False Positives

Avast Home edition is identifying several files as viruses that are not. This is causing the complete shutdown of the internet connection. The files are lspcs.dll winsock.dll, wsock32.dll, and kernal32.dll.

So how do I find the exclusions list so I can add these files to the list? I have looked everywhere and cannot find it.

:-X

These files winsock.dll, wsock32.dll, and kernal32.dll are in the System section of the chest and are back-up copies and not infected files.

A forum search for lspcs.dll will return information on this false positive.
http://forum.avast.com/index.php?topic=23415.msg193099#msg193099

Where are you seeing these files? Into Chest? Aren’t some of them into the System folder (so they’re just clean backups…)?

Searching the board for Exclusion Lists (or help files):

For the Standard Shield provider (on-access scanning):
Left click the ‘a’ blue icon, click on the provider icon at left and then Customize.
Go to Advanced tab and click on Add button…

For the other providers (on-demmand scanning):
Right click the ‘a’ blue icon, click Program Settings.
Go to Exclusions tab and click on Add button…

You can use wildcards like * and ?.
But be carefull, you should ‘exclude’ that many files that let your system in danger.

Welcome :wink:

Re: the exclusions list: What do I do once I click on the Add button?

Enter the path to the file that you want to exclude, e.g. C:\Program Files\excluded_folder\lspcs.dll, etc.

Please, keep on the SAME thread… this duplicate the help effort :wink:
Follow: http://forum.avast.com/index.php?topic=23404.msg193412#msg193412

:slight_smile: SUCCESS!!!

After running a winsockfix utility, restoring the lspcs.dll from the virus chest and adding the lspcs.dll to the exclusion lists on both the resident and on-demand Avast scanners I again have access to the internet after 3 days!!!

Just to be sure, please submit the file to JOTTI or VirusTotal and let us know the result. If it is indeed a false positive, send it in a password protected zip to virus@avast.com

Please, mention in the body of the message why you think it is a false positive and the password used. Maybe a link to this thread too :slight_smile:

I checked the lspcs.dll on VirusTotal and most apps did not find a virus. I have emailed the results to virus@avast.com. I tried to zip the lspcs.dll and send it to you but winzip would not zip it, or at least the zip file ended up with 0 bytes.

Because it is in the chest, a protected area, avast won’t let anything work in that area to protect you. That is why you get a 0KB file size. You can send it from the chest (otherwise you need to restore the file to its original location or a temp location), right click on it and select Send to Alwil software.

Last night I emailed the lcpcs.dll file to virus@avast.com. I hope you received it.

I hope they received it as well ;D
The people who have been helping you in this thread are avast users just like yourself.

Thank you for the help. :slight_smile:

Do you know if the Avast folks will let me know what they find regarding the file I sent them?

They will normally only contact you if they need any more information.

If it is found to be an FP then the VPS will be updated so it isn’t detected in future, so you should periodically check it (scan it in the chest), there should still be a copy in the chest even though you restored it to the original location. If it is no longer detected then you can remove the exclusions you made.

All is working well! Thanks to DavidR and the other superusers for all the help.

Your welcome, glad that we could help.