Avast marked most startup apps as FileRepMalware and moved them to chest...

Avast Free Antivirus / Premium Security
1

I am really disappointed. I don’t care if you messed something up. I’ve been using your software for years without any problems, until yesterday when I powered off my PC in a good shape.
I powered it on today and noticed no startup apps launched apart from the bluetooth driver an o&o defrag window which said it had to repair itself (first bad sign). I just reset the PC hoping it was a temporary memory problem or something, but the issue persisted after the reboot.
I was looking at system logs and trying to find the issue, when avast popup appeared telling me that a file has just been quarantined because it’s a virus! FileRepMalware, that’s a virus’ name. Wait what? That file couldn’t be a virus or malware, because it was O&O Defrag’s updater that just repaired itself a few minutes ago…

I am attaching the opened quarantine (and actions’ log a few posts below) window that I saw after I restored all the files and SCANNED them manually… It says --no-virus-- now, but earlier EVERY one of those files said FileRepMalware.
I disabled reputation services in options, no more popups about files being infected/FileRepMalwared (and there were a few more added before I disabled it)
And that would be OK if I could just disable it, restore quarantined files and carry on. The thing is, I can’t because your stupid app REMOVED all startup entries connected to those startup apps it quarantined!

I am furious and really disappointed in avast right now. One boot, Internet connection, and because of your app, I have to restore every single app by hand. It didn’t even ask me or show any notifications if I wanted those files quarantined, it just did it. I am awaiting your response on this subject.

System: Windows 7 Pro x64
Avast version: 8.0.1497
Virus database: 130911-1

If you need any more data, please feel free to ask.

UPDATE: It also seems that your antivirus happily deleted (not just moved to chest) other apps’ executables such as Truecrypt’s. Thanks avast! Now I have even more apps to reinstall.

2
I am furious and really disappointed in avast right now. One boot, Internet connection, and because of your app, I will have to restore every single app by hand. [b]It didn't even ask me if I wanted those files quarantined, it just did it.[/b] I am awaiting your response on this subject.
have you selecte [b]ask[/b] under action settings?

some info …http://forum.avast.com/index.php?topic=124265.0

3

No, I have it on default quarantine move to chest-remove. Why would I change default options if they never failed me before? I haven’t changed that action since I never imagined avast would do such tricks to me.

I finally found avast actions’ log and I am attaching it to this post. It messed up my PC pretty hard. Every action is from today’s firstboot (around 1 hour 7 minutes from posting this post)

The best part is now I really have to reinstall these apps, because removed files were deleted for good

Avast should think before publishing such stupid settings. If file’s rep is FileRepMalware, why does it count as a virus? Of course the default action for a VIRUS it to QUARANTINE and DELETE it. But what if your stupid reputation service goes crazy like now? I am sure I’m not the only one affected because that would be too ironic.

The post/topic you linked above is a similar case, but mine is a global one since it affected my whole system. The topic also doesn’t provide any solution.

I am actually very relieved my second drive is encrypted and I have to mount it manually. I can’t imagine what would happen if it started scanning it…

4

hi dark_skeleton,

Really sorry you’ve gone through this.

Although it is late on this, reviewing your file shield setting seems to be in order, so as to prevent a repeat of this issue in the future.

Please note the settings in File System Shield below for all three categories: To get to these settings, do the following:

Avast! Program GUI>Security>Summary>Current Status>double-click File System Shield.

THEN: >Click Settings upper right>navigate to Actions area and change as appropriate and report back.

I’ve read your new reply just made now, and agree with you here. Seems the default is to quarantine first, so… Ask first would seem to be the safest option, then move to quarantine would be second, so I’ve taken the trouble to outline where these settings are.

[EDIT:] Setting to ask would not be a setting for the average user, which is why the default is likely set to quarantine first.

5

Thanks for answering, it’s actually pretty unsafe that defaults for Virus are chest-remove and for pup/suspicious are ask-remove. It’s a pretty invasive setting, but I guess it’s ok for normal users (assuming all your services are working properly). I never cared much because I rarely had any viruses and actually didn’t mind them being quarantined quickly.

What I’m asking is please verify if your reputation service is working properly. I am afraid to turn it back on because of what just happened and I’m actually thinking I might never turn it on again.

Because of it I will have to slowly restore my PC to it’s previous state (I have the Windows system restore feature disabled since I’m running on an SSD)

6

FilerepMalware is a cloud avast backend technology.It works in run time and not while on demand scanning.

Send the file quarantined by avast to virus@avast.com with subject false positive.

FilerepMalware is the similarity search engine.Interesting that its detecting those files as similar to some family of malware :o

7

True. While the system is booting up, the files run would be scanned by File System Shield, so is possible changing settings in File System Shield from automatically quarantining in this case to ask, in this case, would allow some control over an erroneous vps in place or file rep issue that somehow manifested itself here. That is all we are after here. These changes in settings are not for the average user, as most would not know how to answer and choose the right choice in action.

To summarise, normal actions are as follows: Quarantine, then delete. Deletion is to be avoided if at all possible, as once that is done, the file is gone forever. Repair only works on normal files that are infected with a virus.

Repair cannot work on trojans or worms as the entire file is an infectious agent, so there is nothing to repair. A virus infection is the result of a normal file having a part of its’ code overwritten or changed to suit the intended actions of the virus code, so removing the virus code will, in most cases, clean the infected file. A windows system file can be controlled/renamed by a trojan, and deleting a needed system file will wreck havoc on a system to the point where it may not boot again. So, deleting is the very last resort, and is best reserved to remove known trojans or worms. An infected system file can always be replaced by a known clean copy.

8

Well, I have finally restored my PC to the previous state (mostly). I don’t really care about background tasks like Java updates or Adobe stuff so I haven’t reinstalled them. The rest required me to repair using installers, reinstall over existing installations or uninstall and reinstall apps. Some required me to manually re-add startup entries, especially “scheduled tasks” and some to enter their settings, disable autostart, accept, re-enable autostart, accept. I also had to download over 1GB of installers. On the bright side, thanks to logging I knew exactly which apps were damaged. 3 hours of work that could’ve been avoided…

Especially that those files have absolutely nothing in common. Really, do you want me to send all these files to that address?
Files got removed without my approval, as you said, in run time. That wasn’t on-demand scanning.

There has been a VPS update today not long ago, so I hope I won’t have such surprises anymore, ever. I have changed settings to Ask and re-enabled reputation services for now. I also have to do the same on my second PC.

Thank your for your time and explanations, it seems like software is alive and making its own decisions, huh

9

Because of this horror story, I’ve changed Action’s settings in File System Shield.

10

Glad to help. As for the files lacking commonality, they are all common driver/system files, albeit from different programs.

Sorry this happened to you. You might want to consider installing a disk imaging programs for situations such as this to be able to recover in minutes instead of hours. A restored image will revert all settings, and include the last known good vps version taken at the time of the image, back to a running system exactly the way it was at the time that snapshot was taken. You then can skip the known bad vps, if indeed that was the cause and move on.

11

I’‘ve had enough of this. I have just booted my PC today and this again.
I had everything set on Ask as suggested, but it only asked one question and there wasn’t even an option to take no action. It still quarantined all my files… WTF?!
I did a full scan yesterday, Avast found nothing, just a few wannabe-PUPs which weren’t PUPs (I manually enabled searching for PUPs).
Of course, all chested files’ startup entries have been removed, too.

From what I’ve noticed, it only happens on first boot of the day (?)

I DEMAND EXPLANATION and uninstalled your antivirus. This went too far.

EDIT: removed caps and cursing because I felt bad about it and I know it’s not your fault… I’m still enraged though

12

This is indeed a horror story. I also disagree that average users should be considered that stupid that they can’t answer the question ‘Do you want Avast to automatically block this potential threat?’ YES, NO or DON’T KNOW

13

Removed due to incorrect location for feedback. Sincere apologies.

14

I went into my Avast settings yesterday and changed all of them to Ask First. The first time Avast deletes anything on my system without asking me it is gone. No looking back. I do know what I am doing. Avast needs to change the default back to Ask.

15

Well I just added these rules and I still can not download my own program from my own website. I have no choice other than to disable Avast. The program seems to be broken. This is a potentially dangerous action I’m about to take. Running an unprotected machine is not only dangerous for the person who uses it. I always had a fondness for Avast but I can no longer recommend it as I have often done in the past. I still would like Avast to be great again, like it used to be. The program is now too complicated for advanced users to use.

16

I agree.

17

Dark_skeleton surely must be infected with something and that is why its triggering avast detections still.

But guess what,when protection improvements like evo-gen,filerepmalware are not made there will be many people and even some among here saying “hey avast sucks its protection sucks the program is sh*t”

and when avast tries to make things better and problems come by people start complaining.All is made by human,mistakes will be there,dont expect everything to be 100%.There has been no reports about this filerepmalware alarm from anybody else and that means there is something wrong with the OP’s machine.

Instead of simply complaining,try and help to make things better.Report undetected viruses and false positives to virus@avast.com and besides how cheap people can be when they are getting such great protection improvements for free? ::slight_smile:

And then again trolls and mad people will come here ragging about avast and say that they will never recommend it again without explaining their problems or try to make a effort to get it resolved they keep talking in a negative tone.

If people cant understand that things will keep going up and down we all have to put up and try to resolve individual problems which may or may not be strictly caused by avast.

I am leaving my words here in a effort to make people realize that nothing is 100% and everything is human made.Avast developers also do hard work and they also need rest.NONE OF US ARE GOD.

If this topic continues in a negative tone and none of the people over here want to get things resolved and dont want cooperate in improving things and resolving issues.I would suggest a topic lockout.

Without you people’s help,cooperation nothing is possible.Please understand the reality.DO NOT expect big changes to happen without any interaction.

So again,dont cooperate,dont take efforts and rant about avast and their company will not take you anywhere.Instead dont use AV software and then get frustrated with viruses.People dont want to make different topics in this forum to get help,they dont want to make things better and help avast team,they want to rant about avast.Bash it like no one’s business.

Sorry if this sounds rude but polite tone doesnt seem to be working with you guys.

18

No need to apologise mate. That was a great post, and that’s the great thing about free speech. We can all share our thoughts and suggestions - within reason and in a civil manner of course! :slight_smile:

I guess this is not the right place for constructive feedback. Sincere apologies, True Indian.

19

I don’t understand why Avast is misbehaving right now. I’m going to start relying more on hashing files myself to check their integrity. At least that way I can be pretty certain if an infection has occured in one of my own projects. Avast doesn’t seem to do this for excuded files, so they simply cannot be organized into folders without getting deleted. This is a bit of a mystery to me. Using heuristics is fine, but deleting people’s work and installing 3rd party software without a warning is nothing less than viral activity. There’s no getting away from the fact.

20

czardes,if you have done with your non-helpful rants,take the pain of sending the flagged files to virus@avast.com for analysis so the virus lab can fix the false positives. :slight_smile:

What 3rd party software?? mcshield!? well,you know what that is a cleansing tool something that normal AV’s cant do.If you cant follow simple suggestions its your problem not ours and besides at some point you will get tired and stop your rants instead of following advice given to you.