I’m using free Avast. I did not upgrade for a day or two because I planned to backup all my projects for the last 10 years. When I tried to transfer my files onto a memory stick, most of the compiled PE Apps I created using AutoIt were deleted. I have not yet assessed the damage done, but I am hoping someone will be able to tell me how to recover these files. I was given an option to add the files to an exclusion list during the transfer, but this had no effect on the aggressive action taken by Avast. I beg the developers, please can you not do something about the default avast behaviour and make it easier to control the program’s actions. Until I manage to assess the damage, I can’t begin to think of upgrading. I may have to disable avast altogether.
Normally the files should not been deleted, they should be in quarantine.
Under Maintenance on the top, then choose Virus Chest.
If you havent changed the Avast settings.
I planned to backup all my projects for the last 10 years.10 years are bit long to wait before backup ... or?
malware experts are notified…
When I tried to transfer my files onto a memory stick, most of the compiled PE Apps I created using AutoIt were deleted.did avast give a malware name to the detected files.... if so what?
Hi,
Check USB storage devices / removable drives
Download MCShield from one of the following links:
MyCity - Official download link
Softpedija - Mirror download link
[*] Double click MCShield-Setup to install the application.
[*] Wait a few seconds to MCShield finish initial scan.
Recommendation to under General and Scanner tab you click on Defaults button to choose recommended options.
[*] Connect your USB storage devices to the computer one at a time. Scanning will be done automatically.
When all scanning is done, you need to attach a logreport that MCShield has created.
Start → All Programs → MCShield → Logs
Attach here → AllScans.txt
Explanation: USB storage devices are all the USB devices that get their own partition letter at connecting to the PC,
e.g. flash drives (thumb/pen drives, USB sticks), external HDDs, MP3/MP4 players, digital cameras,
memory cards (SD cards, Sony Memory Stick, MultiMedia Cards etc.), some mobile phones, some GPS navigation devices etc.
Okay that’s helped a bit. Avast still deletes the restored exes after I try and run them. I appreciate the help. I don’t know what the nest step is to get Avast to allow the files to run.
Disable Avast while the files are being restored.
After that set the files to exclusions.
Home Screen>Settings>Global Exclusions
I have some older backups. I don’t know what is in the folders. Win32-Evo-gen [susp]
did you follow argus advice above?
If you can explain to me why I would use 3rd party software to control my AV then I’m all ears. The idea that such a thing is possible casts extreme doubts on the reliability of the AV in question. I’m generally quite a trusting person (perhaps to my own peril), so naturally I did not try to override Avast using 3PS. If I were to attempt such a thing, it woulld be a very last resort and, I would feel uncomfortable with such experiments.
I am not into looking for exploits in AV software. I have better things to spend my time on.
Perhaps I’m wrong to take issue with this, but as I said I would only use 3rd party software as a last resort. It would of course be the ultimate in bad publicity for Avast. I think Avast is better than that. It just seems to have lost much of it’s user interactivity over time.
Perhaps I'm wrong
Yes, you 're wrong.
None antivirus will not solve such problems with worms, any AV.
MCShield uses an entirely different method than any AV software, that is why is benefits. MCS only targets worms on USB flash drive, mobile phone or any other memory card.
If you think there is ideal AV , you are very wrong.
The choice is yours, greeting.
It’s the first time I’ve been tipsy for a while (last night when I made the above post). I don’t understand what I need another program for to scan legitimate files. Why am I wrong?
What is wrong is the fact that Avast moves stuff to its virus chest without first asking. What’s wrong is I have to come to a forum to get help to recover my work. What’s wrong is that Avast is behaving like a virus.
I’ve had some problems with Avast, but it’s been a good AV over the years. Why I can’t just give it the hash of my PE apps that I want it to ignore I don’t know. As soon as I move a file it get’s flagged again. That doesn’t make sense to me.
I do not know that the infection comes.
It’s okay. I do appreciate the help. This is a false positive problem, and a user interaction issue. It’s actually quite a major problem which really needs to be addressed. I have been totally prevented from downloading files on some occasions. Now that’s a problem. What if I needed those files for something important?
At the moment I do not feel confident enough to download the latest release of Avast. I would like some feedback from the dev team. I would like to know answers to the questions I asked about not being able to move my files around without first having to disable Avast. Why does a new installation not remember my preferences? Most importantly why using a hash like SHA-1 can’t be employed so as not to forget which files have been added to exclusions?
I want to distribute some of my programs, but things like this prevent me from doing so. I do not want to start suggesting people disable their AV in order to run my programs, which are all portable applications BTW.
I don’t think I’m being unreasonable.
Steven Winderlich, thank you for your help. This morning I have followed your instructions for one or two files and it worked. It’s going to take me a while to fix this problem.
I would like to say that the method isn’t exactly intuitive and most people would not be able to figure this out by themselves (I certainly couldn’t). When browsing for files to exclude I only saw folders in the treeview. I had to type the full path into the input. I fear this work will need to be done again every time I update Avast, and every time I transfer my files. There must be a better solution than this.
When I got the message saying the files had been removed, the exclude option did not seem to register my mouse clicks. win xp sp3
Actually this only partly solves my problem. I need to disable avast to be able to move my files.
if and when you have the time, take a look at this topic … http://forum.avast.com/index.php?topic=104046.0
especially the posts by dr_bora the creator of MCShield. he explains all the how/why
Pondus, this isn’t about USB protection. I am unable to copy and paste my files into another folder on the same drive, even though they are in the exclusions list. What use is that?
You have an infected USB drive and the files too. You need to follow argus instructions and apply MCShield. Do not believe any of us ? See this topic which is very similar with your case:
http://forum.avast.com/index.php?topic=134661.msg988250#msg988250
I understand how much you love and want to protect the reputation of your favourite antivirus program, but what you are suggesting simply doesn’t add up.
Firstly: If you were to make a virus yourself, would you really be inclined to only infect portable executables, not yet added to an antivirus exclusions list, and which are packed in UPX? These files would be considered suspicious anyway, so your program would be a totally stupid and amateur virus right?
Secondly I decided to test your hypothesis by downloading a clean file I which uploaded in March (the memory stick had not even been purchased at this point in time). The download was blocked by Avast even though the file is zipped. After disabling Avast and downloading the file I checked that the hash of the zip file had not changed since the file’s creation. The program is as yet unfinished. Link below.
http://www.czardas.co.uk/downloads/AutoMathEdit.zip
The SHA-1 of the file is 961D82B3A6A13868731DEF1018C7507CA454C9B2
More information about the file can be found here: http://www.autoitscript.com/forum/topic/142184-automathedit/#entry1062579
So while I appreciate your efforts, I’m pretty certain this is a problem with Avast and not with the memory stick, although this does not preclude the small possibility that the stick may contain infected files.
So while I appreciate your efforts, I'm pretty certain this is a problem with Avast and not with the memory stick, although this does not preclude the small possibility that the stick may contain infected files.so why not rule out that small possibility .... it cant hurt ... or ?
and then you can say … what did i tell ya ;D
Oh don’t worry, I intend to scan the drive when my computer starts to behave properly. It does so when I disable Avast, but that leaves me vunerable. I’m still uncertain what to do about this. I was going to sort through and archive many documents sitting in my main projects folder. This is a job which will take several days. I may simply have to disable Avast for that period. I could then try the latest program update once I can guarantee the safety of my data.
I do not consider myself an inexperienced PC user and I’m somewhat disappointed that I cannot control my antivirus program. I do not agree with suggestions in other threads that people are too stupid to make their own choices about what to allow and what to block. Taking control over the operation of someone else’s machine is something I would class as a virus. I believe the problems to be partly bug related, however the default automatic quarantine policy without asking is turning Avast into something as unpleasant to use as Norton.
Is anyone using Avast able to download the file linked to above? Of course I took the effort to scan this file using Virus Total shortly after it had been uploaded. For anyone who doesn’t trust the link. See below, or test it for yourself: