Avast! Free ~ Actions?

system · 2015-09-16T23:14:36.000Z

I have set the ‘Actions’ in the customise behaviour to ‘Ask’ when any suspected malware is detected. Yet when I tried to implement this behaviour when Avast! Free discovered an almost certain false positive in the FotoSketcher 3:20 file application it quarantined the suspicious file anyway.

http://i386.photobucket.com/albums/oo307/Davebucket17/Avast%20Actions_zpssfwbneco.jpg

What setting should I have it on to prevent Avast! automatically quarantining files it suspects are malware? Does this feature even actually work in Avast! Free?

DavidR · 2015-09-17T13:42:28.000Z

Did you set all three tabs to Ask ?

If not then what was detected most likely wasn’t a virus but a PUP or Suspicious as you mention.

system · 2015-09-17T16:12:01.000Z

Yes, all three were set to ‘ask’. It was identified as a trojan, which I didn’t think described a potentially unwanted program. I’m pretty sure trojans are suspicious in any shape or form. What I can’t understand is why the drop-down menu on the alerting pop-up was totally unresponsive. If I have options shouldn’t I be able to choose them? Is this a known bug?

DavidR · 2015-09-17T16:20:26.000Z

A copy of the alert image would help if you can replicate it ?

The reason I ask is that not all alerts have a drop-down function, that is the purpose of those three tabs are for. If you select Ask as the first option the next will default to No Action.

I suspect this could be either DeepScreen or Hardened Mode if you have those enabled.

system · 2015-09-17T16:47:03.000Z

I doubt I could replicate the alert pop-up. This alert gave me a drop-down function. I selected ‘No Action’ IIRC but there was no response. I uninstalled FotoSketcher program (which prompted the now definitely recognised and proved false positive as communicated to me by Avast! Customer and Technical Support) and tried to reinstall it. Exactly the same thing happened. I should be able to tell Avast! to ignore a false positive/suspect file according to the customisation options. But I couldn’t. I don’t have Hardened Mode enabled and there was no mention of Deep Screen on the pop-up.

DavidR · 2015-09-17T17:55:49.000Z

Selecting no action only does that, take none of the possible actions. This will/should leave the file in place, but what it won’t let you do is run it. After a reboot if you tried to run it again you would get the alert again.

For many years avast has taken the decision not to have a single click option to ignore/exclude/allow to run for obvious reasons. If it was a good detection, then a single click (accidental or otherwise) could have serious consequences, for the user who might just blame avast for it.

I don’t know if the DeepScreen popup is specifically branded as such. But if I recall it does say it is running a DeepScreen check and it may take a few seconds.

system · 2015-09-17T18:31:33.000Z

DavidR post:6:

Selecting no action only does that, take none of the possible actions. This will/should leave the file in place, but what it won’t let you do is run it. After a reboot if you tried to run it again you would get the alert again.

OK, thanks for the clarification, but it actually quarantined it rather than leave it in place.

DavidR post:6:

For many years avast has taken the decision not to have a single click option to ignore/exclude/allow to run for obvious reasons. If it was a good detection, then a single click (accidental or otherwise) could have serious consequences, for the user who might just blame avast for it.

I can understand the reasoning behind the policy, sort of, but it is disconcerting to think that the end user can’t be trusted by Avast! to make decisions about what runs or what goes to quarantine. If it had been an essential systems driver instead of a third party application program I’d probably be typing this on my Ubuntu laptop now. In my experience most ‘malware’ flagged by anti-malware or AV’s are false positives. I know they are inevitable in any AV program but there needs to be some safeguards. In Panda Free 2015 there was a choice to uncheck the default auto-quarantining of possible malware. This ability saved millions, including myself, from a severely borked computer during the recent great Panda borking event caused by a bad update signature. The ultimate irony here is that I changed my Win 7 desktop to Avast!, as I had had good experiences with it before on my Vista laptop, and because Panda Free 2016 did exactly the same thing with FotoSketcher a few weeks ago on the Win 7 machine! It was a false positive then as well. I thought I would have more control with Avast! Free.

DavidR post:6:

I don’t know if the DeepScreen popup is specifically branded as such. But if I recall it does say it is running a DeepScreen check and it may take a few seconds.

I’ve seen DeepScreen pop-ups and it definitely wasn’t one of those.

bob3160 · 2015-09-17T19:03:27.000Z

If users could be trusted to only install safe programs and only visit “safe sites”,
then they wouldn’t need any protection at all.
Even the advanced user can be fooled into visiting an unsafe site and downloading unsafe material.
Hence, if it’s not deemed safe, it winds up in the Virus Chest not your computer.
From there it can always be restored if Avast made a mistake.

system · 2015-09-17T19:36:08.000Z

bob3160 post:8:

If users could be trusted to only install safe programs and only visit “safe sites”,
then they wouldn’t need any protection at all.
Even the advanced user can be fooled into visiting an unsafe site and downloading unsafe material.
Hence, if it’s not deemed safe, it winds up in the Virus Chest not your computer.
From there it can always be restored if Avast made a mistake.

Yeah, but bob, Avast! quarantined a running application program I have been using malware-free for years. This wasn’t a case of visiting an unsafe site or downloading an unsafe installer. I scan all downloads as a matter of fact. There should be a way for the end user to have some control over what happens to currently running application programs on their own computers. Besides, it wouldn’t restore the quarantined file from Virus Chest anyway. Otherwise why give the illusion of choice of action in the AV GUI?

I’ve never regretted buying a laptop preinstalled with Ubuntu as I never have to worry about an AV program going all HAL 9000 or trying to eat itself.

bob3160 · 2015-09-17T19:53:15.000Z

“Besides, it wouldn’t restore the quarantined file from Virus Chest anyway.”
It would after it was sent to Avast for analysis and deemed to be safe.

system · 2015-09-17T20:03:25.000Z

bob3160 post:10:

“Besides, it wouldn’t restore the quarantined file from Virus Chest anyway.”
It would after it was sent to Avast for analysis and deemed to be safe.

I don’t doubt it. That’s not the point though, Avast! shouldn’t have quarantined a file from a running program it previously considered safe in the first place. I should have the ability to override the decision at the time. This can actually be achieved with other AV’s. So why not Avast!?

bob3160 · 2015-09-17T20:53:51.000Z

daveweb post:11:

bob3160 post:10:

“Besides, it wouldn’t restore the quarantined file from Virus Chest anyway.”
It would after it was sent to Avast for analysis and deemed to be safe.

I don’t doubt it. That’s not the point though, Avast! shouldn’t have quarantined a file from a running program it previously considered safe in the first place. I should have the ability to override the decision at the time. This can actually be achieved with other AV’s. So why not Avast!?

As DavidR already explained, the decision from Avast was not to allow overrides on a detected infection. Avast makes the final decision.
If that’s not acceptable, your only choice (if you don’t have the patience to wait for a check on this program from the virus lab) is to fire Avast.

DavidR · 2015-09-17T21:10:07.000Z

bob3160 post:10:

“Besides, it wouldn’t restore the quarantined file from Virus Chest anyway.”
It would after it was sent to Avast for analysis and deemed to be safe.

There is a function in the virus chest options to ‘Restore and add to exclusions’ which was added in the not to distant past. So at least you have a way back, that isn’t a single click on the alert window, this is a deliberate act, not something that could be accidental.

system · 2015-09-17T21:13:34.000Z

bob3160 post:12:

If that’s not acceptable, your only choice (if you don’t have the patience to wait for a check on this program from the virus lab) …

And as I stated earlier bob, this isn’t about patience, stoicism or equanimity, and it’s fine if it’s just some third party application program, but if it isn’t it means that I, as an end user could be left with a potentially unbootable computer whose future would basically be to be employed as a giant paperweight.

bob3160 post:12:

… is to fire Avast.

This is probably the most sensible advice you’ve ever given me bob.

system · 2015-09-17T21:15:09.000Z

DavidR post:13:

bob3160 post:10:

“Besides, it wouldn’t restore the quarantined file from Virus Chest anyway.”
It would after it was sent to Avast for analysis and deemed to be safe.

There is a function in the virus chest options to ‘Restore and add to exclusions’ which was added in the not to distant past. So at least you have a way back, that isn’t a single click on the alert window, this is a deliberate act, not something that could be accidental.

I tried the ‘Restore and add to exclusions’ option both times and nothing happened.

bob3160 · 2015-09-17T21:18:45.000Z

At this point, the only ones that can add anything to this topic would be Avast.

DavidR · 2015-09-17T21:26:00.000Z

daveweb post:15:

DavidR post:13:

bob3160 post:10:

“Besides, it wouldn’t restore the quarantined file from Virus Chest anyway.”
It would after it was sent to Avast for analysis and deemed to be safe.

There is a function in the virus chest options to ‘Restore and add to exclusions’ which was added in the not to distant past. So at least you have a way back, that isn’t a single click on the alert window, this is a deliberate act, not something that could be accidental.

I tried the ‘Restore and add to exclusions’ option both times and nothing happened.

I believe you have other things going on with your installation (given the other point you raised) as only a day ago I did just that, when one of my little utilities was picked up as a PUP on an on-demand scan. I let it be sent to the chest to test this very function, not only was it restored the exclusion was added to the avastUI > Settings > General - expand the Exclusions - File paths tab .

system · 2015-09-17T21:51:11.000Z

DavidR post:17:

daveweb post:15:

DavidR post:13:

bob3160 post:10:

“Besides, it wouldn’t restore the quarantined file from Virus Chest anyway.”
It would after it was sent to Avast for analysis and deemed to be safe.

There is a function in the virus chest options to ‘Restore and add to exclusions’ which was added in the not to distant past. So at least you have a way back, that isn’t a single click on the alert window, this is a deliberate act, not something that could be accidental.

I tried the ‘Restore and add to exclusions’ option both times and nothing happened.

I believe you have other things going on with your installation (given the other point you raised) as only a day ago I did just that, when one of my little utilities was picked up as a PUP on an on-demand scan. I let it be sent to the chest to test this very function, not only was it restored the exclusion was added to the avastUI > Settings > General - expand the Exclusions - File paths tab .

It’s a good possibility that there is something wrong with the install, but everything seemed fine. I did have a very minimal custom install, but I only unchecked the bundled applications I didn’t want or need. It worked perfectly well in every other respect.

DavidR · 2015-09-17T21:55:17.000Z

I just wonder if it would be worth trying an avast Repair or a clean reinstall.

system · 2015-09-17T22:50:56.000Z

DavidR post:19:

I just wonder if it would be worth trying an avast Repair or a clean reinstall.

I’ve uninstalled Avast! for the meanwhile but I may try that at a later date. I like Avast! but I have to be sure that it won’t brick my computer by automatically quarantining suspected malware without asking me about the decision.

Announcements