This is just too much!

ApoC · 2017-06-07T06:50:09.000Z

Hello jvidal,

I would like to apology for any inconveniences caused by Avast! in the first place. For further investigation of this issue, would You be so kind and send use these log files:
idpagentdetection.log
idpagent.log.*
secapi.log.*

located in C:\ProgramData\AVAST Software\Avast\log ?

You can attach them to this topic, the files are encrypted so only Avast developers are able to read the content.

Thank You very much.

jvidal · 2017-06-07T16:24:04.000Z

only idpagent.log.* are available.
idpagentdetection.* do not exist and secapi.log.* are blocked.

Eddy · 2017-06-07T16:37:50.000Z

Disable avast self-defense and try to attach secapi.log again.

bob3160 · 2017-06-07T22:28:30.000Z

http://screencast-o-matic.com/screenshots/u/Lh/1494164131495-33069.png

jvidal · 2017-06-10T20:30:42.000Z

this is getting COMPLETELY OUT OF CONTROL, it happened again today.
I was installing a program called “balabolka” when a bogus virus detection popped up “filerep: malware” (BTW, who THE HELL determines the “Rep” of a file???). Then, while trying to report the false positive and closing the alert window, another one popped up, detecting something like “IDP.generic”. after that, it all went to hell, avast deleted the winzip executable (the file I opened was inside a .zip file) and then started deleting random executables WITHOUT TELLING ME OR WARNING ME OR SAYING A VIRUS WAS FOUND OR ANYTHING!!!. The only way to stop this is to hard-reboot the PC via the reset button.

WHAT THE HELL IS GOING ON??? Avast has turned into malware itself, now it’s safer to not have it installed!!!

jvidal · 2017-06-10T20:37:20.000Z

and here are the logs

Eddy · 2017-06-10T20:44:47.000Z

Thanks for the logs.
Now it is up to someone from avast to have a look at them.

On a note, don’t forget to turn the avast self defense back on again.

jvidal · 2017-06-10T20:52:39.000Z

I uninstalled it. I’m gonna install it again in an attempt to fix this madness!!!

The victims this time were the winzip executable, gzdoom (a doom engine), pasofami (a japanese NES emulator, 2 files), msdos player (i486 version, an MSDOS emu) and maybe another one I can’t detect right now, I have to check against my backups. the thing is that I use this files all the time and there’s no problem with them, but when avast “loses it”, it starts deleting them FOR NO REASON AND WITHOUT ANY KIND OF NOTIFICATION WHATSOEVER.

jvidal · 2017-06-10T21:09:06.000Z

I’m gonna try to explain this in a clearer way.
Avast “finds” a virus in file X (which is not actually a virus, it’s a FP). A window pops-up saying that file X is infected with something (usually it just has a “bad rep”, according to someone (FileRep: malware is the detection). Another bogus detection might also appear (IDP.Generic or that damn “evo-gen” crap). Then, and this is the real problem, avast goes crazy and starts deleting other files. The first one, Winzip.exe, because the file X was inside a zip file when the bogus detection happened. Then, after that, avast just starts deleting other files A,B,C,D…etc that are located on other folders and have ABSOLUTELY NOTHING TO DO WITH FILE X. Also , these files are all 100% clean files, that have been used millions of times before, without avast detecting anything on them.

bob3160 · 2017-06-10T21:28:42.000Z

Reported to Avast on another channel. Remember, this is the weekend.

jvidal · 2017-06-10T21:59:00.000Z

The critical issue here is WHY is avast doing this??? Why? what triggers this erratic behavior?

Avast should just deal with the (alleged) infection and stop there (like it has always done!). Why does it go on to delete a lot of other, completely unrelated AND CLEAN FILES??? Files that have been used a million times in the past without any issues! And even if those files were some sort of malware or even false positives, why isn’t there a notification to the user? they’re just moved to the vault, but they DO NOT show up in the vault in AVAST UI, they cannot be recovered, except from a backup (and strangely enough, avast doesn’t say ANYTHING when copying the files back from the backup)
This issue is absolutely critical and needs fixing ASAP!!!

ApoC · 2017-06-10T22:04:51.000Z

Hello,

I checked the logs and detected file is the setup.exe and the detection come from the Avast!s cloud, this is the reason why there is no detection dialog and removal is triggered without prompting. Removal then removes all files installed by setup.exe. I passed this information to our viruslab for further setup.exe analysis. If it is confirmed as FP it will be reclassified in the cloud.

As workaroud you can add this file manually to exception list until the classification is changed.

ApoC · 2017-06-10T22:17:48.000Z

About the missing record in vault. From logs it looks like you turned the behavioral component down or restarted during the removal. Detection was triggered at 20:16:55,976 and behavioral engine received command to stop at 20:17:12,628. It is possible that in this case the result of removal is not written into database => not visible from the UI. If so, this is definitely the bug.

We will test this scenario ASAP.

Thank You for the logs file and Your cooperation.

jvidal · 2017-06-10T22:36:06.000Z

thanks, but like I said, why does avast start deleting other files THAT HAVE ABSOLUTELY NOTHING TO DO with the initial “infection”?
The files avast deleted were there BEFORE the alleged infection, they’re completely unrelated.
And yes, I restarted the PC to avoid further damage!!!

That is the crucial issue here!

Eddy · 2017-06-10T22:40:03.000Z

Seems to me that all file related to setup.exe are removed, meaning also everything that setup is using including zip etc.
I can be wrong of course, but have patience as avast is looking into it.

jvidal · 2017-06-10T22:42:49.000Z

I can’t, for the life of me, think what might programs like Gzdoom or MAME or other games/utilities/emulators I have on my drive might have to do with some program’s installation. There’s something VERY WRONG here.

Plus, if I open an (allegedly) infected file inside a zip file using winzip, avast should be smart enough to deal with the real infection and NOT DELETE winzip.exe!!!
it’s like “killing the messenger”

Eddy · 2017-06-10T22:44:18.000Z

Guess you never programmed.
I have and still do and real strange things can happen if you make a real tiny mistake.

jvidal · 2017-06-10T22:53:44.000Z

programmer or not, just explain this to me:
Avast finds an (alleged) virus in a temp folder (opened from within a zip file).
Avast deleted the alleged infection and THEN it proceeds to delete winzip.exe and some other completely unrelated files on other folders (like MAME, GzDoom and others. Then, it goes to yet another folder and starts deleting other utilities. Those same files have NEVER EVER been detected as malware by avast before).
huh?

Oh and BTW, I have programmed in BASIC, Pascal, FORTRAN, C/C++, Visual Basic, even Scheme, for god’s sake!
Oh, almost forgot: Assembler (Assembly) too.

bob3160 · 2017-06-10T22:59:32.000Z

jvidal post:25:

programmer or not, just explain this to me:
Avast finds an (alleged) virus in a temp folder (opened from within a zip file).
Avast deleted the alleged infection and THEN it proceeds to delete winzip.exe and some other completely unrelated files on other folders (like MAME, GzDoom and others. Then, it goes to yet another folder and starts deleting other utilities. Those same files have NEVER EVER been detected as malware by avast before).
huh?

Oh and BTW, I have programmed in BASIC, Pascal, FORTRAN, C/C++, Visual Basic, even Scheme, for god’s sake!

You’ve already received a reply from Avast. As stated, they will be looking into this.
Eddy can’t speak for Avast. At this point, you’ll need to wait till Avast has had a chance to get to the bottom of this.

Eddy · 2017-06-10T23:00:18.000Z

As I don’t have the source code that avast is using, I only told what could be happening.

And as I said, avast is looking into it so have patience.

Announcements