Avast! , Redlof and WinMe

[rlndsgrb]

Avasts! insists on find out Redlof............in the _RESTORE folder !
No other folder is infected...
Other AV get "access denied " on this folder and do not scan it.
Is it an Avast bug or a my virus ?
These are the three last scan of this last week.Of course I had
resetted SR atfer each scan. Is someone (Alwil Member...) interested
to the last "058.CPY" file ?

Thanks,regards rolando.
 

 

c:\_RESTORE\TEMP\A0011552.CPY [L] VBS:Redlof (0)
c:\_RESTORE\TEMP\A0011558.CPY [L] VBS:Redlof (0)
c:\_RESTORE\TEMP\A0011574.CPY [L] VBS:Redlof (0)


c:\_RESTORE\LOGS\vxdalt1.log [L] VBS:Redlof (0)

c:\_RESTORE\TEMP\A0000058.CPY [L] VBS:Redlof (0)

[raman]

An easy one: Use this guide to solve your Problem
http://vil.nai.com/vil/SystemHelpDocs/DisableSysRestore.htm

[rlndsgrb]

Yes, if it was a virus.......................
I think it isn't a virus and I cannot disable SR every day
for a fause positive!
Regards,rolando.

[raman]

Yes, it sounds a little bit like false Alarm. You can send the files to support@aws.cz to validate that. Or do it on your own by using this link: http://www.kaspersky.com/remoteviruschk.html

BTW: Does it mean the mentioned infected files come back again and again? Normaly after disable, restart and enable the Systemrestore the files should be gone.

[rlndsgrb]

I would not say that " infected files come back again and again " , but that false psitive Redlof come again and again !

Code: [Select]

disable  and enable the Systemrestore the files should be gone. Yes ,all of the files would be deleted ....BUT all checkpoints to recover the System would be lost ! And now I have many patches that I could have to uninstall .
I have  posted because I beleved that Alwil members
were interested to a false positive....Just to get a more
reliable Avast!4 .

Regards , rolando.

[raman]

Yes ,all of the files would be deleted ....BUT all checkpoints to recover the System would be lost ! And now I have many patches that I could have to uninstall .

Remember the Systemrestore is not an uninstaller tool. It will restore the system to that point the Restorepoint is set. So if you install a tool and than an other and you want to delete/uninstall only the last one you will lose the first one too, because the restorepoint was set before the installating the first tool.

And about the false alarm thing: send them to the Avast-support, because we are only Avat user( exept the Alwillteam members of course)

[whocares]

Hi,

to check for false alarms:
you can boot your PC with a WIN-Bootdisk, and copy the seemingly infected files from the Restore-folder to a user-folder of your choice.
After a normal reboot, you can scan the files with other scanners.
Be sure to use "Scan-all-Files"Mode in the other scanners, and to disable Avast resident shield beforehand.
This procedure shouldn't hurt your Win-SystemRestore-Points at all, but give you some info about false alarm or not.


 

[rlndsgrb]

Hi Raman,
I know as SR works.I use it when a patch is uninstallable.
 

Code: [Select]

 And about the false alarm thing: send them to the Avast-support, because we are only Avat user( exept the Alwillteam members of course)  
Alwillteam do not seem interested. So I am.

Hi whocares,
A virus in SR folder cannot damage the system (unless I
I did a SR ). Other AV scanners do not find any virus.