As I pointed out in my 31.10.2011 18:03 post to this thread, the files being flagged as infected are different versions of the EICAR Test Virus (.exe, .com, .zip and .txt) that I use to test new/updated anti-virus installations on the different PC's I support. These files have been on my PC for a very long time but, until the recent 2012.0.1831 program update, I was able to have AVG ignore them by adding the files to my exceptions lists (both Resident Shield and Potentially Unwanted Programs.) Obviously these are NOT false positives as AVG should detect them as infected (unless they've been flagged to be ignored of course.)
Also, following the instructions in the AVG 2012 (incl. Previous Versions) Uninstall/Re-Install Instructions link posted by Pokornyz on 31.10.2011 05:16 resulted in all the previous scan logs for AVG being deleted from my computer (the instructions specifically tell you that, after running the removal tool, you must delete all the AVG folders from your hard drive, including the C:\Documents and settings\All users\Application data\AVG??? folders where the scan results are saved.)
Since I "downgraded" my installation of AVG 2012 to program version 1809 to prevent these files from always being detected and moved to the Virus Vault (adding them to my exceptions lists works properly in that version), I no longer have any scan results that show them as being detected and moved to the Virus Vault while still being listed in my exceptions sections!
According to our developers, detection of Eicar even when it is added to PUP exceptions is correct.
This detection was fixed (added) in core update 2092.
Even though the detection is not linked with program version, by reverting to older program you also revert to older core.
Rather than focus on which program or whatever, the focus should be on the simple fact that the latest AVG does not honor all exceptions. I have to continuously "restore" 2 of my files from the virus vault. Yes, I've properly listed these files in the Exceptions list, which seems to be ignored by the AVG 2012 program. A buggy program line somewhere.
As described in my previous post, Eicar detection even when the file is in PUP exceptions is correct.
You can add any executable file to PUP exceptions but the exception will only work when the detection is Potentially unwanted program.
If you add any files that are considered to be true infection (or Eicar), files still be detected regardless of exception.
This is correct behavior.
Yes, I do have the files in PUP as well. I have a list of files that need to be excluded, and they all seem to be excluded except for a couple of them, which end up in the virus vault. Then I have to restore them.
As explained in my previous post, removed files are most likely not considered to be Potentially Unwanted Programs but normal detection.
Detection of such files even if they are in PUP exceptions is correct.
So, to be sure I understand what you're saying: Even if I put files into PUP exceptions and Resident shield exceptions, AVG will still move those files to the virus vault? What is the point of typing in the exceptions then?
Note that I'm not saying there's a problem with DETECTION of these files, that is fine. The problem is that AVG 2012 is MOVING files from the EXCEPTIONS lists to the VIRUS Vault. If you re-read the posts here in this thread more carefully, it is clear that the latest AVG is NOT honoring the EXCEPTIONS lists, by MOVING the some of the files in the EXCEPTIONS lists to the VIRUS VAULT.
AVG has decided they know best how to manage your PC. You can't be trusted with critical decisions such as which programs and/or files you'd like to allow on your computer. If it's something they don't like, tough luck. It's getting moved anyway.
Even if I put files into PUP exceptions and Resident shield exceptions, AVG will still move those files to the virus vault?
Please note that Resident Shield exceptions are not applied when running a scan (scheduled, on demand). These are applied to Resident Shield detections only.
In past, there was a bug in AVG which resulted in a file which was added to PUP exceptions to not be detected by Resident Shield nor scan. This situation has been fixed recently, which probably caused all the confusion about the behavior change.
As mentioned above, the PUP Exceptions were designed to be applied to PUP (Potentially unwanted programs) only. These are applied even when running a scan (Resident Shield exceptions are not applied to scans).
Developers are working on merging the exceptions configuration on one place to make it much more transparent.