Avast deleted an application I use all the time!

Avast Free Antivirus / Premium Security
1

I tried to access a small program I use all the time by typing the file path into the “run” box in XP and was told that Windows could not find “C:\documents” so I thought that it was the Adobe Manager trojan that every help forum search of “cannot find c:\documents” pointed to, but that is not the case. The reason is because Avast deleted the program (although not the folder I put it in). I did not know what deleted this at first, so I tried to re-download the exe. It is a tiny 10KB exe file and Avast blocked me from downloading it by clicking on the direct link or by right-clicking the direct link. I have had Avast for about six months and I have used this program probably just under a hundred times since I have had Avast, but suddenly Avast doesn’t want it on my system when I need to use it.

The program is DVD Bitrate Viewer (http://www.videohelp.com/tools/DVD_Bit_Rate_Viewer). I am sent review copies of DVDs to write reviews for a couple sites, and one site requires the bitrate graph and DVD Bitrate Viewer is the program that scans the DVD and generates a graph (you then hit cntrl+prtscn and paste the result into an image editing program). I have used this program hundreds of times but now Avast is calling it a suspicious file and won’t let me download or open it. This is very annoying. When I click on Avast’s “more details” button, it has absolutely no information for the supposed infection. I need to use this program. How do I tell Avast to allow the download and to allow the program.

2

Perhaps a false positive? According to virustotal, Avast! finds it suspicious, but none
of the other scanners hit it.
http://www.virustotal.com/file-scan/report.html?id=e800c9a552e79f55a26d3a7434437b5c8ee955194412d59660bda72685da9a99-1312084390

3

Virustotal seems to be a very useful page. Is that result enough to prove that it is not a dangerous program?

4

Since the executable has been out for a while and only Avast! flags it,
it’s 99.9% a FP.

You provided a link to the file, so Avast! can download and inspect it if they
are so inclined. Are you able to use this file? Perhaps you can add an exclusion ?

5

Avast has deleted it from the folder it was in, and I cannot download it because Avast won’t let me.

6

What about if you temporarily disable Avast, download the file, set an exclusion
and then re-enable Avast!

Some of the other regulars here may have more info as to how that should be handled.

7

I’ll give it a try.

8

Yes,

Maybe try the above steps and send the file to Avast as a zip folder attachment. Send it password protected in the zip folder to virus@avast.com Indicate the password needed to open the file in the e-mail message and title the subject of the e-mail, False Positive. Give as much detail as you can about the program in your e-mail message and what Avast currently does when it finds this file. You may also want to send them the Virus Total report.

You can also download the file, create and put it in a Zip Folder, and than put it safely in the Virus Chest to send it to the Avast Virus Lab. Password Protect the file in a Zip folder. Than open the Avast GUI and go to the virus chest and click Add. Find where you put the file and submit it to the Avast Virus lab with the same detailed instructions you would use for e-mail. Don’t forget if the file is Password Protected, give the name of the password in the additional information field when you send the file to the Avast Virus lab. Indicate False Positive as the file type for the report to the lab.

Any files in the Avast Virus Chest will not hurt your identity or your computer as they are quarantined when in the chest.

Jack

9
You can also download the file, create and put it in a Zip Folder, and than put it safely in the Virus Chest to send it to the Avast Virus Lab. Password Protect the file in a Zip folder. Than open the Avast GUI and go to the virus chest and click Add.
not necessary to zip and password protect when sending from chest ;)

Moving files to the Virus Chest
https://support.avast.com/index.php?_m=knowledgebase&_a=viewarticle&kbarticleid=501#idt_03

Submitting files from the Virus Chest to avast! Virus Lab
https://support.avast.com/index.php?_m=knowledgebase&_a=viewarticle&kbarticleid=501#idt_07

10

So I…

  1. pause the program,
  2. download the application again,
  3. add the exclusion,
  4. place it in the virus chest,
  5. submit it to the virus lab,
  6. restore it to the excluded folder,
  7. and then enable the shields again?
11

Most likely a false positive, as I know what piece of malware the defenition should detect and this doesn’t seem to fit in the profile.

Greetz, Red.

12

I don’t know what’s happening now. I paused the shields, downloaded the file, created the exclusion, and submitted it to the virus lab. Then I deleted it from the chest. Then I re-enabled the shields.

Is there some link between Avast and Comodo, because now Comodo is attacking it. When I click on the file, I get a box that says “Windows cannot access the specified device, path, or file. You may not have the appropriate permissions to access them.” And then Comodo Internet SEcurity Alert pops up and says “Application Isolated.” When I hit “Don’t Isolate Again” and click on the program again, I get the same warnings. I opened Comodo and added the file to the Trusted Files list but I get the same warnings.

I rebooted the computer and found that Avast had deleted the file again and put it in the virus chest. I restored it and deleted it from the chest, but when I try to open it, I get the Comodo warnings. I went back to the trusted files and the entry is no longer there. I added it again but it disappeared from the trusted list again.

And now this:

13

Back from my adventures on the Comodo forums (thanks to Radaghast for working with me): DETAILS HERE and it does seem to be an Avast issue. I’m not sure what to do next.

14

What you are seeing is Avast and Comodo interfering with each other.

Are you using Comodo firewall only or the antivirus part too?

Using two antivirus tools both in resident mode at the same time is not a good idea.

You may try excluding Avast Chest and Avast databases from Comodo and the other way around too, but as a general concept, you should use Comodo only as firewall and Avast as AV.

You are correct about Avast making problems in this particular case (FP).

If this is indeed a FP ( and I would tend to think it is), then Avast is not only detecting it as a file (which you already added to your exclusion/exception list). Avast is also detecting something in memory (RAM) when you tried to add it to Comodo.

That’s why I think you should also exclude Comodo’s database from Avast, and the other way around too.

Once the program will not be a FP anymore in Avast, your problem with this particular program will be solved.

Still, some incompatibility between security tools may happen “some” time, and excluding both databases from each other might help you reduce it.

Now, is this going to happen to everyone using both programs? I don’t think so. It depends on so many settings, that for some other user using the same FP program and both Avast and Comodo it might well had been resolved with the exclusion/exception list in Avast and that’s it.

In any case, once the FP is solved in Avast (you should still keep a copy in the chest until it is solved), it would be recommended to delete the particular exclusion line.

BTW, Avast has at least 2 exclusion / exception lists for files and folders. One is in the general settings, and one in the expert settings of the File System shield, so add your program/folder to both.

15

I am only using Comodo’s firewall, not their AV. Would I just add the file path for the whole of Comodo (c:\program files\comodo) to the Avast exclusions, or is their a specific Comodo executable to exclude?

16

Things like this are the reason why I set my scanner actions to Ask for PUP’s and “Suspicious” files. You may want to do the same.

17

I have changed the PUP and Suspicious settings.

18

It’s working now. Thanks for the help!