Avast Home edition is identifying several files as viruses that are not. This is causing the complete shutdown of the internet connection. The files are lspcs.dll winsock.dll, wsock32.dll, and kernal32.dll.
So how do I find the exclusions list so I can add these files to the list? I have looked everywhere and cannot find it.
Where are you seeing these files? Into Chest? Aren’t some of them into the System folder (so they’re just clean backups…)?
Searching the board for Exclusion Lists (or help files):
For the Standard Shield provider (on-access scanning):
Left click the ‘a’ blue icon, click on the provider icon at left and then Customize.
Go to Advanced tab and click on Add button…
For the other providers (on-demmand scanning):
Right click the ‘a’ blue icon, click Program Settings.
Go to Exclusions tab and click on Add button…
You can use wildcards like * and ?.
But be carefull, you should ‘exclude’ that many files that let your system in danger.
After running a winsockfix utility, restoring the lspcs.dll from the virus chest and adding the lspcs.dll to the exclusion lists on both the resident and on-demand Avast scanners I again have access to the internet after 3 days!!!
Just to be sure, please submit the file to JOTTI or VirusTotal and let us know the result. If it is indeed a false positive, send it in a password protected zip to virus@avast.com
Please, mention in the body of the message why you think it is a false positive and the password used. Maybe a link to this thread too
I checked the lspcs.dll on VirusTotal and most apps did not find a virus. I have emailed the results to virus@avast.com. I tried to zip the lspcs.dll and send it to you but winzip would not zip it, or at least the zip file ended up with 0 bytes.
Because it is in the chest, a protected area, avast won’t let anything work in that area to protect you. That is why you get a 0KB file size. You can send it from the chest (otherwise you need to restore the file to its original location or a temp location), right click on it and select Send to Alwil software.
They will normally only contact you if they need any more information.
If it is found to be an FP then the VPS will be updated so it isn’t detected in future, so you should periodically check it (scan it in the chest), there should still be a copy in the chest even though you restored it to the original location. If it is no longer detected then you can remove the exclusions you made.