Avast Deleting Executable Even After Excluding It - Edit: It's not Avast

I posted before that I assumed that Avast 7 was deleting the .exe of the game Alliance of Valiant Arms. Well it happened again. The ava.exe of the game went MIA for the 5th time. So I uninstalled Avast 7 and the game launches fine now. I know the .exe is missing
because it’s not there in the game folder. As DavidR suggested I added the path, the folder and the executable in file shield, trusted process in behavioral shield and sandbox but it doesn’t work. Reading the forums of AVA other players are having the
same experience with the missing .exe but with different AVs. It must have something to do with the .exe itself being detected as unsafe.

Is there a way for the Avast team to not have AVast detect/delete the file? I submitted a support ticket but haven’t heard anything from 'em ( I uploaded the necessary log files). Gets tiresome having to keep re-installing the game and downloading all the updates after a few times. I know it’s kinda extreme to uninstall Avast and not have any AV but until it gets fixed I’m browsing via VM.

Been using Avast since v4 and this is the only time I’ve had any issues with Avast. Hope it gets fixed.

If the file is not detected (in which case you would probably notice the popup), then it can’t be deleted - there’s no such code in the program.
Whether the file deletes itself if it detects some kind of interference… well, it might be possible, but I’m afraid it’s up to the game developers to fix it.

Can you upload the file to www.virustotal.com and test with 40+ malware scanners
Wien you have the result copy The link and post it here for us to see

@igor - thanks for the quick reply! now that you mentioned it there must be some sort of system in place in AVA that deletes the .exe if it detects something interfering with it. the game uses gameguard which is an anti-cheat program so it must have
something to do with that. will have to let the developers know about this. and my bad for blaming Avast.

@pondus - will do. at work right now but will upload the ava.exe (18 mb) when i get home later. thanks for the suggestion!

Right after I posted I wiki’d gameguard. it’s an ‘anti-cheating rootkit’. Maybe this might help?

nProtect GameGuard (sometimes called GG) is an anti-cheating rootkit developed by INCA Internet. It is installed alongside many Asian massively multiplayer online roleplaying games (MMORPGs) such as Rohan: Blood Feud, Lineage II, 9Dragons, Cabal Online, Phantasy Star Universe, GunZ: The Duel, Flyff, Rappelz, Luna Online, PangYa, Prius Online, Ragnarok Online and Alliance of Valiant Arms to block malicious applications and common methods of cheating. nProtect GameGuard provides B2B2C (Business to Business to Consumer) security services for online game companies and portal sites.

GameGuard hides the game application process, monitors the entire memory range, terminates applications defined by the game vendor and INCA Internet to be cheats (QIP for example), blocks certain calls to DirectX functions and Windows APIs, keylogs your keyboard input[citation needed], and auto-updates itself to change as new threats surface.

GameGuard possesses a database on game hacks based on security references from more than 260 game clients. Some editions of GameGuard are now bundled with INCA Internet’s Tachyon anti-virus/anti-spyware library, and others with nProtect KeyCrypt, an anti-keylogger software that protects the keyboard input information.
/end wiki

so it’s not avast that deletes it… it’s gameguard! although i would imagine when they say ‘terminate the application’ the process would be stopped, not deleted. well this explains a lot. Time to re-install Avast.

here’s the link to the virustotal results:

https://www.virustotal.com/file/b56f4f668a3a7bcdcd13cabc587c6a0bf55dfc718af2d04d46945dd587055a6c/analysis/1336043146/