Avast WEBforum
Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: REDACTED on August 16, 2014, 09:29:43 AM
-
i'm trying to manually add an executable to the virus chest using the 'add' function, but files are being copied to the chest - not moved to the chest. this is ok for files i can delete from their original location, but for files i can't delete they can't be isolated in the chest.
am i missing something here? using version 2014.9.0.2021
-
Yes, that's intentional - adding a file to chest just "copies" the file to chest. avast! doesn't delete undetected files.
-
how to use the chest. http://www.avast.com/faq.php?article=AVKB21
why do you want to move these files to chest ?
-
ok - thanks for the info. that is confusing - all documentation/instructions i've seen state that using 'add' will 'move' the file to the virus chest - not copy it.
Pondus i wanted to move files for Lojack (Absolute Software Corp) and a windows media player file to the virus chest to block them from executing. I can block them with online armor, but get loads of pop ups when they try to run. since i can't delete any of these files (Lojack just reinstalls itself) i guess i can't use the virus chest for this.
-
ok - thanks for the info. that is confusing - all documentation/instructions i've seen state that using 'add' will 'move' the file to the virus chest - not copy it.
Pondus i wanted to move files for Lojack (Absolute Software Corp) and a windows media player file to the virus chest to block them from executing. I can block them with online armor, but get loads of pop ups when they try to run. since i can't delete any of these files (Lojack just reinstalls itself) i guess i can't use the virus chest for this.
Avast only moves things to the chest that it has actually detected as malware. Add to the chest only adds a copy of the file, the original remains in place; it has been that way for a very long time. This in a way is similar to Restoring a file from the chest, a copy remains in the chest.
Well if avast were to 'move it' rather than 'add' a copy to the chest, then that would essentially be the same as deletion surely as it wouldn't be in the expected location. Wouldn't Lojack do the same thing, reinstall to replace missing files.
Surely the point of having LoJack for Laptops® (presumably this is what yo have) installed is for hardware protection; if you are going to try crippling/circumventing it, should you even have it installed ?
-
Avast only moves things to the chest that it has actually detected as malware. Add to the chest only adds a copy of the file, the original remains in place; it has been that way for a very long time. This in a way is similar to Restoring a file from the chest, a copy remains in the chest.
Thanks for the reply DavidR... I understand this now - my point was just that the documentation does not suggest the file will be copied
Well if avast were to 'move it' rather than 'add' a copy to the chest, then that would essentially be the same as deletion surely as it wouldn't be in the expected location. Wouldn't Lojack do the same thing, reinstall to replace missing files.
my assumption as well, but still wanted to see what would happen. however, it would have worked to block windows media player network share wmpnscfg.exe which for some reason won't shut down.
Surely the point of having LoJack for Laptops® (presumably this is what yo have) installed is for hardware protection; if you are going to try crippling/circumventing it, should you even have it installed ?
i did not install. Lojack comes pre-installed on many laptops and is bundled with other downloads. the files are supposed to be disabled until you purchase a license for Lojack - but this is not the case - my firewall is constantly blocking Lojack files. From what i've read, information on location and installed apps is sent out at every boot regardless of whether you have a license or not - creepy...
but i've found that oddly the files are easily disabled by selecting 'deny' for 'read and execute' in the security tab of the file properties - or of course you can just block them from sending info with a firewall.
i haven't found a solution to disable wmpnscfg.exe other than blocking with online armor
-
Surely LoJack must have an entry in Programs & Features to remove it ?
Though it may well be hidden given the nature of the program, they wouldn't want the thief to be able to easily remove it.
I would visit their website/forum and look for ways to remove (or disable) the it.
-
some hits came up ;) http://lmgtfy.com/?q=how+to+uninstall+LoJack
-
Surely LoJack must have an entry in Programs & Features to remove it ?
Though it may well be hidden given the nature of the program, they wouldn't want the thief to be able to easily remove it.
haha - good one - it has recovery files in the bios to reinstall itself - and apparently many factory installs can even repair the bios if you try to edit or flash it.
I would visit their website/forum and look for ways to remove (or disable) the it.
Apparently Absolute Software will remove the files if you can prove the laptop is yours. i've disabled Lojack - see my previous post -
-
some hits came up ;) http://lmgtfy.com/?q=how+to+uninstall+LoJack
thanks for the info - i've looked through most of these already, but there was one new method... stop rpcnet service - delete/replace the Lojack files with 'notepad' files of the same name - set the notepad dummy files to 'read only' - reboot.
as i mentioned above, i disabled Lojack by setting 'read & execute' to 'deny' in the file properties security tab for each Lojack file.
unfortunately both of these methods leave the repair files in the bios intacted, but i don't want to tinker with the bios and potentially mess things up.
-
I'd leave the bios alone, no sense in risking a chance of bricking your laptop over this.
I took the time to check out Absolute Software's FAQ's and discovered that LoJack is not limited to just laptops, it can also be installed on PC desktops too. Really, a better solution would be to encrypt the entire drive, it would seem to me, and keep a second drive copy (unencrypted?) around in case the original drive was stolen along with the laptop or PC.
At least with encryption, you wouldn't have to deal with the issues you are dealing with now. But, be aware that encrypting the main drive would mean that if the password was lost or forgotten, there would be no easy way to regain access to the drive again.
Only advantage to LoJack, really, is the promised ability to recover the system if lost or stolen.
Pity it came pre-installed on your system. There should be a way to remove it if it is not wanted, as soon as you get your laptop, and that removal should be relatively painless to do. Simple as that.
Looks like you need to contact Absolute in any case to get your system to work the way you want it to. Doesn't look like there is any other way to do it.
-
Only advantage to LoJack, really, is the promised ability to recover the system if lost or stolen.
i wouldn't bank on that - the methods to disable it that i posted above are pretty simple - even i figured it out :)
Looks like you need to contact Absolute in any case to get your system to work the way you want it to. Doesn't look like there is any other way to do it.
i'm not going to bother - it's disabled - so as long as it stays that way i'm happy