Can't turn off false alarms in Avast Free

[system]

I have backed up on servers the file appended below, it’s an AUTOEXEC.BAT off an old W9x Installation floppy, and is completely harmless. It is, I grant, not a showstopper to have this historical file causing false alarms, but I really don’t see why I should have to delete it just because Avast can’t cope with it. What if Avast starts falsely reporting a file that IS important?

I am particularly annoyed that:

The file was deleted off all the servers and moved into the vault without my being prompted to allow it, and there doesn’t seem to be a setting to force prompting beforehand. Nor, when restoring the file from the vault, is there a setting to clear the file, so sooner or later it is just re-imprisoned.

There is no other mechanism (that actually seems to work) to tell the program that this file is harmless.

The program ignores the exclusion settings telling it to leave all files in the Boot Disks directory alone. I’ve set exclusions for the parent directory (including the trailing /*) in both the program settings and the file system shield settings, but these appear to being ignored. The file is still being moved to vault at every attempt to access it, and I still get a Malware Blocked message.

So I have had no choice but disable the file-system shield altogether.

AUTOEXEC.BAT

@ECHO OFF
PATH=A:\

IF %config%==IBM600 GOTO quit
IF %config%==Emergency GOTO quit

ECHO.

IF NOT EXIST A:\NET.EXE GOTO no_net
IF NOT EXIST A:\SYSTEM.DAT GOTO no_reg
CALL A:\STARTNET.BAT
IF ERRORLEVEL 1 GOTO quit
:no_net

ECHO ******************************************************************************
ECHO This computer is Charles_%this%
ECHO ******************************************************************************

IF EXIST C:\NUL GOTO no_fdisk
ECHO NB: No C: drive appears to exist on this PC!
CHOICE /C:YN /T:Y,10 /N "Do you wish to run FDISK [Y,N] ? "
IF ERRORLEVEL 2 GOTO quit
FDISK
CLS
ECHO ******************************************************************************
ECHO This computer is Charles_%this%
ECHO ******************************************************************************
:no_fdisk

IF NOT EXIST C:\REBOOT.FLG GOTO no_cycle
ECHO.
ECHO WARNING - SETUP flag file found!
ECHO --------------------------------
ECHO Perhaps SETUP has rebooted the PC with this setup floppy still in the drive …
ECHO.
CHOICE /C:YN /N "About to reinstall Windows! Do you really wish to continue [Y,N] ? "
ECHO ******************************************************************************
IF ERRORLEVEL 2 GOTO quit
:no_cycle

IF NOT EXIST C:\CONFIG.SYS GOTO no_old_os
ECHO NB: A previous operating system probably exists on this PC!
CHOICE /C:YN /T:Y,10 /N "Do you want to reformat the hard disk [Y,N] ? "
IF ERRORLEVEL 2 GOTO no_format
ECHO Y | FORMAT C: /Q /S /V:WINDOWS
:no_format
ECHO ******************************************************************************
:no_old_os

ECHO If you wish to run Windows Setup off CD, place the CD in the drive now,
ECHO and let it register.
ECHO.
CHOICE /C:YN /T:Y,5 /N "Do wish to run Windows Setup [Y,N]? "
ECHO ******************************************************************************
IF ERRORLEVEL 2 GOTO quit

CALL SETUP.BAT
GOTO quit

:no_reg
ECHO ERROR - No registry file SYSTEM.DAT exists on this floppy
ECHO.

:quit
ECHO.

[Pondus]

have you tested the file at www.virustotal.com ?
if so post the scan link here for us to see

you can report False Positive here http://www.avast.com/contact-form.php

[Milos]

Hello,
it is because of line “ECHO Y | FORMAT C: /Q /S /V:WINDOWS”.

@CharlesHarrison post:1

The file was deleted off all the servers and moved into the vault without my being prompted to allow it, and there doesn’t seem to be a setting to force prompting beforehand. Nor, when restoring the file from the vault, is there a setting to clear the file, so sooner or later it is just re-imprisoned.

This behavior can be set in settings.

@CharlesHarrison post:1

There is no other mechanism (that actually seems to work) to tell the program that this file is harmless.

There are exclusions in each shield.

@CharlesHarrison post:1

The program ignores the exclusion settings telling it to leave all files in the Boot Disks directory alone. I’ve set exclusions for the parent directory (including the trailing /*) in both the program settings and the file system shield settings, but these appear to being ignored. The file is still being moved to vault at every attempt to access it, and I still get a Malware Blocked message.

Maybe you set exlusions for custom scans, not in the shield settings.

Milos

[system]

@Milos post:3

it is because of line “ECHO Y | FORMAT C: /Q /S /V:WINDOWS”.

Thanks. But noone’s going to run that file now, and I doubt it would work on NTFS-based systems anyway.

@Milos post:3

@CharlesHarrison post:1

The file was deleted off all the servers and moved into the vault without my being prompted to allow it, and there doesn’t seem to be a setting to force prompting beforehand. Nor, when restoring the file from the vault, is there a setting to clear the file, so sooner or later it is just re-imprisoned.

This behavior can be set in settings.

I’ve not been able to find it. Please can you explain where.

@Milos post:3

@CharlesHarrison post:1

There is no other mechanism (that actually seems to work) to tell the program that this file is harmless.

There are exclusions in each shield.

But, as I said originally, they are ignored.

@Milos post:3

@CharlesHarrison post:1

The program ignores the exclusion settings telling it to leave all files in the Boot Disks directory alone. I’ve set exclusions for the parent directory (including the trailing /*) in both the program settings and the file system shield settings, but these appear to being ignored. The file is still being moved to vault at every attempt to access it, and I still get a Malware Blocked message.

Maybe you set exlusions for custom scans, not in the shield settings.

I’ve set them in both the global Program Settings and in the File System Shield settings, but the files are still being deleted, and I still get Malware Blocked messages, without being offered any alternative choice, such as telling Avast that it’s making an ass of itself and to leave the files alone.

Now that we suspect the Format command, I wonder if I ought to just rename the files to something like AUTOEXEC.BAT.NOT, perhaps permanently, but at least until Avast sorts itself out.

[system]

@Pondus post:2

you can report False Positive here http://www.avast.com/contact-form.php

Thanks, done.

[system]

@CharlesHarrison post:4

Now that we suspect the Format command, I wonder if I ought to just rename the files to something like AUTOEXEC.BAT.NOT, perhaps permanently, but at least until Avast sorts itself out.

I tried renaming the files to AUTOEXEC.BAT.false positive and re-enabling the shield, but it still didn’t get the hint, and put them into the vault.

Rrrrrrrrrrrrrrrrrrrrrrrrrrrrr!

[Milos]

@CharlesHarrison post:6

@CharlesHarrison post:4

Now that we suspect the Format command, I wonder if I ought to just rename the files to something like AUTOEXEC.BAT.NOT, perhaps permanently, but at least until Avast sorts itself out.

I tried renaming the files to AUTOEXEC.BAT.false positive and re-enabling the shield, but it still didn’t get the hint, and put them into the vault.

Rrrrrrrrrrrrrrrrrrrrrrrrrrrrr!

Which shield does it detect? FileSystem or Webshileld or Network, …?

Milos

[system]

@Milos post:7

Which shield does it detect? FileSystem or Webshileld or Network, …?

It’s the File System Shield that’s the problem. It doesn’t seem to obey its own exclusion lists. I’ve had to disable it again.