FPS - Alliance of Valiant Arms (A.V.A) executable deleted by Avast?

Avast Free Antivirus / Premium Security
1

I downloaded AVA few days ago and was able to play it (I turned off avast temporarily when i unrar’d the file because of Avast’s tendency to scan files as they decompress). Then today I tried launching the game but wasn’t able to because the executable to launch the game ( I think it’s named ava.exe) wasn’t there in the folder. The only difference I could think of was that Avast was on again and maybe it deleted it because it thought it was a virus? i check the virus chest but it didn’t show there. Am I unfairingly blaming Avast? Is there a log file that I can check to see Avast’s activities? Thanks.

  • using latest version of Avast and vir def 120422-1 WinXP Sp3.
2

avast does not automatically delete files, unless u change the default settings, which is potentially dangerous.

are there any pop-ups from avast? it should pop up either a red box (malicious/pup/adware) or blue box (autosandbox for suspicious apps)

3

thanks for your reply. i didn’t change any settings. i checked the action screen and it goes like this:

Select action to be performed when a virus is found

Move to Chest

If Action fails, then

Delete

If action fails, then:

No Action

Are these the default settings?

I did not encounter any popups at all.

4

Well avast doesn’t delete anything by default, either the user changes the default settings or the user selects delete when the alert windows is displayed.

Note, there would generally be something displayed, it wouldn’t be an autonomous deletion and nothing displayed. e.g. if avast though it a virus it would alert.

Disabling avast to unpack archives isn’t advised as that is the very time that it is needed most.

If there are no popups - Check the following report files to see if there are any records of and A.V.A. files listed:
C:\Documents and Settings\All Users\Application Data\AVAST Software\Avast[b]report[/b]\BehaviorShield.txt
and
C:\Documents and Settings\All Users\Application Data\AVAST Software\Avast[b]log[/b]\autosandbox.log

5

Hi David. thanks for the helpful info. the path to the log files on my end is: C:\Documents and Settings\All Users\Application Data\Alwil Software\Avast5\log (is it because I’ve been doing the in-program update as opposed to installing from scratch?).

Here is the info from the autosandbox.log (snipped - it’s the only entry from 4/22/12):

4/22/2012 5:16:06 AM Autosandbox candidate: C:\WINDOWS\system32\GameMon.des
[Source: ]
[Opened by: C:\ijji\ENGLISH\AVA\Binaries\GameGuard\GameMon.des]
[Reason: 0x00010000]
→ Result: Sandboxing (because policy set to Auto).

I did not get the popup to sandbox.

and from the behaviorshield.txt

4/22/2012 5:15:50 AM Modification of: \Device\HarddiskVolume1\WINDOWS\system32\drivers\etc\hosts
By: C:\ijji\ENGLISH\AVA\Binaries\GameGuard.des
Via: C:\ijji\ENGLISH\AVA\Binaries\GameGuard.des
→ Action allowed
4/22/2012 5:16:15 AM Modification of: \REGISTRY\MACHINE\SYSTEM\CurrentControlSet\Services\dump_wmimmc\DisplayName
By: C:\ijji\ENGLISH\AVA\Binaries\GameGuard\GameMon.des
Via: C:\ijji\ENGLISH\AVA\Binaries\GameGuard\GameMon.des
→ Action allowed

Any ideas?

6

  1. Change the AutoSandbox mode to Ask (avastUI, Additional Protection, AutoSandbox, Settings), that will allow you to tell it to Run Normally and check the Remember my answer for this program, for this file. You could also copy and paste the full path to that file in to the exclusions in that same window.

  2. Since the Behavior Shield Allowed it, you shouldn’t have to do anything, however, it might be worth adding both of them to its trusted processes, that way they wouldn’t be checked. The reason I suggest that it that even when allowed by the behavior shield, there would be a slight delay whilst checked and this could cause a failure response in the game.

All of that doesn’t resolve the mystery of your missing file, as you said “I think it’s named ava.exe” so you would first have to know the correct name to try and see if it has really gone. Not that I’m convinced avast had any hand in its disappearance, as at the very least there should have been an alert.

Or try checking the C:\Documents and Settings\All Users\Application Data\AVAST Software\Avast\report\FileSystemShield.txt (in your Alwil path) and see if there is anything in that (which I doubt).