Cyberlink users, please run boot scans

[leftisthominid]

Hello, I have Cyberlink Videomagic on my other computer.
On Monday, I did a boot-scan and all was clean. Between then and now I barely used my computer.

Right now I am running a boot scan on that computer and Avast is saying that EffectExtractor.exe and RichVideo.exe are infected by Win32:Evo-gen. I have a strong feeling this is a false positive.

Does anyone else get this problem on boot scan?

[leftisthominid]

I've posted logs here
http://forum.avast.com/index.php?topic=102878.0

Please, someone smart, please look at them.

I am going to run Microsoft Safety Scanner with my wireless off for another opinion

[DavidR]

Personally before running the other scans and posting the logs I would have sought confirmation on the detections.

You could have check the offending/suspect file/s at: VirusTotal - Multi engine on-line virus scanner and report the findings here, post the URL in the Address bar of the VT results page. You can't do this with the file securely in the chest, you need to Open the chest and right click on the file and select 'Extract' it to a temporary (not original) location first, see below.

Create a folder called Suspect in the C:\ drive. Now exclude that folder in the File System Shield, Expert Settings, Exclusions, Add, type (or copy and paste) C:\Suspect\*
That will stop the File System Shield scanning any file you put in that folder.

[leftisthominid]

I told Avast to delete the files though, so I can't check them.

[mchain]

I told Avast to delete the files though, so I can't check them.

Once you delete the files, they are gone forever.  What if the program needs those files to run properly, and Avast! later changes the detection to a false positive?  What do you do then?

Always quarantine, never delete.  Qualification:  If, after two weeks in the quarantine folder, they check out to be still malicious, and your program(s) seem to run fine without them, then and only then, delete from the chest.  Quarantine is a protected area in your system where malicious files are kept away in a safe area, and separate from the rest of the operating system.  They cannot do harm whilst in the chest.

Antivirus vendors routinely check Virus Total for new malware, so submitting a new sample will eventually help everyone later down the road.  So if one could do that, it will help everyone.  It is also useful to determine if a file is likely a false positive when scanned at Virus Total if only 1 or 2 vendors detect.

Deleting leaves no options.

EDIT:  Boot scans are run only when Avast! asks.  Normal real-time scanners (File system, Web scanner, Network scanner, etc.,) are more than sufficient to protect my system.  I almost never run a quick, full or boot scan.  There is no need to, unless an alert box pops up.

Continue on with the thread in the virus section, though.  Since the files were deleted....

[leftisthominid]

Ok, I get it, in the future I should quarantine, not delete.

Can someone look at my logs from the other thread (http://forum.avast.com/index.php?topic=102878.0)?

I just want clarification that I am clean. MBAM, another bootscan, and Microsoft Safety Scanner all said I am clean.

[mchain]

@ leftisthominid,

As I am just an Avast! user with a little technical knowledge, I do not think I can honestly offer the distinguished and discerning judgment of a certified malware specialist.  Therefore, I cannot tell you if or when your system is clean.  This is not my place.

You are in good hands with essexboy, and when he says, at the end, your system is clean, it is. 

I can tell you, however, from the aswMBR log you attached, it is showing you are infected with a rootkit;
 
File: C:\Windows\assembly\GAC_32\Desktop.ini  **INFECTED** Win32:Sirefef-PL [Rtk] 11:11:48.316   
File: C:\Windows\assembly\GAC_64\Desktop.ini  **INFECTED** Win32:Sirefef-PL [Rtk]
(Copied directly from your aswMBR log).

Avast!, according to essexboy in another thread, can detect all versions of Sirefef rootkit.  Some a/v solutions, sadly, cannot yet do so.

So, you are infected, and now at the point where Sirefef can be killed and removed from your system.  Sirefef is a serious infection.

Work with essexboy to get this done.  Let him do his magical wizardry to cleanse your system. 

You are not yet quite there.  Remnants must be removed.  Remnants can come back to haunt you, so....

EDIT:  As leftisthominid has pointed out, I was looking another post.  My mistake and error.  *sigh*

[leftisthominid]

mchain, I did not post any aswMBR log, I do not know where you are getting that I have MBR infection. Please make sure you are reading the right person's logs