Un-scannable files

[Robinson1]

I have used Avast 4.6 Home for some time now and it runs at all times in the background. Additionally I also run a 'Thorough Scan' on my system periodically. At the end of this scan I am told that there are 1525 files which cannot be scanned. The list is too lengthy to post here but, for example, 2 of them include:
@atdmt[1].txt and
sbRecovery.ini

Are these files likely to be protected malicious files?

As a relatively unenlightened computer user simple answers would be appreciated.   Thanks

[Lisandro]

Are these files likely to be protected malicious files?

Don't think so... password protected files are just skipped as avast! (and other programs) can't break the password.
Viruses are not passworded files.
Other ones seem come from Spybot and they're legit...
You need to post the complete list for us to be sure.

[Robinson1]

  Thanks Tech. The scan takes quite a while to redo so I will leave it 'till tomorrow

[Ricky2005]

if it can't scan a file like tech said it could be password protected but it could be in use aswell

[darth.mikey]

if it can't scan a file like tech said it could be password protected but it could be in use aswell

That's right so it's good to do a boot scan from time to time also 

[Ricky2005]

yep

[polonus]

Yes Ricky,


AV products exclude certain files from scanning, files in use like a swap file, is not scanned. ClamWin for instance mentions all files that are not normally scanned because they as a rule of thumb should not contain virus content. If you do not do a full scan files are excluded from  scanning as well.

greets,

polonus

[DavidR]

Many programs (usually security based ones) password protect their files for legitimate reasons such as AdAware and Spybot Search & Destroy, there are others.

When you run scans with the above programs and you delete harmful entries that they detect, a copy is kept (in quarantine/restore/backup) in case you need to reverse what you did. These are usually password protected, you should do some housekeeping and delete old backup/recovery/quarantine entries (older than two weeks or so), this will reduce the numbers of files that can't be scanned.

By examining 1) the reason given by avast! for not being able to scan the files, 2) the location of the files, you can get an idea of what program they relate to.

Files that can't be scanned are just that, not an indication they are suspicious/infected, just unable to be scanned.

[Robinson1]

  Thanks Guys, you've made me feel better already.

I have just deleted a bunch of atdmt,fastclick,valueclick, files as I am sure that they were unwanted cookies originally. I note that every one was followed by a recovery file. Which I assume covered the preceeding file now deleted? So these can go as well?

A huge number were RECYCLER PROTECTED files so I guess I don't need these either?

The Avast scan (which took 4 hours) does not give me a reason for not being able to scan. It just says 'Unable to scan:Ar' and no times or dates are given so I would not know if they were over 2 weeks old.

Sorry I cannot give you the full list as Tech suggests but I cannot copy and paste at all.

Hey, I used to use Norton (not a free one either) and they have no Forum like this. I found their renewal system completely unuser-friendly and very frustrating. That's why I jumped at Avast once I heard of it. This is fantastic. Thanks for your help.

Any further comments would be more than welcome.

[DavidR]

The Avast scan (which took 4 hours) does not give me a reason for not being able to scan. It just says 'Unable to scan:Ar' and no times or dates are given so I would not know if they were over 2 weeks old.

1. You can expand the column width to see more of the text, at the top of the column there is the heading and between that is a separator hover your mouse over this and you will see the pointer change to a <-||-> drag (press and hold the left mouse button) that to the right to expand the column.

2. The two weeks bit has nothing to do with avast, rather the program that created the backups, etc. so that is where you should check if they are greater than two weeks old.

[Lisandro]

A huge number were RECYCLER PROTECTED files so I guess I don't need these either?

They belong to Norton Unerase Protection. You should have being using the Systemworks either...

The Avast scan (which took 4 hours) does not give me a reason for not being able to scan. It just says 'Unable to scan:Ar' and no times or dates are given so I would not know if they were over 2 weeks old.

These files were deleted and are 'retain' by Norton Protection the number of the days you've set (default: 7). Can't be scanned by any antivirus.
They 'belong' to Norton.

Sorry I cannot give you the full list as Tech suggests but I cannot copy and paste at all.

On the screen you can't. But on the report you can (set the report file options).

[Robinson1]

Quote...."They 'belong' to Norton"....... Not any more they don't

Thanks for all of your help fellows, and for taking the time to answer me, I'll know better what to do next time. I deleted all of the Spybot and the Norton files so I'll be starting off with a clean slate.

Just one final question, one file said it was a 'decompression bomb' so I left it alone for now. Any pointers please?

[Lisandro]

Just one final question, one file said it was a 'decompression bomb' so I left it alone for now. Any pointers please?

Decompression bomb is just something that unpacks to an unusually big amount of data even though it's rather small (i.e. has a high compression ratio, for example). It's nothing to worry about, you are just informed that avast! will not try to unpack the archive (you may not even know that it's an archive, but it seems like it is) because it may take VERY long to process.
(quoted from Igor: http://forum.avast.com/index.php?topic=15389.msg131213#msg131213)

[Robinson1]

  Thanks again for taking the trouble to help me. I'll get rid of the decompression bomb next time I do a scan. After reading the thread (and not understanding much of it) where it took Duff 5 days to scan his machine I feel very satisfied with my 4 hours.

I'll certainly be making this forum my first port of call in future. It's g-g-g-g-r-e-a-t!.

[DavidR]

The fact that it is reported as a possible decompression bomb, doesn't mean it is harmful, there are some legitimate reasons for high compression.

So care should be exercised (like trying to find what program it belongs to, e.g. the location of the file, etc.) before any decision to delete, rather move it to the avast virus chest where it can do no harm and if required can be restored if there are any adverse effects due to its movement.