avast!: Data of this type is not suported

[Avasthigno]

Hi to everyone,

I am new with Avast. Avast today found infected .zip archive but failed to delete or move it to chest (please look at picture 1). In the same time archive could be deleted to Recycle Bin using standard deletion method. Also, when I extracted the archive which contained infected .exe file Avast detected it and could delete file or move it to chest? 

So, I am a little bit confused. Why Avast failed to delete .rar archive but could delete .exe file that archive contained?

[DavidR]

I don't really know, it may be that it couldn't extract the problem within what is a second archive (the self_extracting_archive.exe) when it might possibly corrupt the original.

You also mention .rar but this seems to have been .zip, there are occasions when avast has problems woth .rar archives, normally when they are multi-level archives.

[Avasthigno]

Hi David, thanks for helping.

I mention .rar by mistake. The archive is in .zip format.

The .exe file is infected with Win32:Trojan-gen {Other}. Is it detected by Avast's heuristic? Some well-known antiviruses cannot even detect this malware (picture 2)

I am not an expert but it seems to me that it is a very interesting peace of malware. Also, in my humble opinion the cause of the problem is malware itself.  If someone in Alwil is willing to look at this malware I will be happy to send it.

[igor]

Can you please upload the ZIP file (wimad dropper.zip) to our FTP: ftp://ftp.avast.com/incoming
I'd like to check that archive.
Thanks.

[DavidR]

Hi David, thanks for helping.
I mention .rar by mistake. The archive is in .zip format.
The .exe file is infected with Win32:Trojan-gen {Other}. Is it detected by Avast's heuristic? Some well-known antiviruses cannot even detect this malware (picture 2)
<snip>

You're welcome, it certainly has the attention of one of the avast developers if you can ftp Igor the .zip archive.

You might want to add this to your checking links as VirusTotal uses the windows versions of software where Jotti is Linux versions I believe and it currently has 39 different scanners - VirusTotal - Multi engine on-line virus scanner.

Welcome to the forums.

[Avasthigno]

I hope that I managed to upload the archive to /incoming folder. When I tried for second time (using FTP client) I logged on but could not to upload the archive. The error message was: "503 Could not create file".

If I not uploaded the archive please give me email address to send.

David, Igor, thank you both. 

[DavidR]

You're welcome.
I don't know if it was just a hiccup, but you don't have read access to that upload location so you can't confirm that it was successfully uploaded, but I'm sure Igor will let us know if it didn't complete.

virus(at)avast(dot)com is the normal address, samples have to be archived and password protected. But it is probably best to wait for Igor to get back to you as this would be one email amongst many, many hundreds of others.

[igor]

Thanks for the file, it was uploaded correctly.
The problem seems to be caused by the block of zeroes, appended after the real end of the ZIP archive. I'll try to do something about it for the next program update.

[Avasthigno]

Hi, me again. 

One more malware which Avast cannot remove. It is a rogue antispyware software Spyblaster (SpyBlaster.msi). This time it is windows installer file (SpyBlaster.msi). Avast did not recognize malware during the downloading. After, during the manual scan detected "Win32:Spyware-gen [trj]" but could not delete it with the message I posted above.

You can download and examine the file on spyblaster.com (attention: do not download and install SpyBlaster, it is rogue antispyware product)

[igor]

I believe the message is different. Maybe similar, but different

Basically, it says that avast! is unable to remove files from inside of MSI installers. Unfortunatelly, there's currently no option in the virus warning to remove the whole archive instead; hopefully in the future versions.

[Avasthigno]

Thanks for the quick reply Igor!

Yes, the message is different: "The operation is not supported for this type of archive" (At least, I did not open new topic  ).