Author Topic: avast virus chest  (Read 9171 times)

0 Members and 1 Guest are viewing this topic.

jukos

  • Guest
avast virus chest
« on: January 12, 2013, 07:10:21 AM »
 
i plugged in usb and avast sent some of the files to virus chest as a threat.. Few of those are very important to me, i want to restore those files... how?

Offline DJBone

  • Avast Evangelist
  • Starting Graphoman
  • ***
  • Posts: 6366
Re: avast virus chest
« Reply #1 on: January 12, 2013, 07:37:18 AM »
Hello and welcome to the forum! :)

Go to the virus chest and rightklick the file(s) and choose restore.

DJBone
Win10 x64, APS (always latest version)
Avast Mobile Security (always latest version)

jukos

  • Guest
Re: avast virus chest
« Reply #2 on: January 12, 2013, 08:53:44 AM »
 thank you..

 where do i look for virus chest ?

Offline DJBone

  • Avast Evangelist
  • Starting Graphoman
  • ***
  • Posts: 6366
Re: avast virus chest
« Reply #3 on: January 12, 2013, 08:55:43 AM »
Open avast GUI --> Maintenance tab --> virus chest

DJBone
Win10 x64, APS (always latest version)
Avast Mobile Security (always latest version)

Offline DavidR

  • Avast √úberevangelist
  • Certainly Bot
  • *****
  • Posts: 89421
  • No support PMs thanks
Re: avast virus chest
« Reply #4 on: January 12, 2013, 01:52:47 PM »
There is little point in just restoring as avast should detect and alert again.

@ jukos
What are the file names and malware name given on the files sent to the chest ?

Why are they important to you (?)
If the detections are good, they are infected. Anything that you consider a false positive (the only real reason for restoration), shouldn't just be ignored, restored or excluded from scans (avast), that is shooting the messenger rather than treating the problem.

Confirm by examination (virustotal) that it is indeed an FP, if so send the sample for analysis and correction of the detection signature plus inclusion in a signature update. This helps all avast users.
~~~~
You could also check the offending/suspect file at: VirusTotal - Multi engine on-line virus scanner and report the findings here, post the URL in the Address bar of the VT results page. You can't do this with the file securely in the chest, you need to Open the chest and right click on the file and select 'Extract' it to a temporary (not original) location first, see below.

Create a folder called Suspect in the C:\ drive. Now exclude that folder in the File System Shield, Expert Settings, Exclusions, Add, type (or copy and paste) C:\Suspect\*
That will stop the File System Shield scanning any file you put in that folder.

####
If only GData and avast detect it - GData uses avast as one of its two scanners so counts as 1 detection and almost certainly an FP.
Send the sample to avast as a False Positive:
Open the chest and right click on the file and select 'Submit to virus lab...' complete the form and submit, the file will be uploaded during the next update. A link to this topic wouldn't hurt.

@@@@
- In the meantime (if you accept the risk), add the full path to the file to the exclusions lists (see Note below):
File System Shield, Expert Settings, Exclusions, Add and
avast Settings, Exclusions

Restore it to its original location, periodically check it (scan it in the chest), there should still be a copy in the chest even though you restored it to the original location. When it is no longer detected then you can also remove it from the File System Shield and avast Settings, exclusions lists.

Note: When using the Browse button it only goes down to folder level accept that. Now open the entry in the exclusions and change the \* to \file_name.exe where file_name.exe is the file you want to exclude.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.6.6121 (build 24.6.9241.848) UI 1.0.809/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security