AVG Support Community
Share tips and solutions on AVG Products
Community topics
AllAVG Gurus
These community experts are here to help
-
Alan Binch
-
Borislav Angelov
-
Vladimir Bartl
-
Subhadeep Kanungo
-
Miloslav Serba
Daniel Mastropietro AntiVirus Free does not honour command line exceptions
Hello,
Adding command line exceptions (e.g. .exe file) as outlined in this article:
https://support.avg.com/SupportArticleView?l=en&urlName=AVG-Antivirus-scan-exclusions
does NOT make the added exception be considered as an exception from scanning, namely: the .exe file is still scanned when run from a CMD window.
And this is very cumbersome because the .exe file is a file I have created myself (I am a developer) and don't want to waste time every time I run it to try the application (the scan takes about 5-7 seconds!! --and the file size is just 5 MB)
Is the sentence in this support question from 2017:
https://support.avg.com/answers?l=en&id=906b0000000DyPJAA0
«
We have escalated the case to our developers team and they have informed us that if a folder or file is added to exception, AVG will be scanning those files too. If there is any detection in those files, then it will ignore the threats....
»
still true?
If so, the behaviour of AVG in terms of exception described in the first article is not true, as the very first sentence reads:
"While it is generally not recommended, you may want to exclude certain files or websites from scanning to speed up your scans or to avoid false positive detections."
Any clarification on this matter is appreciated.
Adding command line exceptions (e.g. .exe file) as outlined in this article:
https://support.avg.com/SupportArticleView?l=en&urlName=AVG-Antivirus-scan-exclusions
does NOT make the added exception be considered as an exception from scanning, namely: the .exe file is still scanned when run from a CMD window.
And this is very cumbersome because the .exe file is a file I have created myself (I am a developer) and don't want to waste time every time I run it to try the application (the scan takes about 5-7 seconds!! --and the file size is just 5 MB)
Is the sentence in this support question from 2017:
https://support.avg.com/answers?l=en&id=906b0000000DyPJAA0
«
We have escalated the case to our developers team and they have informed us that if a folder or file is added to exception, AVG will be scanning those files too. If there is any detection in those files, then it will ignore the threats....
»
still true?
If so, the behaviour of AVG in terms of exception described in the first article is not true, as the very first sentence reads:
"While it is generally not recommended, you may want to exclude certain files or websites from scanning to speed up your scans or to avoid false positive detections."
Any clarification on this matter is appreciated.
We apologize for the inconvenience. We'll check & clarify this for you.
Initially, please mention the program version of the AVG Antivirus Free installed on your computer.
Also, could you let us know if you tried manually browsing for the file path & adding it to the exception list?
Did you receive any threat message from AVG, regarding your program file?
If you did, please share us it's screenshot, so that we can check and assist you further.
You can post the screenshot here in your topic. Click on Answer & then click on the Image [mountain symbol] & follow the instructions.
Awaiting your response.
1) AVG AntiVirus Free vesion 20.7.3140 (build 20.7.5568.601) running on Windows 10, 64-bit
2) I browsed for the file path and added it (so no mispelling). The .exe program appears in the list under Settings -> General -> Exceptions -> Command line exceptions.
3) I didn't receive any threat message from AVG.
Thanks
We'd like to inform you that the latest version of the AVG Antivirus Free is 20.8.
Please update your AVG Antivirus Free application & keep monitoring the situation.
Kindly write back to us if the issue recurs. Thanks in advance!
I've upgraded to the latest 20.8 version and, as expected, the problem still happens.
Not only that, it got even worse!
In fact, I can now NO LONGER STOP the scan as I used to do before... as the pop up window does not show that possibility any more.
From your description, we see that the excluded file is still being scanned through command lines, which is usual.
Reason being, the file will be excluded from scanning within the AVG interface & if a command line scan is initiated, then the file would be scanned (outside AVG interface).
Would you be so kind to clarify whether you've excluded the command line via AVG interface as mentioned in the provided article?
Yes, I have excluded the file via the AVG interface. The .exe program I've added to the exception list appears under the list shown here (with the full path to the file, selected by browsing to it, so no mispellings of the path or file name):
So are you saying that the program will ONLY be excluded when AVG scans the system via the interface, but the program will be scanned REGARDLESS OF BEING LISTED IN THE EXCEPTIONS LIST when it is run from the command line in a CMD Window?
If this is the case, to me it doesn't make any sense at all, as it contradicts the name of the exception type "Command Line", as opposed to "File/Folder" or "Website" (which are the other two options shown in the picture above). To me, "Command Line" exception means: "exclude a program that is run via the command line (CMD)".
If the above behaviour is the case, is there a way of adding an exception to AVG via a command line (as opposed to via the interface), so that when I run the program from the command line IT IS ACTUALLY excluded? (from your description it seems that options that I set via the interface, only affect processes run through the interface... that's why I am asking this).
Your concern was escalated, and I am right now in the process of investigating your shared concern.
I will follow-up with you upon conclusion of my investigation. In the interim, your continued patience is appreciated. Regards, Shawn
If you disable the "cyber capture" feature, do you continue to experience the same disruption? You can locate the cyber capture feature in settings specific to detection.
Let me know how this works. I look forward to hearing from you. Thanks, Shawn
Cyber capture is actually the problem. And adding the EXE program as a command line exception has NOTHING to do with being scanned or not (i.e. I REMOVED the program from the list of command line exceptions, and the program is NOT scanned as long as Cyber capture is disabled).
I would suggest that the following link be updated, because the information provided there is (at least) not completely correct:
https://support.avg.com/SupportArticleView?l=en&urlName=AVG-Antivirus-scan-exclusions
** My question now is: what is the exception list useful for?? **
Thank you very much Shawn for your prompt reply to my last poke.
That being said, this was not intended to be a solution, but a troubleshoot. To clarify, it is not suggested to disable the CyberCapture component, as this can potentially increase the probability of your computer being compromised with malware.
I am going to ask that you submit a system log file, so I may share with our development team, to determine why the exception list didn't work as intended. Which in turn, answers your follow-up question.
I will have my colleagues reach out to you by email, as it is associated to your AVG forum profile, and they will provide further instruction to create and submit a system log file. I will follow-up with you, respectively, upon any new development.
In the interim, thank you for your time and continued effort. Regards, Shawn
I received your submitted system log file, and have shared it with our development team. I will inform you of any development.
However, in trying to replicate the disruption you experienced, the creation of an exception should work. Can you clarify, the exception you created, is a file/folder exception?
Let me know please. I look forward to hearing from you. Regards, Shawn
Please refer to my last post on 18-Oct-2020, where I describe what you are asking and include a screenshot of the interface showing where I set the exception.
I did reference the shared screenshot, from 18OCT2020, and in the screenshot the "command line" is checked as a filter, whereas I wanted to ensure you actually created a file/folder exception.
R/
Shawn
Oh, I see now. I had originally created a file/folder exception, but it didn't work, so I created a command line exception.
I have retried again adding my EXE file I want to exclude to the File/Folder exception list and I re-verified that it doesn't work (i.e. the EXE file is still scanned when run from the CMD window or when I double click on it from the Windows Explorer).
BTW, I don't understand what the difference between "command line exception" and "file exception" is... Could you clarify please?
Thanks
So I received follow-up from our development team, and they analyzed the registry in the submitted system log file. They were able to determine some paths of auto-sandboxed processes, can't match, since the .EXE is launched from a temp path which is not on the exceptions.
And the command line exceptions are mostly for the behavioral shield, meaning they are mostly for file-less type of detection (or script interprets like power-shell with the whole script on command line).
I trust this explanation and information help further clarify your concern. Regards, Shawn
OK, thanks. This makes absolute sense as the program I am running needs to generate a temp directory where the actual EXE files that are run are temporarily located. The problem is that the name of this temp directory changes at every execution of the program.
But... I just added the whole directory where the temp directory is created as part of the File/Folders exception list and now the AntiVirus is NOT triggered when running my program! :-)
(N.B. the directory needs to be added as it shows up in the CMD window where I launch the EXE program, i.e. with directory names shortened to 8 characters)
So, your explanation guided me to the solution. Thank you very much for your assistance!
Regards
Daniel
If we can be of further help, please, do not hesitate to contact us. Best, Shawn