system dll isolated in virus chest and can't get it out.

[Undead-Divine-Assassin]

As I suggested in another thread here this sort of thing is a good example of the, in places, less than great  Avast GUI design.

When an action is enabled the user should have it confirmed, via a message box, so they know whether the operation has actually been carried out or not. As it is you just don't know unless you re-click restore and get the message the file already exists. As it is it causes confusion.



 

[twl845]

UPDATE: I just discovered that even though the chest still lists my printer driver, since I have disabled Self Defense Module, the printer is now OK and there is no pop up. Now, can anyone please tell me what I have to do to prevent a re-occurance if I re-enable the Self Defense Module. Thanks again. 

[twl845]

UPDATE: I unchecked "Self Defense Module" temporarily. Upon doing that Avast does not send another pop up, although my printer driver is still listed in the chest, and my printer now works OK. Can you give me any advice so I can re check the self defense module? Thanks again for your help. 

[bob3160]

UPDATE: I unchecked "Self Defense Module" temporarily. Upon doing that Avast does not send another pop up, although my printer driver is still listed in the chest, and my printer now works OK. Can you give me any advice so I can re check the self defense module? Thanks again for your help. 

The self defense module protects avast! from being tampered with. It has nothing to do with protecting your files.

[twl845]

when you restore a file from chest, a copy will remain in chest ....
is that what you see?.... or does it not go back to orginal location


how to ....   avast! 8.x: Using the Virus Chest
http://www.avast.com/faq.php?article=AVKB21


and you find lots of how to stuff in the FAQ section, just search.    http://www.avast.com/faq.php

Thanks for sending the faq section on the virus chest. I'm checking it out.

[twl845]

Update: After trying to think of ways to remove my printer driver from quarantine, I did a restore with my AX64 Time Machine Rescue Disk, and upon boot up I immediately unselected the Self Defense Module in Avast. Then I checked the Virus chest and my printer drive was gone. My printer is up again printing OK. Now, can anyone tell me how to prevent the problem from re occurring when the self defense module is re selected? I have the path and name of the file written down, but I can't seem to navigate to it. Thanks in advance.

[bob3160]

I again repeat my last reply:

UPDATE: I unchecked "Self Defense Module" temporarily. Upon doing that Avast does not send another pop up, although my printer driver is still listed in the chest, and my printer now works OK. Can you give me any advice so I can re check the self defense module? Thanks again for your help. 

The self defense module protects avast! from being tampered with. It has nothing to do with protecting your files.

[twl845]

I again repeat my last reply:

UPDATE: I unchecked "Self Defense Module" temporarily. Upon doing that Avast does not send another pop up, although my printer driver is still listed in the chest, and my printer now works OK. Can you give me any advice so I can re check the self defense module? Thanks again for your help. 

The self defense module protects avast! from being tampered with. It has nothing to do with protecting your files.

Thanks for your response. I know it doesn't protect my files, but somehow it prevents Avast from sending my printer driver to the virus chest as a false positive. Unchecking it was suggested to me and it worked. Go figure.

[bob3160]

Coincidence probably. Certainly not a fact.

[twl845]

Coincidence probably. Certainly not a fact.

OK I'll continue to investigate. Thanks for the heads up.

[twl845]

OK, after realizing that I had Avast set to Send to Virus Chest, and have changed that to Ask, and excluded my driver file in File System Shield settings for now, I re enabled the Self Defense Module. After using my printer I got no suspicious virus alerts. So I guess I'm good. Thanks to all for your help! 

[Milos]

Hi All,
When I accessed a few apps to print something, I got a pop up saying something like a suspicious file was sent to the virus chest. After this, I can't print anywhere. The file is: Name - CNB0265.dll, Location - C:\ windows\system32\spool\drivers/x64\3, Virus - WIN:EVO-GEN(susp)
I tried clicking Restore but couldn't do it by right clicking for choices. I don't know how to get the file out of quarantine, and I don't know how to reverse this and eliminate the file from being quarantined again. I did a full scan which produced no infections before the pop up occurred, and did a Malwarebytes scan too. I right clicked the virus name in quarantine and it says (no virus). So If someone could please help me I would be really grateful. Thanks in advance.

Hello,
majority of Evo-gens and FileRepMalware are alerted only on access not during on demand scan.

Milos

[jefferson sant]

OK I'll continue to investigate. Thanks for the heads up.

seems to me that the virus lab did not receive the file
We need you sending that samples to analyze.

[twl845]

OK I'll continue to investigate. Thanks for the heads up.

seems to me that the virus lab did not receive the file
We need you sending that samples to analyze.

Sorry I didn't know how to send it. As I mentioned in post #25 The problem no longer exists and all is OK. Thanks for your help and concern.