This is just too much!

jvidal · 2017-06-10T20:30:42.000Z

this is getting COMPLETELY OUT OF CONTROL, it happened again today.
I was installing a program called “balabolka” when a bogus virus detection popped up “filerep: malware” (BTW, who THE HELL determines the “Rep” of a file???). Then, while trying to report the false positive and closing the alert window, another one popped up, detecting something like “IDP.generic”. after that, it all went to hell, avast deleted the winzip executable (the file I opened was inside a .zip file) and then started deleting random executables WITHOUT TELLING ME OR WARNING ME OR SAYING A VIRUS WAS FOUND OR ANYTHING!!!. The only way to stop this is to hard-reboot the PC via the reset button.

WHAT THE HELL IS GOING ON??? Avast has turned into malware itself, now it’s safer to not have it installed!!!

jvidal · 2017-06-10T20:37:20.000Z

and here are the logs

Eddy · 2017-06-10T20:44:47.000Z

Thanks for the logs.
Now it is up to someone from avast to have a look at them.

On a note, don’t forget to turn the avast self defense back on again.

jvidal · 2017-06-10T20:52:39.000Z

I uninstalled it. I’m gonna install it again in an attempt to fix this madness!!!

The victims this time were the winzip executable, gzdoom (a doom engine), pasofami (a japanese NES emulator, 2 files), msdos player (i486 version, an MSDOS emu) and maybe another one I can’t detect right now, I have to check against my backups. the thing is that I use this files all the time and there’s no problem with them, but when avast “loses it”, it starts deleting them FOR NO REASON AND WITHOUT ANY KIND OF NOTIFICATION WHATSOEVER.

jvidal · 2017-06-10T21:09:06.000Z

I’m gonna try to explain this in a clearer way.
Avast “finds” a virus in file X (which is not actually a virus, it’s a FP). A window pops-up saying that file X is infected with something (usually it just has a “bad rep”, according to someone (FileRep: malware is the detection). Another bogus detection might also appear (IDP.Generic or that damn “evo-gen” crap). Then, and this is the real problem, avast goes crazy and starts deleting other files. The first one, Winzip.exe, because the file X was inside a zip file when the bogus detection happened. Then, after that, avast just starts deleting other files A,B,C,D…etc that are located on other folders and have ABSOLUTELY NOTHING TO DO WITH FILE X. Also , these files are all 100% clean files, that have been used millions of times before, without avast detecting anything on them.

bob3160 · 2017-06-10T21:28:42.000Z

Reported to Avast on another channel. Remember, this is the weekend.

jvidal · 2017-06-10T21:59:00.000Z

The critical issue here is WHY is avast doing this??? Why? what triggers this erratic behavior?

Avast should just deal with the (alleged) infection and stop there (like it has always done!). Why does it go on to delete a lot of other, completely unrelated AND CLEAN FILES??? Files that have been used a million times in the past without any issues! And even if those files were some sort of malware or even false positives, why isn’t there a notification to the user? they’re just moved to the vault, but they DO NOT show up in the vault in AVAST UI, they cannot be recovered, except from a backup (and strangely enough, avast doesn’t say ANYTHING when copying the files back from the backup)
This issue is absolutely critical and needs fixing ASAP!!!

ApoC · 2017-06-10T22:04:51.000Z

Hello,

I checked the logs and detected file is the setup.exe and the detection come from the Avast!s cloud, this is the reason why there is no detection dialog and removal is triggered without prompting. Removal then removes all files installed by setup.exe. I passed this information to our viruslab for further setup.exe analysis. If it is confirmed as FP it will be reclassified in the cloud.

As workaroud you can add this file manually to exception list until the classification is changed.

ApoC · 2017-06-10T22:17:48.000Z

About the missing record in vault. From logs it looks like you turned the behavioral component down or restarted during the removal. Detection was triggered at 20:16:55,976 and behavioral engine received command to stop at 20:17:12,628. It is possible that in this case the result of removal is not written into database => not visible from the UI. If so, this is definitely the bug.

We will test this scenario ASAP.

Thank You for the logs file and Your cooperation.

jvidal · 2017-06-10T22:36:06.000Z

thanks, but like I said, why does avast start deleting other files THAT HAVE ABSOLUTELY NOTHING TO DO with the initial “infection”?
The files avast deleted were there BEFORE the alleged infection, they’re completely unrelated.
And yes, I restarted the PC to avoid further damage!!!

That is the crucial issue here!

Eddy · 2017-06-10T22:40:03.000Z

Seems to me that all file related to setup.exe are removed, meaning also everything that setup is using including zip etc.
I can be wrong of course, but have patience as avast is looking into it.

jvidal · 2017-06-10T22:42:49.000Z

I can’t, for the life of me, think what might programs like Gzdoom or MAME or other games/utilities/emulators I have on my drive might have to do with some program’s installation. There’s something VERY WRONG here.

Plus, if I open an (allegedly) infected file inside a zip file using winzip, avast should be smart enough to deal with the real infection and NOT DELETE winzip.exe!!!
it’s like “killing the messenger”

Eddy · 2017-06-10T22:44:18.000Z

Guess you never programmed.
I have and still do and real strange things can happen if you make a real tiny mistake.

jvidal · 2017-06-10T22:53:44.000Z

programmer or not, just explain this to me:
Avast finds an (alleged) virus in a temp folder (opened from within a zip file).
Avast deleted the alleged infection and THEN it proceeds to delete winzip.exe and some other completely unrelated files on other folders (like MAME, GzDoom and others. Then, it goes to yet another folder and starts deleting other utilities. Those same files have NEVER EVER been detected as malware by avast before).
huh?

Oh and BTW, I have programmed in BASIC, Pascal, FORTRAN, C/C++, Visual Basic, even Scheme, for god’s sake!
Oh, almost forgot: Assembler (Assembly) too.

bob3160 · 2017-06-10T22:59:32.000Z

jvidal post:25:

programmer or not, just explain this to me:
Avast finds an (alleged) virus in a temp folder (opened from within a zip file).
Avast deleted the alleged infection and THEN it proceeds to delete winzip.exe and some other completely unrelated files on other folders (like MAME, GzDoom and others. Then, it goes to yet another folder and starts deleting other utilities. Those same files have NEVER EVER been detected as malware by avast before).
huh?

Oh and BTW, I have programmed in BASIC, Pascal, FORTRAN, C/C++, Visual Basic, even Scheme, for god’s sake!

You’ve already received a reply from Avast. As stated, they will be looking into this.
Eddy can’t speak for Avast. At this point, you’ll need to wait till Avast has had a chance to get to the bottom of this.

Eddy · 2017-06-10T23:00:18.000Z

As I don’t have the source code that avast is using, I only told what could be happening.

And as I said, avast is looking into it so have patience.

jvidal · 2017-06-10T23:04:38.000Z

I just hope you guys @avast can fix this nightmare once and for all. This started happening with version 17.2. It didn’t happen before and I’ve been using avast for several years!

Eddy · 2017-06-10T23:10:14.000Z

ApoC is from avast.

Bob and I are not.

ApoC · 2017-06-12T14:30:51.000Z

Hello jvidal,

today we marked the setup.exe in the cloud as clean. I also noticed your removed winzip is very old one with already expired digital certificate and I hardly suggest the upgrade. The certificated is also marked as mixed on our side (there is some PUP signed with it) so it is not trusted. This is the most probably the reason why it was removed together with setup.exe and this is also the reason why all other not digitally signed software unpacked by winzip was removed.

jvidal · 2017-06-17T16:23:16.000Z

Avast started doing stupid things again!
I wanted to play a remake of Bruce Lee (an old 8 bit classic), so I ran the executable and to my surprise, it didn’t open and after a few seconds, it crashed. The exe disappeared. I immediately suspected avast and went to the virus chest to find out that the exe was moved to it, classified as “IDP. Generic”. Again, absolutely no warning, no notifications, NOTHING. Avast just decided to delete it. Fortunately, this time it only killed this file and didn’t start killing other programs, like on previous occasions. The strange things start now: I restored the file from the vault and deleted the program’s config file (thinking it may have been corrupted) and now it opened, but in windowed mode (which is the default mode, since I deleted the config file). I tried to switch it to full screen and avast killed it again.
So, the issue here is WHY THE HELL does a program work perfectly in windowed mode and it magically becomes a virus when ran in full screen??? It’s the same program, for god’s sake!!!
Btw, I have played this game millions of times before and it was all good, now suddenly avast decided to flag it as a virus (which is, of course, another false positive), but only in full screen mode.
Really starting to get sick of avast!

Announcements