

just in case.

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67194
Re: Exclusion does not work after the new Avast-update 6.0.1367
« Reply #4 on: December 07, 2011, 05:50:12 PM »
Enough C:\Users\Me\Desktop\folder\*
The best things in life are free.

Kostronor

  • Guest
Re: Exclusion does not work after the new Avast-update 6.0.1367
« Reply #5 on: December 07, 2011, 08:14:57 PM »
Enough C:\Users\Me\Desktop\folder\*
Thats what was working till the update has broken it.
Which shield is identifying the malware? You may need to add exclusions / exceptions to other shields (and scans) too.

I would try also with several paths simultaneously like

Code: [Select]
C:\Users\Me\Desktop\folder
C:\Users\Me\Desktop\folder\
C:\Users\Me\Desktop\folder\*
C:\Users\Me\Desktop\folder\*.*
Like said in op, it is the File System Shield.
I had tried every of these and none was working.
also i tried to exclued the file itself:
C:\Users\Me\Desktop\folder\herp.exe
Like said, the problem is not the path not beeing correct, but files which are created in the folder are found, not the .exe itself.
Example:
we have:
-virus.exe
on execution, virus.exe will create a file called virus.exe.tmp.
with C:\Users\Me\Desktop\folder\*:
virus.exe.tmp is deleted
without C:\Users\Me\Desktop\folder\*:
virus.exe is deleted
virus.exe.tmp is deleted

ady4um

  • Guest
Re: Exclusion does not work after the new Avast-update 6.0.1367
« Reply #6 on: December 08, 2011, 02:48:28 AM »
Is it possible that you have to change the type of extensions (not just exe, dll, sys, com and alike) or the sensitivity of the FSS?

What settings you have in FSS -> EXPERT settings -> scan when... ?

Try "playing around" with those type of settings.

I'm not saying this is the best workaround, and probably avast should take this example for future improvements.

In this particular case, I don't know if the created virus is actually executed or just being written, which may make some difference too.

Offline -Genesis-

  • Sr. Member
  • ****
  • Posts: 286
Re: Exclusion does not work after the new Avast-update 6.0.1367
« Reply #7 on: December 08, 2011, 10:43:16 AM »
I think what his saying is true because it happens to me also latest build.

File system shield is detecting one of my .dll file as a threat. This is expected because the .dll file is a cheat for a game.

.dll file will work using injector.

I excluded in File system shield setting the folder and even the .dll file.

I even unchecked the behavior shield main setting.

The .dll file has been copied to the computer but opening it File System shield still detecting it.

Windows 11 Pro / Windows Defender/
Ryzen 5 1600/ Aorus Gtx 1080Ti Xtreme/ Gskill Trident Z RGB 3000/ Samsung Evo 250GB/ Western Digital Black 1 TB

Kostronor

  • Guest
Re: Exclusion does not work after the new Avast-update 6.0.1367
« Reply #8 on: December 08, 2011, 11:54:02 AM »
Is it possible that you have to change the type of extensions (not just exe, dll, sys, com and alike) or the sensitivity of the FSS?

What settings you have in FSS -> EXPERT settings -> scan when... ?

Try "playing around" with those type of settings.

I'm not saying this is the best workaround, and probably avast should take this example for future improvements.

In this particular case, I don't know if the created virus is actually executed or just being written, which may make some difference too.

Hmmm... All settings in scan when are checked the way avast needs to operate in my opinion, so changing them would not help, because then i could also disable avast for 10 minutes, and that is not what i want ;)

Your last question is somewhat interesting because that is something i would like to analyse but avast is blocking me ;)
But with excluding, avast should not make any difference between the two!

I think what his saying is true because it happens to me also latest build.

File system shield is detecting one of my .dll file as a threat. This is expected because the .dll file is a cheat for a game.

.dll file will work using injector.

I excluded in File system shield setting the folder and even the .dll file.

I even unchecked the behavior shield main setting.

The .dll file has been copied to the computer but opening it File System shield still detecting it.



Thanks for the clarification, that i'm not the only one having this error.


Is there any statement by anyone from avast?

Offline igor

  • Avast team
  • Serious Graphoman
  • *
  • Posts: 11849
    • AVAST Software
Re: Exclusion does not work after the new Avast-update 6.0.1367
« Reply #9 on: December 08, 2011, 11:57:58 AM »
Yes, the exclusions for writing  don't seem to work in the last version.

ady4um

  • Guest
Re: Exclusion does not work after the new Avast-update 6.0.1367
« Reply #10 on: December 08, 2011, 01:07:59 PM »
Yes, the exclusions for writing don't seem to work in the last version.

This is the type of test I was aiming at. My point was, if the virus is only being written (not executed), then the "scan when writing" is the setting that should get you a different result in scanning, specially if you would use "scan all files". That's the reason I asked for your settings there.

If you can, please test these settings in several combinations so to confirm igor's suspicion.

Please report back your test's results.
« Last Edit: December 08, 2011, 01:09:55 PM by ady4um »

Kostronor

  • Guest
Re: Exclusion does not work after the new Avast-update 6.0.1367
« Reply #11 on: December 08, 2011, 08:39:59 PM »
Yes, the exclusions for writing don't seem to work in the last version.

This is the type of test I was aiming at. My point was, if the virus is only being written (not executed), then the "scan when writing" is the setting that should get you a different result in scanning, specially if you would use "scan all files". That's the reason I asked for your settings there.

If you can, please test these settings in several combinations so to confirm igor's suspicion.

Please report back your test's results.

seems like igor is right, disabling check for writing leads to no found and disabling check for open leaves no difference.

Ok, i think, in this case we all can clearly state that avast has a bug.
is there a need to report this bug, or is it already known or is it known since this thread?
just asking because i think this should be fixed soon ;)
Thanks for all your help in finding the issue
Kostronor

wowow big edit:
Seems to me that my first guess was wrong, the shield even scans when deactivated. i have deactivated the FSS and it is finding the virus. But i checked every module and none of them is telling me that a virus has been found...
i will now investigate a bit further about it

Well, i cannot find what is finding the virus.
even with FSS disabled it is finding it.
with all modules disabled nothing is found...
« Last Edit: December 08, 2011, 08:53:22 PM by Kostronor »

Tetsuo

  • Guest
Re: Exclusion does not work after the new Avast-update 6.0.1367
« Reply #12 on: December 10, 2011, 12:26:35 PM »
I'm quite sure that the exclusions for writing don't work in the current version.

I checked some files created by Online Armor (which is thoroughly excluded in Avast!) and I noticed that Avast! scans them anyway.

Win XP Pro SP3
Avast! Free AV 6.0.1367 (Behaviour/Script Shield removed)
Online Armor Free 5.1.1.1395 (Web Shield disabled)
*Avast!/OA mutually excluded


Hope this will be fixed soon. As always, thank you very much.

Regards,
T.

Kostronor

  • Guest
Re: Exclusion does not work after the new Avast-update 6.0.1367
« Reply #13 on: December 17, 2011, 01:58:12 AM »
Just to bump it, is there any statement by the avast-team about fixing this bug?

Offline igor

  • Avast team
  • Serious Graphoman
  • *
  • Posts: 11849
    • AVAST Software
Re: Exclusion does not work after the new Avast-update 6.0.1367
« Reply #14 on: December 17, 2011, 02:03:17 PM »
It will be fixed in the next program update.