Bug Subject : Restoring a file from chest doesnt work.
Environment :
Avast 5.0.507
Win XP3,
CIS 4.0.141842.828 (Firewall & Defense on, Av deactivated), all other anti spy/malware on demand.
Description :
Avast marked hxxp://www.nirsoft.net/utils/asterwin.html as a PUP, tried to restore back from chest, didnt work. The file was not restored.
Or perhaps the file was restored but Avast again identifies it as malware hence back it goes in to the chest (no alert shown though)
I set all my scanner options to ask before taking an action on detection. I don’t want anything being quarantined automatically or even worse, silently. I also would like to see an option to ignore or add to exclusions when something is detected. Why are those options not present?
Your post isn’t related to the problem discussed in this topic, “Restore from chest doesnt work.”
So I suggest that you start your own topic, you have also asked that question in another topic though and one of the Alwil team has answered it, Alwil won’t put a single click option to Ignore (allow to run) or exclude a file it considers infected to prevent the accidental selection by a user.
This makes my post very relevant to the topic. If you set the option to ask, the file will not go back in the chest without an alert. If that is what happened.
Sorry ‘mohan’ is talking about restoring a file that is ‘in the chest’ and here you are trying not to have avast send it to the chest or take any other action.
Setting it to ask, the file is in limbo, neither on your system or in the chest as avast’s web shield has blocked it. When the file we are seeing as reported is a web URL indicating it is a file which was on-line, so there is no way avast could restore a file to an on-line location.
Unfortunately we have had no response from ‘mohan’ to the questions about the files origin, so anything on that point is speculation on all parts. So until that is determined this really can’t progress.
No I was not trying to have the program do anything. He suggested the possibility of the file going back into the chest after being restored and that happening without an alert, thus making it appear that it was never restored. I was just saying that if you have the option set to ask, that can’t happen.
Actions - Viruses, PUP, Suspicious tabs - All options are set to Ask.
The show notification option is checked
Sensitivity is High fr Heuristics and the option for code emulation and scan for PUP is checked.
I have added as exclusions the path where I want to restore them (same path as the location where they were identified)
Am trying to restore them from the chest (using the restore option, have also tried the extract option) but I do not get any notification and neither is the file extracted.
Have also tried using the in built submission mechanism but oddly that too doesn’t work, though have input all data required by the submission dialog.
I think perhaps my options are possibly odd and hence the behavior presented.
Since you are using a slightly older version, try updating avast to version 5.0.594 which is the latest stable release version. This might help the problem.
Am trying to restore them from the chest (using the restore option, have also tried the extract option) but I do not get any notification and neither is the file extracted.
Have added the destination folder to exclusions to be on a safe side. But no luck.
If you didn’t exclude them then avast would alert when you either restore or extract them.
So either you got the exclusion right or the restore or extract didn’t work.
I don’t know which, there is no notification on the restore or extract, you have to check the original location or the extract location you gave to ensure the file has been sent there.
There is always a copy remaining in the chest for safety so you have one copy somewhere (this can be deleted if on successful completion), if this is what you are basing your “But no luck” comment on. You have to check the location you sent it to to ensure it is there.