How to set exclusion

Hello,
I have a file that Avast catches as a Worm and will not let me execute it. I checked it with other virus checkers on-line, and most do not find a virus in the file. I turned Avast off and executed the file under Sandboxie and the file does not create files. I have used this file before with no warning and caused no problem.

I tried to set an exclusion for this file, but it does not set an exclusion for the “Resident Protection”. How do I setup Avast so that I can execute this file without getting the warnings?
Thanks

Hi Frank,

If related with File, then you may do :

  1. Open avast! 5.0 GUI
  2. Go to Real Time Shield
  3. Go to File System Shield Tab and then click Expert Settings
  4. After that you may choose Exclusions, then you may click Add and then browse which file you want to exclusions
  5. After that you may click OK

Hope this would resolved your issues.

cheers,

Yanto, thank you for your reply.

I am using Avast Free version 4.8. Tried to update, but was told that I am up to date. I do not know V5.0 GUI and cannot find the Real Time Shield.
Please help with this.
Thanks

Before excluding anything, it is advisable to confirm, you don’t say what the other scanners were.

What is the infected file name, where was it found e.g. (C:\windows\system32\infected-file-name.xxx) ?
Check the avast! Log Viewer (right click the avast ‘a’ icon), Warning section, this contains information on all avast detections. C:\Program Files\Alwil Software\Avast4\ashLogV.exe

  • Or check the source file using notepad C:\Program Files\Alwil Software\Avast4\DATA\log\Warning.log and copy and paste the entry.

You could also check the offending/suspect file at: VirusTotal - Multi engine on-line virus scanner and report the findings here the URL in the Address bar of the VT results page. You can’t do this with the file securely in the chest, you need to extract it to a temporary (not original) location first, see below.

  • avast4 - Create a folder called Suspect in the [b]C:[/b] drive. Now exclude that folder in the Standard Shield, Customize, Advanced, Add, type (or copy and paste) C:\Suspect* That will stop the standard shield scanning any file you put in that folder. You should now be able to export any file in the chest to this folder and upload it to VirusTotal without avast alerting.

  • GData uses avast as one of its two scanners so counts as 1 detection and almost certainly an FP if only those two detect it.

  • In the meantime, add it to the exclusions lists:
    Standard Shield, Customize, Advanced, Add and
    Program Settings, Exclusions (right click the avast ’ a ’ icon)
    Restore it to its original location, periodically check it (scan it in the chest), there should still be a copy in the chest even though you restored it to the original location. When it is no longer detected then you can also remove it from the Standard Shield and Program Settings, exclusions.

David,
The last section in your reply did it:
Standard Shield, Customize, Advanced, Add and
Program Settings, Exclusions.

I checked the file with Virus Total. There were numerous virus checkers that did not consider my file containing a virus. Under normal conditions, I would just delete this file. However, I used this file numerous times before without any trouble. Last time was around 6 months ago (no problem). Now I get these alerts. I think it’s the way the Avast database changed over this time. But that’s o/k, now that I can accept this file.
Thanks again.

It isn’t so much the number of scanners that don’t consider it infected, rather the number of scanners that do and which those scanners are. This is why we ask for a link to the virustotal results page.

Even assuming that it is a false positive the job isn’t done and exclusion only helps one person, reporting it to avast as a false positive so that the signatures can be corrected thus helping all avast users that have this file.

Send the sample to [b]virus (at) avast (dot) com[/b] zipped and password protected with the password in email body, a link to this topic might help and false positive in the subject. 
 
Or you can also send it from the Infected Files section of the chest (select the file, right click, email to Alwil Software). It will be uploaded (not actually emailed) to avast when the next avast auto (or manual) update is done.

I agree. I sent the file to emailed the file to Avast.
Thanks a lot.

You’re welcome, thanks for sending it to avast.