Avast WEBforum

Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: Jaguar07 on September 26, 2011, 12:58:00 AM

Title: Three False positives
Post by: Jaguar07 on September 26, 2011, 12:58:00 AM: When running a full scan with the latest Avast software (Free or Paid Version) you may see the following detections:

C:\Windows\SysWoW64\kernel32.dll|[Emul] Severity High Status Threat: Win32: Cycbot-KI [Trj]
C:\Windows\winsxs\...\kernel32.dll|[Emul]Severity High Status Threat: Win32: Cycbot-KI [Trj]
C:\Windows\SysWoW64\kernel32.dll|[Emul] Severity High Status Threat: Win32: Cycbot-KI [Trj]

All three of these are FALSE Positives. Do not move these files to the vault or delete them. If you do you will most likely have to restore your computer using the Windows 7 DVD.
Title: Re: Three False positives
Post by: CraigB on September 26, 2011, 01:11:09 AM: And if you have deleted those files please do the SFC repair described here http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html
Title: Re: Three False positives
Post by: DonZ63 on September 26, 2011, 01:38:37 AM: Well that explains all the borked PC postings I have seen in this forum in the last couple of days.

You definitely don't want to give false positives for Windows kernel files. Avast needs to be more careful with the virus definitions.
Title: Re: Three False positives
Post by: Nesivos on September 26, 2011, 04:23:13 AM: Quote from: DonZ63 on September 26, 2011, 01:38:37 AM
Well that explains all the borked PC postings I have seen in this forum in the last couple of days.

You definitely don't want to give false positives for Windows kernel files. Avast needs to be more careful with the virus definitions.
Quote
I came down with this...issue....early this morning after running an Avast! Full Scan. It found three "corrupt" files, (the 3rd being a duplicate of the 1st). I followed Avast! instructions and moved them to the Chest (it wouldn't move the 3rd, probably because it had already done that with its doppleganger, the 1st file).. I then continued following Avast!'s instructions and ran a boot-time scan. The pc rebooted after that and O experienced just what Justin described, "On reboot the systems seems fine but Avast! won't run

My solution was similar to Justin's: along with the Help option supplied by Win7, I used an adaption of Justin's suggested repair: "In the Command Prompt type SFC /Scannow. Once it's finished corrupted files will be repaired and your .exe's will work once again." After running the scan (about 25 min) I received a note from Windows saying ""Windows Resource Protection found corrupted files and successfully repaired them. Details are included in the CBS.log windr\logs\CBS\CBS.log" I am going to now run a new Full Avast! Scan and hopefully it will find nothing and that will be the end of it

http://answers.yahoo.com/question/index?qid=20110924163655AAvx4kn (http://answers.yahoo.com/question/index?qid=20110924163655AAvx4kn)
Title: Re: Three False positives
Post by: slybo on September 26, 2011, 02:59:05 PM: I do not have any problems with this but have a question just in case it comes up. Is running chkdsk , which you go to my computer and right click on c drive and use tools and select error checking and fix system files, and it does it on boot up. Is this the same as SFC ?
Title: Re: Three False positives
Post by: Nesivos on September 26, 2011, 03:29:54 PM: Quote from: slybo on September 26, 2011, 02:59:05 PM
I do not have any problems with this but have a question just in case it comes up. Is running chkdsk , which you go to my computer and right click on c drive and use tools and select error checking and fix system files, and it does it on boot up. Is this the same as SFC ?

You might want to verify this but ISTM to be correct through W7. I haven't tried either command on W8 DP

Quote
1. sfc /scannow will scan the system files on the drive replacing any which are missing or corrupt.

2. Chkdsk creates and displays a status report for a disk based on the file system. Chkdsk also lists and corrects errors on the disk.

https://www.computing.net/answers/windows-xp/sfc-scannow-chkdsk-/122869.html (https://www.computing.net/answers/windows-xp/sfc-scannow-chkdsk-/122869.html)

As craigb originally suggested I would run SFC in this case since we are talking about fixing "System Files"

My guess is that SFC stands for "System Files Check" or something like that :)

Good luck
Title: Re: Three False positives
Post by: slybo on September 26, 2011, 05:06:07 PM: Thanks, sounds like I had better use SFC if this does happen.
Title: Re: Three False positives
Post by: essexboy on September 26, 2011, 06:04:17 PM: SFC has a cache of windows files stored in a secure backup area so if the main system files are corrupted then it will be able to replace them

Disc check just checks the hard drive for sector errors/bad sectors and repairs or marks as bad where necessary