files aren't repairing

[fakeMacGyver]

I use the home version on WinXP. I've found a couple zip files that are infected and attempted to 'repair' them. On other files, I was told that they couldn't be repaired and I just erased them. On these,  there was no message and process went through...so I thought. I decided to scan the same zip files again out of curiosity & they remained infected.  

Can anybody tell me why this is so & what I can do about it?

[whocares]

Hi,
EDIT: probably because the files are not repairable, i.e. damaged (sorry VLK)

-> Just delete the files manually (maybe you have to pause avast's resident shield to do that)

generally it's a good idea to get information on a specific virus first (via avast's or other virusinfo pages),
then decide if it can be repaired/deleted whatever;
as a compromise, in the meantime you can move the infected files into the chest

 

What virus was detected by avast, and where was it found (full path/Folder/filename) ?

[fakeMacGyver]

Since I usually get a message of how something can't be repaired, yet this one didn't show it, I assumed everything was ok. I extracted the files to a folder and then scanned. The virus (Win95:CIH 1.x) was found inside and this time, when I chose to have it repaired, I was told that it couldn't be. I am still new at this and am confuse how/if anything can be repaired. Over the years, I recall that I used another virus program that very frequently mentioned it had repaired a file, but avast seems to not do any.

It was just a small freeware game that I downloaded somewhere, so it wasn't a bit deal.

[whocares]

The virus (Win95:CIH 1.x) was found inside

Hi,
please
a) first tell us the exact name and extension of the file,
b) scan it with Trend & KAV (see below) to confirm the CIH-infection (pause avast shield for this)
c) then delete it immediately

SKIP b) if you don't know 100% what you're doing there

[RejZoR]

Aaaaah i'm searching for CIH virus for almost month :'( ,but i'm not allowed to ask users to send me viruses for my collection (ups i just did it). Grrr... more luck next time. Or just give me hint on where did you get it

[techie101]

Rez....
Why would anyone want to collect viruses!

Mac....
You have a nasty little virus on your hands...It is a Chernobyl variant.  I quote from Symantec:

"As of August 3, 1998, the KILL_CIH tool was designed to safely detect and remove all known strains of the W95.CIH (Chernobyl) virus from memory under the Windows 95 and Windows 98 systems; the W95.CIH virus cannot infect the Windows NT/2000 systems. If the tool is run before the virus infects the system, the tool will also inoculate the computer's memory to prevent the W95.CIH virus from infecting the system until the next system reboot.

Note: If your computer is already infected with the W95.CIH virus, first run the KILL_CIH tool before attempting to update the virus definitions or to scan your system. If you attempt to scan the system with any antivirus product without first running this tool, the infection could spread.

http://securityresponse.symantec.com/avcenter/venc/data/kill_cih.html

Hope this helps,

techie

[Lisandro]

Since I usually get a message of how something can't be repaired, yet this one didn't show it, I assumed everything was ok. I extracted the files to a folder and then scanned. The virus (Win95:CIH 1.x) was found inside and this time, when I chose to have it repaired, I was told that it couldn't be. I am still new at this and am confuse how/if anything can be repaired. Over the years, I recall that I used another virus program that very frequently mentioned it had repaired a file, but avast seems to not do any.

It was just a small freeware game that I downloaded somewhere, so it wasn't a bit deal.

I would be very happy - maybe Erik too   - if anybody from Alwil quote and answer this thread... Sometimes users thought that avast! has one behavior but, in fact, it seems to take another  

[Vlk]

1. With a couple of exceptions, avast is not able to 'repair' viruses in executable files. That's the fact. The reason is that there's only one truly reliable repair operation for file-infecting viruses - backup/restore. I mean, logically, if the virus is overwriting some parts of the original file, avast can't 'repair' it.

The VRDB can help, though. It collects sensitivite info about executable files, and in case of infection, there's a good chance you'll be able to restore the files to their original state with the use of VRDB.

2. whocares, avast actually does pack most archives back. I.e. when deleting/repairing a file in an archive, avast is able to do the operation on the file itself, not the whole archive...

[whocares]

Hi fMG,

at the first time, when you DIDN'T get an error message after trying to repair the file:

was this with avast main scanner, avast resident shield popping up, or ASHQUICK (scan with "explorer-rightclick")?

I ask because I'm having some problems with ashquick when it has to deal with more than 1 Task/virus/action at a time (see end of thread, my 6th posting: http://forum.avast.com/index.php?board=2;action=display;threadid=2985;start=msg22109#msg22109

[fakeMacGyver]

whocares

It was from the Windows Explorer/right click & scanning the archive. The virus was found...I chose to 'repair'...and it continued. I thought that was great, and the problem really was fixed, because it was the first time that I didn't get a notice of how it couldn't be repaired. As I mentioned, when the archive was extracted, the infected file inside was found in the folder and I was then told it couldn't be repaired.

You asked the name of the file. Each of the archives had an infected 'setup.exe'. Sorry, I didn't quite understand the 'scan it with Trend & KAV to confirm the CIH-infection (pause avast shield for this)'.

-----

RejZoR

Who says you couldn't ask for a virus here? As long as you behave. (:

Go to:

http://members.lycos.co.uk/dillhole2003/, 'Dillhole's collection of sh** games'. I was just searching for some of the worst games ever -- and hope to find even more; suggestions welcome. Anybody have similar links?  

A few of the links there didn't work, but I've been talking with the man in charge of the site and he said he'd be fixing them. As for the virus, the same one (Win95:CIH 1.x) was in two of the files I was able to obtain: the 'Pop Larkin' game and 'Smiling Pete' screensaver. Strangely, the author said that the files passed a Norton scan on his machine. Is avast overreacting or is this a case of Norton goofing up?

-----

I've learned that this virus does bad stuff on the 26th of April (since that's the day the Chernobyl accident took place).