Packed keygens: who does Avast "know" which one to ignore?

+1 Best answer without fighting. Nice one Tech i alway like you because your so simple.

But beranger i want to teach you something. Just beware when you surf in these sites ok mate ? Just be sure that you wont get infected, others ways dont blame avast! to dont have warning you before.

Also maybe just to scan on VirusTotal.com wont maybe show you all presents inside the file(s). Sometimes the virus can be hidden or mores…

Also if your there to judge others to say they are “idiots”, “morons” or anythings elses. Then the door is open for you. We are there for help peoples no to judge or make a conflict between something. So if your that kind of person im invite you to revise your texts before posting. So you can think if its can offense someone or no. Also this is for all peoples that is concerned.

Thats all, stay safe guys/girls.

Mr.Agent

Everyone knows that. The problem is, exceptions work only with the on-demand scan, not with the resident on-access shield.

As I previously said, I personally have never been infected, so I couldn’t even blame anyone for something that never happened!

Absolutely.

But they are. This is not a court of law, and even if it was, intellectual property infringement must be proved. I was simply asking a technical question about false positives and they’re acting like the prosecutor’s office!

  1. Go on the Files Shield > Expert Settings > Exclusions.

  2. Well just in case that its happen.

  3. We are no in a court but the respect is not only in a court its also every places that you see and any persons between you. Now i talk to you no the others and i think the others did understand now. If not then be more mature than them then dont insult them and leave the subject.

Mr.Agent

Thanks! I dunno why I was given the impression that exclusion only work with on-demand…

Its just a first look on the settings and we can find it. :wink: No problem.

Also if you wanna be sure its a false positive u can send the file to the chest and send to avast! so they check it and confirm it. Only if you want.

Mr.Agent

Well if you have no intention of actually using them (as you stated earlier) then you would only need to exclude from on-demand not on-access scans.

Manipulating the archive folders (on an external HDD) would trigger the on-access scan.

But, as you said you aren’t going to use them so why manipulate the archive. I can open an archive, but without extracting the contents (creation of a new file on the HDD) avast doesn’t alert on the default settings. Archives are inert and as such don’t present an immediate risk.

So the file system shield doesn’t scan them unless you extract and try to run the contents, or increase the sensitivity, change the, scan when opening, packers, actions, etc. to scan all files in the file system shield expert settings.

By “archive” I mean “archived/stored/saved files”, NOT “compressed archives”!

So moving a file from HDD1 to HDD2 involves creating a file on HDD2. Normally, this should be scanned. All the decent antiviruses do that (even the indecent ones)!

I am also rearchiving contents from older CD/DVDs to newer ones and all I care is to make a copy of them, not to have files deleted. Of course, I could disable avast during this, but as a general rule… I don’t like False Positives!

If the detection rate on your keygens is more than 50% of all AVs, how do you know they are clean? The fact you didn’t notice suspicious activity doesn’t mean there is none. :wink:

Because I just know, honey.

Try this:

  1. Disconnect from the Internet (physically disconnect the cable), but also enable whatever firewalls AND BEHAVIOR-BASED/HIPS TOOLS (e.g. from Comodo, ThreatFire, and whatever else you might have). If you’re paranoid, use something that would “inoculate” (through checksum) all your files, use a tool that would save elsewhere a copy of your Registry, etc. etc.
  2. Run such a keygen (from my tiny collection, they’re less than 10 guaranteed!), copy your generated strings.
  3. Close the keygen.
  4. Reconnect to the Internet.
  5. Run in sequence ALL THE MALWARE DETECTION TOOLS IN THE KNOWN UNIVERSE! (Installed and/or online. If necessary, install them, one by one, and after uninstalling the previous security suite of your choice.)
  6. Notice that nothing suspicious could be detected on the system.
  7. Reboot (if you never did this after running the keygen) and repeat points 5 and 6.
  8. Use whatever traffic tool to monitor and dump the traffic while you’re buying something online.
  9. Notice there is no suspicious activity.
  10. Agree to pay me 1,000 EUR for claiming I cannot know which keygens are safe.

I am not modest. I have enough common-sense and other qualities in sufficient quantity so that I KNOW what is safe for me to run.

I am puzzled that I have never been infected, I have never lost any file, I have never lost any penny from my credit cards, etc. This, in 17 years of owning computers. And no, I don’t run simultaneously several antivirus products or security suites, although yes, some security tools (behavior-based + firewalls) can be added to any given antivirus.

Once again, avast is behaving “decently”, it gives a small number of false positives, and so does Kaspersky, for instance. Some other products, such as Panda or PC Tools, when they report Trj/CI.A or Trojan.Generic, what they say is that THEY HAVE NO CLUE, but because the file is a packed exe, they PREFER to consider it malware! Also, BitDefender has the tendency to consider… almost everything as malware – and they failed the latest VB100 August test exactly for having found 15 false positives on 100% genuinely legitimate files!

False positives is a serious issue. It’s like declaring a lot of people as having cancer, just because you don’t know why they’re coughing.

OK, let me close this thread as it’s probably going nowhere. Keygens and cracks are often packed by strange and crazy packers/cryptors - so yes, “false positives” may occur. On the other hand, because of the nature of these tools - nobody really cares.
So, the probability of these FPs getting fixed is about the same as starting to detect them on purpose, no matter how much you’d like to.

Btw, your great 10 steps hardly prove anything.