Avast WEBforum
Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: pocahontas on January 19, 2005, 04:32:02 PM
-
xp MCE 2005 include SP2, Outpost 2.5 Pro, Avast4 free latest version,
Hello.
today I´ve got the message about a virus. I put it (it´s a trojaner, isn´t it?) into the quarantine. Now i´ve got three questions:
[Virus name: MediaBuilder.exe]
1. Was it right?
2. Can it be in the True Image 8.0 folder, and belongs the MediaBuilder to True Image, needs True Image this "virus" ?
3. It´s in the quarantine, what shall I do now and what can I do to stop those things?
Regards
pocahontas
<?xml version="1.0" encoding="UTF-8" ?>
- <aswObject>
<NewId>00000005</NewId>
<Size>5160784</Size>
- <ChestEntry>
<ChestId>00000001</ChestId>
<FileTime>1092160800</FileTime>
<OrigFileName>kernel32.dll</OrigFileName>
<OrigFolder>C:\WINDOWS\system32</OrigFolder>
<Comment />
<Category>System</Category>
<TransferTime>1104614973</TransferTime>
<FileSize>1057280</FileSize>
</ChestEntry>
- <ChestEntry>
<ChestId>00000002</ChestId>
<FileTime>1092160800</FileTime>
<OrigFileName>winsock.dll</OrigFileName>
<OrigFolder>C:\WINDOWS\system32</OrigFolder>
<Comment />
<Category>System</Category>
<TransferTime>1104614973</TransferTime>
<FileSize>2864</FileSize>
</ChestEntry>
- <ChestEntry>
<ChestId>00000003</ChestId>
<FileTime>1092160800</FileTime>
<OrigFileName>wsock32.dll</OrigFileName>
<OrigFolder>C:\WINDOWS\system32</OrigFolder>
<Comment />
<Category>System</Category>
<TransferTime>1104614974</TransferTime>
<FileSize>24576</FileSize>
</ChestEntry>
- <ChestEntry>
<ChestId>00000004</ChestId>
<FileTime>1104582648</FileTime>
<OrigFileName>MediaBuilder.exe</OrigFileName>
<OrigFolder>C:\Programme\Acronis\TrueImage\MediaBuilder.exe</OrigFolder>
<Comment />
<Virus>Win32:Trojano-916 [Trj]</Virus>
<Category>Vir</Category>
<Restore>yes</Restore>
<TransferTime>1106135995</TransferTime>
<FileSize>4076064</FileSize>
</ChestEntry>
</aswObject>
-
It's probably a false alarm.
Just open the virus chest (when you start the Simple User Interface, click on the "Chest" image, or select it from the menu). Now, rightclick on the Media Builder.exe file in the Chest and select Email to ALWIL Software.
-
Thank you very much and how do I put MediaBuilder.exe to it come from?
-
Where can I find the chest? In the "C:\Programme\Alwil Software\Avast4\DATA\chest" is no image and only one xml file and four files (from 00000001 till 00000004) of the Typ "datei" (means: file)
What I have to do now?
Please help!
pocahontas
-
By "opening the Chest" I mean starting the corresponding avast! program - as I described above. No need to work directly with the files...
-
thanks a lot again! My personal computer - the unknown machine or how stupid is the person between cher and screen ;-)
Have a nice day and thanks a lot.
Bye
pocahontas
-
The file is back on its place, but and its normal, the next scan gave me the next allert. Is there an allert every time or would it be fixed by the next update?
-
There is every likelyhood that it will be resolved soon in an iAVS update. In the meantime you could ad the file to the exclusions list for normal scans.
(http://img.photobucket.com/albums/v325/for-dwr/exclusions.jpg)
-
Yes, and this is a normel step to do. I´m sleeping......
Thank you to all!
Best regards
pocahontas