AVG blocked every powershell script execution under temp folder

AVG Protection
12

Hi Veeramani,

I had uploaded our installer through false-positive-file report website.
Please note that we will change our installer name every time we release newer version to customers.
So it doesn't work if we are going to add exception by our installer file name.
Thanks.

14

Hi AVG teams,

I had received your analysis results with the following statement.
"We have analyzed the submitted file and we can confirm that it is not infected."

What should we do next?
Will you release an update to all AVG users to stop marking our software as infected?

13

Hi Veeramani,

When is expected that I will receive your developer feedback?
Our customer is asking for update from us as well.
Thanks!

11

Hi Hank,

We're glad to look into this & help you.
Please let us know the verison of AVG that is installed on your computer (Open AVG - Menu - About).
Meanwhile, please ensure that the program has the latest patches applied to it.
(Open AVG program - click on refresh icon beside virus definitions, at bottom right corner - Restart computer after successful update).

3

Upon checking our records, we see that the ticket has landed in the correct channel, Hank.
The concerned team is currently investigating on it. As it involves a group of analysts to review the file/url, it might take some time.
Hence, we request you to allow some more time. 
Thank you for your understanding in advance!

1

We had developed a installer for our software product.
It will put a powershell script into temp folder and execute it during the installation.

But it seems that AVG will block every powershell script execution under temp folder.
So our installer failed caused by AVG protection...

The following link is the screenshot of the AVG block message:
https://imgur.com/GX11J73

It might be the same as this issue reported by John Doe.
https://support.avg.com/answers?id=9065p000000PxpwAAC
"We've blocked xxxxxxx.ps1 because it was infected with IDRALEXA.53"

What should we do to prevent it?

4

Thank you for the information, Hank. 

please submit your tool to our developers for analysis.

Click this link (https://www.avg.com/en-ww/false-positive-file-form) to submit the sample of your installer for analysis.

Our developers will check and get back to you as soon as possible. 
Until then you can add your program to the Exceptions.

AVG >> Menu >> Settings >> General >> Exceptions

5

Hi Veeramani,

I had uploaded our installer through false-positive-file report website.
Please note that we will change our installer name every time we release newer version to customers.
So it doesn't work if we are going to add exception by our installer file name.
Thanks.

6

Hi AVG teams,

I had received your analysis results with the following statement.
"We have analyzed the submitted file and we can confirm that it is not infected."

What should we do next?
Will you release an update to all AVG users to stop marking our software as infected?

7

Hello Hank, 

We request you to add installer in exception for temporory solution. Once the analysis done, our developer team will get back to you through email. 

Thank you.

8

Hi Dinesh,
The AVG version is 21.3.3174 (build 21.3.6164.661)

And it still treated our powershell script in tmp folder as a threat after updating virus definitions to 210516-6.

10

Thank you for updating the status, Hank.

Before we proceed to clarify that for you, we request you to make sure that the virus definitions of your AVG Antivirus have been updated.
Also, a recent program update has been released for the AVG Antivirus (21.4). Please update your AVG Antivirus program to the latest version.
Once you've performed the above actions, restart your device once & check if you're still receiving the same threat message.
Keep us updated.

2

Hi Veeramani,

When is expected that I will receive your developer feedback?
Our customer is asking for update from us as well.
Thanks!

9

Thank you for the infomation, Hank. 

Could you please share the screenshot (https://support.avg.com/SupportArticleView?urlname=AVG-Create-screenshot) of the threat secured message which you received in your PC? 

Have you tried to disable AVG Internet Security components (https://support.avg.com/SupportArticleView?urlname=Disable-AVG-Antivirus) and check the status? Keep us updated.