False positives/behavior shield wrecked windows install

Not here to bash but to actually try to help make Avast better. Long time user and it has saved me enough to know it can work.

I wish I could supply more detailed information, but I had to restore the windows 10 machine that was wrecked from a disk image, I could not boot to it again. So I cannot supply you with lists of files or logs.

Fortunately I know exactly what did it…

I had just installed the cygwin64 X server and was running it for the first time. It came up, and got stuck. I went to start a mintty shell, and the mintty executable had been deleted. I found a whole bunch of cygwin64 executables had been deleted. I didn’t know it at the time, but so had a bunch of Windows 10 files. I eventually tired to restart, and could not get that windows install going again. Recovery console was no help.

When I reimaged, I installed cygwin64 again without the X server. This time I just ran ssh.exe (with the -L option to tunnel a port) and Avast went and deleted a whole bunch of cygwin64 executables again, including ssh.exe and mintty.exe. It only mentioned ssh.exe in the quarantine, though, despite deleting many more. This time it did not kill windows, thankfully. I disabled the behavior shield, reinstalled cygwin64, and now everything is fine.

I suggest an assessment of behavior shield. I added my Cygwin directory to execptions but I am going to run with it disabled for a good long while to be safe.

Please tell me what I need to do to get this attention. I am a computer professional and know what I am doing. This problem is 100% reproducible and it will wreck the Windows 10 install or the Cygwin install without even recording what files it is deleting. Why someone from Avast is not installing cygwin64 right now to see this happen for themselves is beyond me.

My experience was very similar to this thread:

https://forum.avast.com/index.php?topic=203582.0

No one has asked me for logs from the second install when it deleted ssh.exe and a bunch of other perfectly fine programs. Does anyone care it does this?

Who says they aren’t ?
If you want avast to know about this, best is to contact them.
https://www.avast.com/bug-bounty