Virus not really a virus - how do I stop Avast from catching it?

Viruses and worms
1

I run an internet cafe and I recently installed new software from Antamedia to manage the client computers. Within the client portion of the software is a file called watchdll.DLL that is necessary for the program to run. According to Antamedia support, it is part of the process that allows the server computer to watch and control the client computers.
Avast is reading this file as - Win32:Trojan-gen {Other}.
I need to know how to tell Avast to permanently ignore this because every time we turn on the computers, it prevents the software from running unless we manually hit the No Action button. Is there somewhere in the Avast software that I can put this specific file in and tell Avast to ignore it?

2

To know if a file is a false positive, please submit it to VirusTotal and let us know the result. If it is indeed a false positive, send it in a password protected zip to virus@avast.com. VirusTotal has a file size limit of 10Mb. Please, mention in the body of the message why you think it is a false positive and the password used. Thanks.

Maybe you need to disable Hide protected operating system files and enable View hidden files and folders to manage the file(s).

As a workaround, you can add these files to the Standard Shield provider (on-access scanning) exclusion list.
Left click the ‘a’ blue icon, click on the provider icon at left and then Customize. Go to Advanced tab and click on Add button…
You can use wildcards like * and ?. But be careful, you should ‘exclude’ that many files that let your system in danger.

3

Hi Meiliki,

Make sure it is not the following malware, check it against this analysis of the malicious Watchdll.dll

%SysDir%\Programs\Keylogger5\Watchdll.dll - Dangerous
%sysdir%\programs\keylogger5\watchdll.dll
Watchdll.dll is a Spyware.WindowsKey.
Watchdll.dll monitors user Internet activity and private information.
It sends stolen data to a hacker site.
Related files:
%SystemDrive%\Programs\Keylogger5\Krnlmod.exe
%SystemDrive%\Programs\Keylogger5\Ntpsapi.dll
%SystemDrive%\Programs\Keylogger5\Watchdll.dll
Adds the value:
“Krnlmod” = “%SystemDrive%\Programs\Keylogger5\Krnlmod.exe”
to the Windows startup registry keys.

Removal:
Remove Watchdll.dll from Windows startup using RegRun Startup Optimizer.

Removal: %SysDir%\Programs\Keylogger5\Watchdll.dll

watchdll.dll
line

The watchdll.dll file is installed and used by WindowsKeylogger (read more about WindowsKeylogger).

watchdll.dll

WARNING!!! watchdll.dll file is related to spyware. Your computer’s security and privacy may be at risk. We recommend you run a scan of your computer to detect any spyware threats.

Below are manual removal instructions for watchdll.dll so you can remove the unwanted file from your PC. Always be sure to back up your PC before you modify anything.

Note: This manual removal process may be difficult and you run the risk of destroying your computer.
Step 1: Use Windows File Search Tool to Find watchdll.dll Path

  1. Go to Start > Search > All Files or Folders.
  2. In the “All or part of the the file name” section, type in “watchdll.dll” file name(s).
  3. To get better results, select “Look in: Local Hard Drives” or “Look in: My Computer” and then click “Search” button.
  4. When Windows finishes your search, hover over the “In Folder” of “watchdll.dll”, highlight the file and copy/paste the path into the address bar. Save the file’s path on your clipboard because you’ll need the file path to delete watchdll.dll in the following manual removal steps.

Step 2: Use Windows Command Prompt to Unregister watchdll.dll Files

  1. To open the Windows Command Prompt, go to Start > Run > type cmd and then click the “OK” button.
  2. Type “cd” in order to change the current directory, press the “space” button, enter the full path to where you believe the watchdll.dll DLL file is located and press the “Enter” button on your keyboard. If don’t know where watchdll.dll DLL file is located, use the “dir” command to display the directory’s contents.
  3. To unregister “watchdll.dll” DLL file, type in the exact directory path + “regsvr32 /u” + [DLL_NAME] (for example, :C\Spyware-folder> regsvr32 /u watchdll.dll.dll) and press the “Enter” button. A message will pop up that says you successfully unregistered the file.
* Read more about How to Remove watchdll.dll DLL Files

Step 3: Detect and Delete Other watchdll.dll Files

  1. To open the Windows Command Prompt, go to Start > Run > cmd and then press the “OK” button.
  2. Type in “dir /A name_of_the_folder” (for example, C:\Spyware-folder), which will display the folder’s content even the hidden files.
  3. To change directory, type in “cd name_of_the_folder”.
  4. Once you have the file you’re looking for type in del “name_of_the_file”.
  5. To delete a file in folder, type in “del name_of_the_file”.
  6. To delete the entire folder, type in “rmdir /S name_of_the_folder”.
  7. Select the “watchdll.dll” process and click on the “End Process” button to kill it.
watchdll.dll Anti-Spyware Recommendation

Certain file extensions come from parasite applications. If you decide to remove unknown file extensions manually, you might do irreversible harm to your PC. We highly recommend you use a good spyware cleaner/remover to automatically track watchdll.dll as well as other spyware, adware, trojans, and virus threats in your PC like MalwareBytes Anti-Malware or SuperAntiSpyware 4.15.1000,

polonus

4

Thanks for your suggestions. I think we’ve decided to clean it and see if the software still works. i’m about ready to trash the program and just chalk it up as a 300$ life lesson

Thanks
Teri

5

-gen detections are frequently False positives
follow through with the submission

bad files frequently use the same names as reputable ones
there are ways to check the file locations
check properties