Avast WEBforum
Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: UserA789 on March 05, 2012, 11:21:27 PM
-
I had a problem yesterday when Wiondows told me Avast was not running. Uniinstalled, used aswclear from safemode. A directory on root of c:/ was left, entitled "avast! sandbox" with multiple directories. Could not get folder/ file to delete even from safe mode. Traced the problem to one file called "rescache.hit". All google searches suggest this is some kind of virus but thought Id come here for answers. Have reinstalled but dont get why it wont go away, even when using Admin account.
What is it? Why does it not delete, even with 'aswclear' tool? Can this be addressed?
screenshot shows directory and file name structure on root of C:
-
are you able to upload it to www.virustotal.com ?
run a quick scan with Malwarebytes and see what it say
if anything is found post the scan log here
-
I am sure I can upload it, but I was first wanting to find out if it is part of Avast!7. Also, besides for format/reinstall; how can I delete it? It acts like its one of those locked files that Windows relies on. Also, Im sure it must be pure coincidence but my CPU fan stopped working... well, not the fan but the controller for it. Very strange but Imma blame it on coincidence.
I dont want to go to anyone other than Avast for this answer. No offense... I just have developed a trusted faith with Avast.
-
BTW... what is this site you recommend AND why isnt it an Avast site?
you upload suspicious file(s) and test it with 40+ malware scanners to see if it is malware
eksample here
https://www.virustotal.com/file/c9850e4697f49d198906d28e393a3973a3db6c58a41fa7cd1a2e6f1e7aabc86f/analysis/
Isnt Avast!7 desiugned to handle it as well? Why recommend something that isnt my product choice
No security program have 100% detection and Malwarebytes is one of the best removal tools
if you check the Evangelist signatures here you see everyone is using it as an extra scanner
-
I did it but again, Im really an Avast only person usually. Anyhow, the scanner had some sort of iussue and gave me an "Oops!" pop-up then just got stuck in scanning.
Back to the subject... is this an Avast7! file or not? If no then I think I need to submit it to Avast for deeper analysis (where is the link on how to upload to Avast server, if anyone can re-point me there). The only things I can find on it suggest it belongs to a Beta RC releaase of Windows yet Im running FULL version of W7 Pro(64).
-
can this be it
http://social.technet.microsoft.com/Forums/en-US/windowsserver2008r2general/thread/a636c4ce-40c8-4d0a-9d05-052740fea750/
-
...if you check the Evangelist signatures here you see everyone is using it as an extra scanner
Most everyone is using opensource software such as Linux and FF, but Iv already posted about *nux builds being exploited more than Win servers last year. Im not looking for debate but I do appreciate your suggestions.
BTW... here are a couple of links on files with the same names:
http://social.technet.microsoft.com/Forums/en-US/windowsserver2008r2general/thread/a636c4ce-40c8-4d0a-9d05-052740fea750/
http://f.virscan.org/ResCache.hit.html
-
can this be it
http://social.technet.microsoft.com/Forums/en-US/windowsserver2008r2general/thread/a636c4ce-40c8-4d0a-9d05-052740fea750/
I dont think so. If it is, it doesnt make sense its in the directory it is. Nor am I running RC version(s) of anything. If they left it in the final release then fine, but again, it doesnt match where it would be.
While we are discussing what it is and where it comes from... how can I delete it without DL the virus called fileunlocker.
-
and the virscan link you posted show zero hit for malware
http://r.virscan.org/f0c18ccf0d324165e6ca534f52e794cd
http://r.virscan.org/886050185c969f2c1bc0e42580853e09
-
...if you check the Evangelist signatures here you see everyone is using it as an extra scanner
Plenty of folks swear by Android and *nux but its become obvious they ARE NOT as secure as made out to be. Iv posted about *nux builds being exploited more than Windows servers last year already. Not to mention Avast makes an security suite for Android because Avast recognises, at least with Android, its been taken advatage of by an illicit element.
But Im not looking for debate, just say'n.
-
Okay... why cant I delete it? Why is not NOT in the usual spot it should be as per the socialnet MS link? As you stated, no scanner is perfect and if its some unknown; which I still doubt, then maybe its a new method not being considered.
TO BE CLEAR... I dont really think its a virus (but I could be wrong).
Either way, its in a directory entitled Avast! Sandbox. Used all tools present to get rid of the directory and file... none worked. This should be addressed, not debated wther its a virus or not. Not to mention, if it was and was 'clever' enough; Im sure someone could be redirecting my upload or even the page Im trying to upload to.
Lets focus on the question "Is this an Avast file; or should I submit it to Avast from another PC?"
BTW... here is a notepad look at the file:
-
Okay... why cant I delete it? Why is not NOT in the usual spot it should be as per the socialnet MS link? As you stated, no scanner is perfect and if its some unknown; which I still doubt, then maybe its a new method not being considered.
TO BE CLEAR... I dont really think its a virus (but I could be wrong).
so why not test at virustotal and see ?
-
It is a legitimate folder, I have one on windows 7
Removal of the folder can have an adverse affect on your system
-
This IS NOT the same file... and its in a directory created apparently by Avast (yours is in Windows directory; which Im sure I have one there as well but this one is a directory entitled Avast! Sanbox). So your example DOES NOT equeal the problem in this instance. I appreciate your contribution though.
-
not tested it a virustotal yet ?
I know a tool that may be able to delete it.......if thats what you want
-
not tested it a virustotal yet ?
I know a tool that may be able to delete it.......if thats what you want
I have used a tool called fileunlocker before but Avast, after three or so scans FINALLY identified something inside it... if thats the tool you refer to
I did it but again, Im really an Avast only person usually. Anyhow, the scanner had some sort of iussue and gave me an "Oops!" pop-up then just got stuck in scanning.
Ya know, I cant help but discuss how 'flamed' Im begining to feel... but we all forget to read all the posts at one time or another... so for now, Ill let it be.
-
I have used a tool called fileunlocker before but Avast, after three or so scans FINALLY identified something inside it... if thats the tool you refer to
Nope
-
I have used a tool called fileunlocker before but Avast, after three or so scans FINALLY identified something inside it... if thats the tool you refer to
Nope
Isnt there a way to 'unloack' the file WITHOUT downloading software that somebody I dont know created. Not to be all 'paranoid' but this is my 60+ year old ma's PC and it would be unacceptable to end up with some trojan or something.
Whats the file, and where can it be DL from? What information can be provided on its maker/developer?
Back to the topic. Why is Avast creating this directory and fileset? Why does the Avast aswclear not remove it or why is it NOT removed during uninstallation?
Iv submitted a support ticket on this but it seems that only the first paragraph was read and the rest assumed. They did not address the problem at all... which is getting to be a pattern. I am going to attempt to phone YoGi about it, but that gets even worse for Americna English comprehension... not trying to sound offensive, just a fact.
-
if you tested the file at virustotal (there is noting to download) you browse to the file and scan it
you then get a result malware not malware...at the bottom of the result is a more info button that may give the info you want (if there is a sigcheck it may tell you where the file came from)
the program i suggested in my first post Malwarebytes ( very trustworthy ) is the first tool all the pro malware removers start with
it has a extra tool inside called FileASSASSIN you browse to the file and click kill...kabom....it is gone
-
if you tested the file at virustotal (there is noting to download) you browse to the file and scan it
you then get a result malware not malware...at the bottom of the result is a more info button that may give the info you want
the program i suggested in my first post Malwarebytes ( very trustworthy ) is the first tool all the pro malware removers start with
it has a extra tool inside called FileASSASSIN you browse to the file and click kill...kabom....it is gone
Pondus...
I appreciate your help in trying to just delte the file, but what needs addressed is what created it (it seems Avast did but ???). Also, what needs to be addressed is why the aswclear tool DID NOT clean it up when ran in safe mode. If Avast is creating this file and its directory tree then when uninsatlled; it SHOULD be cleaned up... right? If regular uninstalltion isnt doing it, then the tool Avast says to use to do the rest SHOULD clean it up... right?
Lets stay on focus. Youve given great software to go and DL... I appreciate that.
The help Im looking for is more of an explanation of how and why this is being created... and then why its unable to be cleaned up thru Avast recommended methods (if in fact Avast is creating it). This is a problem that needs more than just non-Avast methods to fix it.
-
if you tested the file at virustotal (there is noting to download) you browse to the file and scan it
I uploaded the file to be scanned yet I keep getting a pop-up that simply say's "Oops!". No reason or anything else... just "Oops!" Then it seems to just sit there spinning its icon like its still trying but nothing more happens. But again Id rather focus on if Avast is creating this, and if so, why it isnt getting cleaned up during uninstallition.
-
if you tested the file at virustotal (there is noting to download) you browse to the file and scan it
I uploaded the file to be scanned yet I keep getting a pop-up that simply say's "Oops!". No reason or anything else... just "Oops!" Then it seems to just sit there spinning its icon like its still trying but nothing more happens. But again Id rather focus on if Avast is creating this, and if so, why it isnt getting cleaned up during uninstallition.
Did you ever get a reply as to whether or not that's a folder that should be there in the first place? It would seem to me that with all the avast users, someone should be able to look at his folders and provide a definitive "yes" or "no" answer. The one response you got wasn't looking at the right folder (it was in Windows, vs C:\).
-
If it is in the sandbox then clearing that data should remove it
As to whether it is a part of Avast or not I can not give an answer
A full Avast uninstall using aswClear should remove it
-
If it is in the sandbox then clearing that data should remove it
As to whether it is a part of Avast or not I can not give an answer
A full Avast uninstall using aswClear should remove it
I agree, but as we can read... this didnt happen :(.
Did you ever get a reply as to whether or not that's a folder that should be there in the first place? It would seem to me that with all the avast users, someone should be able to look at his folders and provide a definitive "yes" or "no" answer. The one response you got wasn't looking at the right folder (it was in Windows, vs C:\).
Not yet... gotta check with support but for some reason they misunderstood the question and then attached it to a ticket it had NOTHING to do with. Im actually getting MUCH better information from here than the support site >:( I paid for the product from 8) . But youre right, all examples I can find on this file on the net put it in the Windows directory, nothing about it being in the root and then Iv not heard of anyone having this Avast! Sandox directory on their root of C:\ by default either ??? . Nor why 'aswclear' wouldnt take care of it. Even tried a second un-installation/re-installation. Also, tried changing the folder Sandbox saves in... nothing worked. Am getting close to just formatting as Iv put a couple things off, due to not knowing why this is happeneing, or if I may be being exploited :-X.
I would love to get with an actual Avast Developer and let them remote me to check it out... I dont think thats gona happen :'( . Im gonna try and make time today to call iYogi, but as Iv stated that gets ENTIERLY frustrating :o!!!
Off topic, if you read my thread I put up thanking Avast for Android Avast! and understanding nothing is unhackable, one can imagine that I might be a 'slight' target. Im putting out information even honest dev's take offense to. Im licensed, internatioanly, as a business 'open source' support provider; so dont take it as Im some dude against open source projects. Unfortunatly, the code I support doesn't break down much 8) ... just the OS/OE (operating envirmoent) its running on so I aint gett'n rich anytime soon :-[.
-
I had a problem yesterday when Wiondows told me Avast was not running. Uniinstalled, used aswclear from safemode. A directory on root of c:/ was left, entitled "avast! sandbox" with multiple directories. Could not get folder/ file to delete even from safe mode. Traced the problem to one file called "rescache.hit". All google searches suggest this is some kind of virus but thought Id come here for answers. Have reinstalled but dont get why it wont go away, even when using Admin account.
What is it? Why does it not delete, even with 'aswclear' tool? Can this be addressed?
screenshot shows directory and file name structure on root of C:
How did you decide that rescache.hit is the problem? I had avast crash and it left a sandbox folder with multiple directories on c drive. I couldn't delete the sandbox folder and the directories contained within after uninstalling avast. You need to be logged on as an administrator and change the ownership and permissions. From what I can tell, the crash caused it and it hasn't occurred since then.
-
Hi UserA789,
Rescache,hit has nothing to do with avast as such but with the Windows7 OS. Rescache is part of the MUI and its runtime diagnostics. These are heavily instrumented in the Beta and RC of 2008 R2 but also exist in previous OS's. MUI is multi lingual user interface. The application exists as a language-neutral core binary, plus resources that can be further broken down into one file per supported language. It is important for Vista/Windows7-style applications to start up properly. Are you a developer? From here you can use WAIK for global deployment for Windows 7 to get around these problems: http://www.microsoft.com/downloads/nl-nl/details.aspx?FamilyID=696dd665-9f76-4177-a811-39c26d3b3b34
polonus
-
How did you decide that rescache.hit is the problem? I had avast crash and it left a sandbox folder with multiple directories on c drive. I couldn't delete the sandbox folder and the directories contained within after uninstalling avast. You need to be logged on as an administrator and change the ownership and permissions. From what I can tell, the crash caused it and it hasn't occurred since then.
I am not sure there is a problem, yet the Avast! Sandbox folder holding the rescache.hit file seems to point to some sort of problem/exploit happening to Avast. That, or they need to fix the uninstaller and/or 'aswclear' file to include removing this file. I tried the admin way, even unlocked the REAL admin account. CANNOT change the permissions for said file.
Hi UserA789,
Rescache,hit has nothing to do with avast as such but with the Windows7 OS. Rescache is part of the MUI and its runtime diagnostics. These are heavily instrumented in the Beta and RC of 2008 R2 but also exist in previous OS's. MUI is multi lingual user interface. The application exists as a language-neutral core binary, plus resources that can be further broken down into one file per supported language. It is important for Vista/Windows7-style applications to start up properly. Are you a developer? From here you can use WAIK for global deployment for Windows 7 to get around these problems: http://www.microsoft.com/downloads/nl-nl/details.aspx?FamilyID=696dd665-9f76-4177-a811-39c26d3b3b34
polonus
Im sure that is all true, however this version of the file IS NOT in the windows directory, but a direcotory created by Avast. If you could kindly read the rest of this thread, that would be obvious along with your answer already being looked at as a possibility. Also, I AM NOT runing a RC release. This is a final version of Windows 7, but I dont think that matters as for your answer and it not being appilcable to this one.
-
Okay...
The Avast Support team hasnt given proper answers either. Iv asked them about the file and all I get is this:
Dear $user$,
You can leve this file and install avast again.
Best Regards
Richard Srank
AVAST Software a.s.
So to reinstate the problem, Iv asked them this and am awaiting the response:
"I would like to remove it so I can have a comepletly clean instalation. That is my stated problem. How can I make this happen? Iv logged in as an administrator and cant delte it, nor change its permissions.
Also, please detail how and why it is created by Avast so I can inform the Avast forum about the resolution."
Id like to ask others how they would ask support about this problem if Im sounding to confusing.
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
OFF TOPIC - Also, since Iv been warned for "using a threatening tone very often" on the forum, which I dont understand (if its just using caps in certain instances I will stop trying to make clear what Im asking) and would appreciate being shown which posts (via private message so this thread is not taken off course) these are and I will be more than happy to correct them as I would hate for this to be honestly true.
Additionally, I just received a message complimenting my behavior and patience from another user over this very thread, here is their remarks( which simply echo my own feelings):
"Honestly...I can't recall ever seeing so many disjointed responses to an original post such as yours in my life. Do people simply not even bother to read what you posted, or are they intentionally trying to throw your post off track? Amazing. Seriously."
If the user who sent this would like their name up here, please do it yourself. Right now, I feel very attacked for simply not leting things get out of hand, or flamed and fanned into insulting copmments. My only hope is that Im not banned for just asking help in correcint my behaviors that seem against the forum policy. For now, I will be emailing VLK top ask his opinion and point out where Im being abusive in tone.
-
"I would like to remove it so I can have a comepletly clean instalation. That is my stated problem. How can I make this happen? Iv logged in as an administrator and cant delte it, nor change its permissions.
If you are absolutely desperate to remove a file that windows won't let you access you could do it from a Linux LiveCD or USB I suppose?
Some micro distro's (eg Slitaz) are a very small download (30 Mb)
-
"I would like to remove it so I can have a comepletly clean instalation. That is my stated problem. How can I make this happen? Iv logged in as an administrator and cant delte it, nor change its permissions.
If you are absolutely desperate to remove a file that windows won't let you access you could do it from a Linux LiveCD or USB I suppose?
Some micro distro's (eg Slitaz) are a very small download (30 Mb)
While removing the file is something I consider of great value; I think it needs addressed how and why it got created, and apperntly by Avast! (if not, why it would be in an Avast! directory). This is an Avast related issue that deserves a complete answer.
Also, I prefer not to use Linux distro's as one can read from a post about my acknowledgement of Avast understadning nothing is unhackable.
-
Well, I don't know what you are confused about.....it is from Avast!'s sandbox, that seems pretty clear to me.
What fact outside of that are you trying to grasp?
-
Well, I don't know what you are confused about.....it is from Avast!'s sandbox, that seems pretty clear to me.
What fact outside of that are you trying to grasp?
Here's the OP's first post:
I had a problem yesterday when Wiondows told me Avast was not running. Uniinstalled, used aswclear from safemode. A directory on root of c:/ was left, entitled "avast! sandbox" with multiple directories. Could not get folder/ file to delete even from safe mode....What is it? Why does it not delete, even with 'aswclear' tool? Can this be addressed?
It clearly states that the folder on the C drive, entitled avast! sanbox remained after a safe mode uninstall using aswclear, and that trying to delete it manually was unsuccessful (and later on he said he thought he boiled down the problem to a particular file in that folder -- rescache.hit). You yourself state or imply that the sandbox folder was created by Avast, which means asking for advice on the Avast forum is appropriate. So it quite clear that he's asking what to do about an Avast-created folder that won't delete even after Avast is uninstalled using Avast's own uninstall utility. (But thanks for your post(s) trying to help. Maybe now that the issue is more clear, a solution will be forthcoming quickly.)
-
Also, I prefer not to use Linux distro's as one can read from a post about my acknowledgement of Avast understadning nothing is unhackable.
I wasn't suggesting that you install Linux - just download an iso and create a liveCD to boot with. On any modern machine it should load entirely into RAM.
-
Well, I recognize that he wonders why the uninstall utility fails to clean it. As far as that goes, the "Why" is more or less pointless, the fact is the removal tool failed to remove it (I wonder if he has tried running it twice?), but yeah, the tool not doing a full clean up should probably be looked at.
But he asks;
I think it needs addressed how and why it got created, and apperntly by Avast! (if not, why it would be in an Avast! directory).
Thats the part I was confused over, it is from the Avast! sandbox, created by Avast!, and anything inside it is from running something sandboxed.
It probably wont go away easy, do to permissions.....you could as mentioned, try a Live CD to remove it but he wont because "nothing is unhackable", I have no idea what that means either, in relation to using a Live CD. The other option is what was mentioned by Support to him....installing Avast! again will let you get rid of it, as it is an Avast! file, the problem with removing it is that he uninstalled Avast! so no one is left in command of the file, its an orphan.
-
Well, I recognize that he wonders why the uninstall utility fails to clean it. As far as that goes, the "Why" is more or less pointless, the fact is the removal tool failed to remove it (I wonder if he has tried running it twice?), but yeah, the tool not doing a full clean up should probably be looked at.
But he asks;
I think it needs addressed how and why it got created, and apperntly by Avast! (if not, why it would be in an Avast! directory).
Thats the part I was confused over, it is from the Avast! sandbox, created by Avast!, and anything inside it is from running something sandboxed.
It probably wont go away easy, do to permissions.....you could as mentioned, try a Live CD to remove it but he wont because "nothing is unhackable", I have no idea what that means either, in relation to using a Live CD. The other option is what was mentioned by Support to him....installing Avast! again will let you get rid of it, as it is an Avast! file, the problem with removing it is that he uninstalled Avast! so no one is left in command of the file, its an orphan.
Okay. So you're suggesting that the one option available, in lieu of using the Linux Live CD, is to re-install Avast, then run the aswclear uninstall utility afterwards, and see if that removes the now orphaned folder? Does he need to install the same version of Avast that he originally installed, or will the current version do? And are there any particular settings in aswclear that will help to assure that the folder in question will be removed? (And would Revo uninstaller in aggressive mode be an option as well?)
And for possible further clarification:
1. Do you have the Avast sandbox folder on the %system% drive that he has on his?
2. Have you ever found that that particular folder would not delete after running an uninstall?
3. Are you saying that since it's an Avast generated folder, it's safe to remove, if at all possible, without harming the OS in any way? So that using a program like File Assassin might work? (if in fact the file he boiled the delete problem down to is actually the file that's keeping the folder from being able to be deleted) Because I know that File Assassin comes with Malwarebytes, and a lot of folks have Malwarebytes on their systems already.
Thanks.
-
So you're suggesting that the one option available, in lieu of using the Linux Live CD, is to re-install Avast, then run the aswclear uninstall utility afterwards, and see if that removes the now orphaned folder?
Yes and No. What I mean is reinstall Avast!....then Avast! should have possession over that file, ideally. Then go into sandbox settings and use the button that flushes the sandbox contents. Then (if you dont want Avast! anymore) remove Avast! normally from Control Panel, and (just as a precaution) run the removal tool in Safe Mode to check if anything is left, and clean it out if it is.
Does he need to install the same version of Avast that he originally installed, or will the current version do?
Should not matter.
And are there any particular settings in aswclear that will help to assure that the folder in question will be removed? (And would Revo uninstaller in aggressive mode be an option as well?)
No, no settings. I guess Revo might be an option here, in lieu of having to re-install and all that. I don't recommend it for everyday uninstalls of security applications, but it might work to clean up an orphan file, but so might File Assassin and another previously mentioned option.
Thing is the OP does not seem to want to be rid of Avast!....he wants the file gone, then he wants to re-install, but that is most likely not needed. Those files are probably there so things can run sandboxed, because when sandboxed, an application is cut off from parts of the system it might be dependent on, so virtual copies are probably needed in some cases.
you will notice my over abundance of Wiki-banned words like "Most Likely, Probably, etc....thats because I'm going mostly on educated guesswork, because I'm not a dev
-
And for possible further clarification:
1. Do you have the Avast sandbox folder on the %system% drive that he has on his?
2. Have you ever found that that particular folder would not delete after running an uninstall?
3. Are you saying that since it's an Avast generated folder, it's safe to remove, if at all possible, without harming the OS in any way? So that using a program like File Assassin might work? (if in fact the file he boiled the delete problem down to is actually the file that's keeping the folder from being able to be deleted) Because I know that File Assassin comes with Malwarebytes, and a lot of folks have Malwarebytes on their systems already.
Thanks.
These are very relavant things that Im surprised no one has goten out of what Iv posted. Thanks you. (1) No one has came and said they have this folder install on thier machines. (2) No one has confimred that it gets 'special permissions' that are not 'admin' (as stated even by the "hidden admin" account) changeable even after uninstalltion occurs. (3) If removal of this will cause system instability, then this needs to be stated, so I can not worry about that and just re-install Windows.
Well, I recognize that he wonders why the uninstall utility fails to clean it. As far as that goes, the "Why" is more or less pointless, the fact is the removal tool failed to remove it (I wonder if he has tried running it twice?), but yeah, the tool not doing a full clean up should probably be looked at.
But he asks;
I think it needs addressed how and why it got created, and apperntly by Avast! (if not, why it would be in an Avast! directory).
Thats the part I was confused over, it is from the Avast! sandbox, created by Avast!, and anything inside it is from running something sandboxed.
It probably wont go away easy, do to permissions.....you could as mentioned, try a Live CD to remove it but he wont because "nothing is unhackable", I have no idea what that means either, in relation to using a Live CD. The other option is what was mentioned by Support to him....installing Avast! again will let you get rid of it, as it is an Avast! file, the problem with removing it is that he uninstalled Avast! so no one is left in command of the file, its an orphan.
The first part is answered above. Secondly; I have tried running it twice... first thing I did actually. To the LiveCD query, why should I have to use something else, other than my original OS, to get rid of it. If I cant, then wouldnt you agree this needs adjustment within Avast development? Logic would dictate it does. Not to mention, Iv had issue with my last DL of the LiveCD, so Id like to just keep it to Windows.
Thanks for getting clarification.
Thing is the OP does not seem to want to be rid of Avast!....he wants the file gone, then he wants to re-install, but that is most likely not needed. Those files are probably there so things can run sandboxed, because when sandboxed, an application is cut off from parts of the system it might be dependent on, so virtual copies are probably needed in some cases.
I have already re-installed Avast!. I wouldn't think of using anything else... yet. That does not lessen this needing attention and fixing. I even tried to get rid of the folder by uninstalling again (along with a third attempt using aswclear)... by trying to change the settings for the 'Sandbox' folder; as it specifically states it will delete the orginal if changed... trying to modify its permissions from actual administrtive account.
Nothing has worked successfully, but more over I think this needs attention from the Avast developer team, along with a fix 'tool'.
-
Okay, I see what you want now....you don't really care if this is fixed for you specifically, so much as you want to figure out how it happened (or have the devs figure it out) so it can't happen to you or anyone else anymore.
I can answer those Qs, though
1: No, but I have the Free version, and I'm assuming you use a paid version of Avast! Plus, I'm cecking from a LUA, it might not even show for me.....and I'm currently locked out of my ADMIN account because my friends love to play PC pranks (changed my admin pass ::))
2: Nope....aswsnx privatestorage has been left a couple time, thats the autosandbox, but the removal tool always killed it if normal method failed.
3: Can't say for certain, sorry. But to the best of my knowledge, everything running sandboxed is a copy, not an original
-
So you're suggesting that the one option available, in lieu of using the Linux Live CD, is to re-install Avast, then run the aswclear uninstall utility afterwards, and see if that removes the now orphaned folder?
Yes and No. What I mean is reinstall Avast!....then Avast! should have possession over that file, ideally. Then go into sandbox settings and use the button that flushes the sandbox contents. Then (if you dont want Avast! anymore) remove Avast! normally from Control Panel, and (just as a precaution) run the removal tool in Safe Mode to check if anything is left, and clean it out if it is.
Does he need to install the same version of Avast that he originally installed, or will the current version do?
Should not matter.
And are there any particular settings in aswclear that will help to assure that the folder in question will be removed? (And would Revo uninstaller in aggressive mode be an option as well?)
No, no settings. I guess Revo might be an option here, in lieu of having to re-install and all that. I don't recommend it for everyday uninstalls of security applications, but it might work to clean up an orphan file, but so might File Assassin and another previously mentioned option.
Thing is the OP does not seem to want to be rid of Avast!....he wants the file gone, then he wants to re-install, but that is most likely not needed. Those files are probably there so things can run sandboxed, because when sandboxed, an application is cut off from parts of the system it might be dependent on, so virtual copies are probably needed in some cases.
you will notice my over abundance of Wiki-banned words like "Most Likely, Probably, etc....thats because I'm going mostly on educated guesswork, because I'm not a dev
Thanks. At least the issues and/or possible solutions are much clearer to me now. (The point of reinstalling Avast so it can own that folder, and then using the Sandbox to flush that file is particularly clear, and it wasn't nearly as clear to me before.) Hopefully, a solution for the OP is right around the corner.
-
(1) No one has came and said they have this folder install on thier machines. (2) No one has confimred that it gets 'special permissions' that are not 'admin' (as stated even by the "hidden admin" account) changeable even after uninstalltion occurs. (3) If removal of this will cause system instability, then this needs to be stated, so I can not worry about that and just re-install Windows.
Not true!
Vlk responded to it here. http://forum.avast.com/index.php?topic=95193.msg759750#msg759750
I have been dedicated to Avast for a number of years. However, the suport via the Support Ticket site is less than sub-standard. I dont get it. I paid for the product and expected the same top notch support that the software demonstrates. They continually combine tickets that have NOTHING do with each other. It seems as though they read the first part and then decide what the rest 'must' be relaying. If an ACTUAL Avast team member gets this, please read the following ticket THROUGHLY (Ticket #OXW-598354). I have files that were NOT cleaned up in by unisntalltion OR aswclear (posted on the forum: http://forum.avast.com/index.php?topic=95063.msg759090#msg759090 ). These are files CREATED by Avast, apparently. See the screenshot in the post.
Is there a problem with these agents and their comprehension? Is it something I said? Is Avast simply biased against the country of orgin?
I dont get it, when the product is so above the rest, why the support seems the same; if not worse. And calling in isnt the answer either. One is simply having to re-state and put into slow, childlike phrases to get ANY help at all. Is it time for me to STOP sharing my great opinions of Avast with the veterans I meet with each month, as once its bought we are left to mostly or own devices and knowledge?
Hi UserA789,
I understand your frustration, but this seems to be quite a hard nut to crack. You seem to be the first person who has ever had the problem (or at least reported it to us).
The Sandbox folder is indeed set so that no one besides the System account can access it. This makes it slightly more difficult to remove.
However, individual files in the folder may be protected by other mechanisms (some even outside of avast) and so removing the folder using regular methods may not be possible.
Vlk
And I mentioned it at reply #24
I had a problem yesterday when Wiondows told me Avast was not running. Uniinstalled, used aswclear from safemode. A directory on root of c:/ was left, entitled "avast! sandbox" with multiple directories. Could not get folder/ file to delete even from safe mode. Traced the problem to one file called "rescache.hit". All google searches suggest this is some kind of virus but thought Id come here for answers. Have reinstalled but dont get why it wont go away, even when using Admin account.
What is it? Why does it not delete, even with 'aswclear' tool? Can this be addressed?
screenshot shows directory and file name structure on root of C:
How did you decide that rescache.hit is the problem? I had avast crash and it left a sandbox folder with multiple directories on c drive. I couldn't delete the sandbox folder and the directories contained within after uninstalling avast. You need to be logged on as an administrator and change the ownership and permissions. From what I can tell, the crash caused it and it hasn't occurred since then.
Like I said, the sandbox crashed which created this condition. It hasn't happened since. Since then, the devs have increased the stability of the sandbox with each release.
There have been several options given to remove the folders/files. All are good options. I removed it in less than 5 minutes by manually taking ownership of it and changing permissions.
You could always create a support bundle under the maintenance tab and upload it to avast. Instructions on how to upload are given once you create the bundle. Add your support ticket # to it.
-
rescache.hit files can be found in windows>rescache folder in various rcxxx folders and is normal.These files cannot be deleted or modified(not recommended imo anyway) unless ownership is taken.I guess thats why they cant be removed from the avast sandbox either unless ownership is taken of them.Logging on as administrator is not ownership enough.
-
rescache.hit files can be found in windows>rescache folder in various rcxxx folders and is normal.These files cannot be deleted or modified(not recommended imo anyway) unless ownership is taken.I guess thats why they cant be removed from the avast sandbox either unless ownership is taken of them.Logging on as administrator is not ownership enough.
That makes sense. But then doesn't that beg the question: Why would Avast put a file in its Sandbox folder that it then can't delete? Since other posters have stated categorically that if it's in that particular folder, Avast had to have put it there, why put a file in an Avast Sandbox folder that then can't be deleted? Isn't the whole purpose of having a Sandbox feature to be able to temporarily house a suspicious file, and keep it from infecting the whole system, and be able to delete that file if it's determined that it's a Trojan or a virus? Is it a possible bug? (i.e. that file should never have been put into that folder in the first place?)
-
How did you decide that rescache.hit is the problem? I had avast crash and it left a sandbox folder with multiple directories on c drive. I couldn't delete the sandbox folder and the directories contained within after uninstalling avast. You need to be logged on as an administrator and change the ownership and permissions. From what I can tell, the crash caused it and it hasn't occurred since then.
Like I said, the sandbox crashed which created this condition. It hasn't happened since. Since then, the devs have increased the stability of the sandbox with each release.
There have been several options given to remove the folders/files. All are good options. I removed it in less than 5 minutes by manually taking ownership of it and changing permissions.
You could always create a support bundle under the maintenance tab and upload it to avast. Instructions on how to upload are given once you create the bundle. Add your support ticket # to it.
CharyB,
I would :-* LOVE :-* to take ownership of the file, but as you pointed out VLK explains this cant happen as it owns by 'SYSTEM' and not Administrtor. Also, I never said this file was what caused the conflict between Windows Security Center and Avast to be reported as not running... BTW, the icon didnt show anything wierd, like the red X-sign, but when opened Avast clearly stated it was not running.
But it was never declared that this rescache file caused that, it was simply stated that I uninstalled and reinstalled Avast after seeing the security notifiaction. After, I went to verify that Avast was completly cleaned and thats when I ran into the 'avast! Sandbox' directory. I could not delete the directory and started having inconsitent problems. I started at the top of the tree and started deleting files inside it to find out what file was stopping the entire tree from being deleted/cleaned. At this point, Im sure the PC in question has been compromised due to other inconsistencies so Im sure Ill just be re-formatting it, most likely, but I may try to duplicate the problem. If it doesnt then Id bet a kick in the jib that Iv ran across an exploit. If it does duplicate, then Im sure that the information can be used by Avast to remedy either the 'Uninstaller' or the 'aswclear' tool.
Either way, something good will come of this, Im sure of it!!! 8)