Several Anti-Virus products including Avast™, AVG™ and Comodo™ (and previously Kaspersky™) wrongly block Thortspace™ installation and use — and how to fix it
First of all, if your anti-virus software triggers a false positive for thortspace, please report it as a false positive to your anti-virus company. That would be tremendously helpful. Thank you very much!
In case anyone is wondering: No! Thortspace does not contain any trojans, or malware of any kind.
Also we sign the Windows setup installer with a commercial code signing certificate approved by Microsoft which prevents it from being tampered with at some stage between when the installer is created and when it gets installed on your Windows machine — in line with Microsoft installer “smartscreen” requirements.
UPDATE 12th JULY 2020:
I just ran the latest Setup.exe through VirusTotal and as far as I understand the results, it seems to be saying that the Setup.exe is completely clean.
I mean we know it’s completely clean so this shouldn’t come as a surprise, but VirusTotal uses all the virus signature databases of all the major AV providers and checks against them. So this would seem to imply that none of the main AV providers would any longer be giving false positives against Thortspace.
I’m still trying to figure out exactly how to interpret this result. On the one hand it’s what we would expect. On the other hand we’ve had so much trouble with false positives from AV manufacturers that it’s kinda surprising.
The results are here — you can check them for yourself by uploading the Setup.exe to VirusTotal https://www.virustotal.com/gui/file/9f7ac7f064dafe1c276ecb10b11ad22619631f8151645433abcf53b3128aa2b1/detection
PREVIOUS STUFF IN THIS ARTICLE
UPDATE 1: Important! Recent testing appears to indicate that Kaspersky have now **fixed** this problem, however Avast, Comodo and AVG do similar things, and have similar solutions — more about Avast is below.
Many thanks to Ralf Lembach amongst others for pointing this out. Ralf also brought our attention to there being a number of crashes and installation problems arising from interactions with AV software which it is not immediately obvious are caused by it … but are!)
We are applying to have thortspace white-listed by all these antivirus software companies, but in the mean-time, you probably need to disable your antivirus software while you are installing thortspace, and you will need to set exclusion rules on the executable and executable directory once it is installed.
Below is how to do this with Kaspersky (just as an example). Your anti-virus software will have similar work-arounds. If there is a particular anti-virus software that you want to tell us about, or that you want an article on how to deal with in respect of thortspace, please let me know in the comments.
UPDATE 2: AVG have emailed me to say they have white-listed thortspace, and this will be included in the next virus definitions update they send out. I hope to hear and discover that this has fixed the problem at least for AVG.
UPDATE 3: Many thanks to Wallace Tait for alerting us to the fact that Avast is still doing this in May 2020. (See (B) below for information about Avast.)
Contents of article below:
(A) Kaspersky Antivirus Software blocks Thortspace installation on Windows
(B) Avast Antivirus Software blocks Thortspace installation on Windows — May 2020
(A) Kaspersky Antivirus Software blocks Thortspace installation on Windows
- Kaspersky Anti-virus software may under some circumstances give a false positive in respect of thortspace being a “trojan” — that is a type of computer virus. This is called a “false positive” because thortspace is not actually a trojan. This “false positive” can arise due to a fault in Kaspersky’s software (see below).
2. In order to work around this fault in Kaspersky’s software, before you install thortspace (if you haven’t already) disable Kaspersky Applications Manager:
3. Now install thortspace using the Winodws MG Setup.exe downloaded from https://www.thortspace.com/main/install-thortspace/
4. Now go to Kaspersky settings -> Additional -> Threats and Exclusions
5. Select “Manage exclusions”
6. Add the following entries:
7. Go back to Threats and Exclusions settings
8. Select “Specify trusted applications”
9. Add the following entries (note that the folder name under C:\Users will depend on your windows username):
10. IMPORTANT! The path will need to be updated whenever there is a version update, however depending on which version you thortspace you have installed (“thortspace” or “thortspaceMG”) you should only need to update one path. The screenshot shows both versions for illustration purposes only.
11. Now you should be able to re-enable Kaspersky Applications Manager without Kaspersky giving thortspace as a false positive.
12. You can take additional action to help encourage Kaspersky to fix the false positive permanently and thoroughly by following Kaspersky’s instructions on how to report false positives. Further information about reporting false positives to Kaspersky is shown in the table of anti-virus software vendors that starts about a quarter of the way down this page about reporting false positives.
(B) Avast Antivirus Software blocks Thortspace installation on Windows — May 2020
We tried filing a false positive with Avast here: https://www.avast.com/en-gb/false-positive-file-form.php (many times with a variety of alternative entries in from boxes). The form basically failed to submit every time.
We also tried registering for the white-listing program here: https://www.avast.com/en-gb/whitelist-program-registration but our application was rejected.
Please if you know any way of registering this as a false positive with Avast then please do go ahead and do so. Or else please do write a comment saying how to do this, and I will make more attempts at it myself. Especially if you are a licensed user of Avast anti-virus software, my guess is that they would pay more attention to you as their customer than they do to us.
For now at least, I’m sorry to say this is going to have to be dealt with by the user. Here’s our recommended work-around, such as we have it:
(1) Disable Avast real-time monitoring while you install Thortspace.
(2) Then once Thortspace has been installed, add an exception to Avast’s scanning rules:
On Windows, the path to the Thortspace program install directory is here:
Here’s how to add an exception rule to Avast scanning.
Related links:
- There seems to be a similar issue with AVG (and possibly some other Anti-Virus software programs?): https://www.thortspace.com/forums/topic/problems-with-software/
- Discussion of false positives, and their use in competitive actions between anti-virus software vendors: http://www.reuters.com/article/us-kaspersky-rivals-idUSKCN0QJ1CR20150814
- What to do about a false positive: https://www.opswat.com/blog/what-do-i-do-if-engine-detects-my-safe-file-threat
Related articles:
