Author Topic: Please help!  (Read 9410 times)

0 Members and 1 Guest are viewing this topic.

Offline Albédo

  • Newbie
  • *
  • Posts: 8
Please help!
« on: September 11, 2003, 10:00:10 PM »
Hello.

I installed Avast! 4 HE yesterday, and just today there was this new
version, 4.1, which I downloaded too.
Off-line, I scanned my Outlook Express files in the relevant folder, and
Avast! warned me it had found a virus in there.
Now, though i'm pretty sure I set a specific folder for Avast! to put
infected files in, the program just seems to have deleted my in-mail box
altogether! Four years of mails have disappeared! When I go "Chest", there's
no file to be found in there, though Windows' Explorer sees several :

00000001    413 Ko
00000002    21 Ko
00000003    94 Ko
00000004    41 792 Ko

Of course 00000004 seems to be my lost file (both size and time match), but
PLEASE is there any way I can recover the file?

Hoping for an answer as soon as possible,
Sincerely desperately yours!

a.

PS I did ask the program to write the reports as .txt, but I can't find any
(as I hope such a log would help me understand what's happened)!
« Last Edit: September 11, 2003, 10:57:04 PM by Albédo »

Offline igor

  • Avast team
  • Serious Graphoman
  • *
  • Posts: 11808
    • AVAST Software
Re:Please help!
« Reply #1 on: September 11, 2003, 10:19:08 PM »
1. You shouldn't post your key on a public forum - edit the message and delete it, if possible.
2. Did you check all the file cathegories in the Chest?
3. The big file (40 megs) indeed could be your inbox (though right now, I have no idea why it got moved there). The files in the chest are crypted, so you cannot just copy it back; however, if it will be impossible to extract the file from the Chest by other means, we could decrypt it for you - so don't worry.

As for the log - did you check the avast directory (and subdirectories) for a file with corresponding date?
« Last Edit: September 11, 2003, 10:21:03 PM by igor »

Offline Albédo

  • Newbie
  • *
  • Posts: 8
Re:Please help!
« Reply #2 on: September 11, 2003, 11:17:29 PM »
Oh boy! I just wrote an answer, and then the program let me go as far as "post" before informing me I had not logged in -- so the whole text has gone!
Here I go again anyway...

1. sorry about that; I just edited my post
2. I did try the Chest categories, but once again the "Chest" interface (as reachable from within the Avast simple user interface) is empty, although the Explorer does show those four files I mentionned before -- I forgot to say there's a fifth one called "index.xml" in there too, which is one minute younger than the 40 megs file. I just found how to force the program into creating plain, *.txt logs, but it's a little too late now... /:-\
3. you wrote : "if it will be impossible to extract the file from the Chest by other means, we could decrypt it for you - so don't worry" -- that's nice, but man I AM worrying A LOT: the program stole four years of e-mails just before my very eyes within a nanosecond and there's nothing I seem to be able to do, so would you please kindly explain what you can do to help me out of this, please? Need I send you that 40 megs file as an attachment to a mail or something?
4. I'll keep looking for whatever log file I can read (what are all those alien *.x* files for anyway? Why can't they just be plain *.txt files I can read?). After all, until someone helps me out, that's all I can do...

Please kindly help me recover my lost file.

Thanks in advance.
Hopefully yours.

a.

Offline Vlk

  • Avast CEO
  • Serious Graphoman
  • *
  • Posts: 11664
  • Please don't send me IM's. Email only. Thx.
    • ALWIL Software
Re:Please help!
« Reply #3 on: September 11, 2003, 11:30:44 PM »
What's in the index.xml file? Can you open it in Internet Explorer? What operating system do you use?
If at first you don't succeed, then skydiving's not for you.

Offline igor

  • Avast team
  • Serious Graphoman
  • *
  • Posts: 11808
    • AVAST Software
Re:Please help!
« Reply #4 on: September 12, 2003, 09:32:32 AM »
The log files are plaintext. If you turned on the option Create report file and kept "Standard program folder", the report file should be in the directory avast4\Data\Report\Simple User Interface.txt  (where avast4 is your avast! installation directory).

Offline Albédo

  • Newbie
  • *
  • Posts: 8
Re:Please help!
« Reply #5 on: September 12, 2003, 01:33:11 PM »
What's in the index.xml file? Can you open it in Internet Explorer? What operating system do you use?

Well, it's a bit strange to me, it looks like html, only I guess it's not really, is it?
Can I send it to you or something?

Thanks in advance...

a.

Offline Albédo

  • Newbie
  • *
  • Posts: 8
Re:Please help!
« Reply #6 on: September 12, 2003, 01:36:57 PM »
The log files are plaintext. If you turned on the option Create report file and kept "Standard program folder", the report file should be in the directory avast4\Data\Report\Simple User Interface.txt  (where avast4 is your avast! installation directory).


I'm afraid the file in data\chest is "index.xml", and I have nothing below \Report, where all I can see is two gif files and one "avast.xls".

I forgot to answer : I use Windows 95B.

...Can't anybody really tell me how to get my file back, please?

Sincerely.

a.

Offline Vlk

  • Avast CEO
  • Serious Graphoman
  • *
  • Posts: 11664
  • Please don't send me IM's. Email only. Thx.
    • ALWIL Software
Re:Please help!
« Reply #7 on: September 12, 2003, 01:57:37 PM »
Can you copy and paste the contents of the index.xml file here?

Thanks,
Vlk
If at first you don't succeed, then skydiving's not for you.

Offline Albédo

  • Newbie
  • *
  • Posts: 8
Re:Please help!
« Reply #8 on: September 12, 2003, 02:25:07 PM »
Hello.
Here's the contents of the index.xml file located under \Data\chest :

  <?xml version="1.0" encoding="UTF-8" ?>
- <aswObject>
  <NewId>00000005</NewId>
- <ChestEntry>
  <ChestId>00000001</ChestId>
  <FileTime>840877860</FileTime>
  <OrigFileName>kernel32.dll</OrigFileName>
  <OrigFolder>C:\WINDOWS\SYSTEM</OrigFolder>
  <Comment />
  <Category>System</Category>
  <TransferTime>1063286679</TransferTime>
  <FileSize>422400</FileSize>
  </ChestEntry>
- <ChestEntry>
  <ChestId>00000002</ChestId>
  <FileTime>890413200</FileTime>
  <OrigFileName>wsock32.dll</OrigFileName>
  <OrigFolder>C:\WINDOWS\SYSTEM</OrigFolder>
  <Comment />
  <Category>System</Category>
  <TransferTime>1063286679</TransferTime>
  <FileSize>21504</FileSize>
  </ChestEntry>
- <ChestEntry>
  <ChestId>00000003</ChestId>
  <FileTime>925905600</FileTime>
  <OrigFileName>command.com</OrigFileName>
  <OrigFolder>C:</OrigFolder>
  <Comment />
  <Category>System</Category>
  <TransferTime>1063286679</TransferTime>
  <FileSize>95910</FileSize>
  </ChestEntry>
  </aswObject>

I sure hope it helps...

Thanks.

a.

Offline Vlk

  • Avast CEO
  • Serious Graphoman
  • *
  • Posts: 11664
  • Please don't send me IM's. Email only. Thx.
    • ALWIL Software
Re:Please help!
« Reply #9 on: September 12, 2003, 02:46:45 PM »
Albedo, please send me the file by email (i.e. insert it as an attachment). The address is in my profile.

Thanks,
Vlk
If at first you don't succeed, then skydiving's not for you.

Offline Albédo

  • Newbie
  • *
  • Posts: 8
Re:Please help!
« Reply #10 on: September 12, 2003, 02:50:39 PM »
Right away, thank you!

On the other hand, one more thing if it might help:
I made a copy of my Outlook Express files on Aug. 19. Since Avast! swallowed my inbox.dbx (is that its proper English name?) just yesterday, I unzipped the backup files in c:\temp and launched eTrust EZ Antivirus, who found nothing suspicious in there.
Then again, Avast! did find :

VBS:Kak-A1 [Wrm] c:\TEMP\trz1040.TMP (no idea what file it is)
VBS:Kak-A1 [Wrm] c:\TEMP\Boîte de réception.dbx (that's "inbox")
VBS:Tam-A    c:\TEMP\Éléments envoyés.dbx (that's "sent box")

So I just downloaded antikak.exe, launched it... and it just found nothing!

So here I am wondering if maybe Avast! just took my inbox.dbx file away... for no reason at all?

Thanks for helping me...

a.

Offline Albédo

  • Newbie
  • *
  • Posts: 8
Re:Please help!
« Reply #11 on: September 12, 2003, 03:05:41 PM »
I just launched the on-line antivirus that can be found at www.secuser.com onto c:\temp, and it found nothing wrong either...

a.

Offline whocares

  • Super Poster
  • ***
  • Posts: 1698
  • I'm not a llama! :-)
Re:Please help!
« Reply #12 on: September 12, 2003, 03:25:44 PM »
the on-line antivirus that can be found at www.secuser.com

Hi,

I'm not so sure if Trendmicro's HouseCall is so hot on scanning of email files/archives

you might try the onlinescanners found on
www.ravantivirus.com  &
www.bitdefender.com

Best use them with IE-Browser;
and be sure to
-disable AutoClean  &
-enable emailscanning

 ;)