Win32:CTX virus??

[2harts4ever]

Good morning everyone,

I am a 'newbie' with 'avast!' having just switched from another program yesterday.

On my very first scan Avast! found a virus and recommended I put it in my Virus Chest ... which I did!

The information on this item (the best I can make out) is:

Name:  pskavs.dll

Original Location: C:\WINDOWS\system32\ActiveScan

Last Changes: 4-12-06

Virus:  Win32:CTX

My previous Anti-virus program,  as well as a few online scanners I utilize from time to time,  never reported this item. 

What should my next step be?

Thanks and regards,

2harts4ever

[igor]

See here, please.

[2harts4ever]

Morning igor,

Thanks for the fast reply and the link you provided.

Do I understand it correctly that this is Avast! picking up something from my Panda online scans and that it really is a 'false positive'?

If my assumption is correct how do I get Avast! to ignore it next time?

Thanks and regards,

2harts4ever

[igor]

You can put the folder into the list of avast! exclusions, e.g. in the form
C:\WINDOWS\system32\ActiveScan\*
preventing avast! from scanning the files next time.
Note that there are actually 2 exclusion lists - one for the on-demand scanners (in program Settings / Exclusions), the other for Standard Shield resident provider (in Standard Shield configuration, on the last page). So, you might want to put the mask into both of them.

[2harts4ever]

Hi igor,

Thanks for the speedy update.

I think Avast! and I are going to get along just great.

Thanks and regards,

2harts4ever

[2harts4ever]

Hi again igor,

I did as you suggested:

Note that there are actually 2 exclusion lists - one for the on-demand scanners (in program Settings / Exclusions), the other for Standard Shield resident provider (in Standard Shield configuration, on the last page). So, you might want to put the mask into both of them.

Now, do I remove or delete  this file from my Virus vault?

If so, how?

I have to do some 'honey-do's' so I will check back in when I return.

Thanks and regards,

2harts4ever

[DavidR]

In the virus chest, Infected Files section, Select the file you want, Right Click on the file and select Restore, that will send it back to its original location.

[2harts4ever]

Hi DavidR,

That did it!

Thanks and regards,

2harts4ever

[DavidR]

No problem, welcome to the forums.

[2harts4ever]

Howdy,

I hope you folks are still monitoring this post because this Panda file (pskavs.dll) is still haunting me.

I followed the directions Igor gave me to have Avast! stop detecting it:

You can put the folder into the list of avast! exclusions, e.g. in the form
C:\WINDOWS\system32\ActiveScan\*
preventing avast! from scanning the files next time.
Note that there are actually 2 exclusion lists - one for the on-demand scanners (in program Settings / Exclusions), the other for Standard Shield resident provider (in Standard Shield configuration, on the last page). So, you might want to put the mask into both of them.

And that fix works as far as keeping Avast! from detecting it on new scans.

However, today, I tried to run an on-line scan with Panda for the first time since installing Avast! and when it got to downloading the 'pskavs.dll' file in oder to run the Panda on-line scan the Avast! virus alert went off.

Is there a setting I can activate which will allow me to still utilize the Panda On-line scan from time to time?

This is what I put in the exclusions to have Avast! stop detecting it:
C:\WINDOWS\system32\ActiveScan\*

Did I enter it wrong?

Thanks and regards,

2harts4ever

[DavidR]

The alarm probably came from the web shield as it scans http traffic, what does the avast Log Viewer say the location of the if as you say whilst downloading it is the web shield.

When running any other security based on-line scan I recommend you pause web shield for the duration of the scan. Personally I wouldn't use Panda it is too much hassle with its unencrypted signatures and there are plenty of others that you could use. On-line Virus Scanners and other useful Links Security-Ops.eu.tt

[2harts4ever]

Hi DavidR,

Glad you are still around.

Thanks for the timely response as well as the link.  It looks like it is full of 'goodies'.

Thanks and regards,

2harts4ever