Disappearing Reappearing "Threat found!" note in Internet Security

[REDACTED]

Hi everyone,
I've had something odd happen to me a couple of nights this week--I run a full scan of my hard drive, external harddrive, and a rootkin scan every night.  It might be excessive, but I'm a PhD student, and last fall, I had a problem with malware that rendered me computer-less for a couple of weeks, so I'm not taking any chances. 

I'm running Internet Security on Windows 7. 

Last night (7/22), after the scan, "Threat found!" appeared.  When I clicked the blue "Details" button, nothing happened.  When I hit the report button, I got a message saying that the directory couldn't be found, and indeed, it doesn't seem to exist on the computer.  If I click the link toward the bottom of the Avast! window for the scan history, the only notation from the recent scan is that some files could not be scanned.  When I click on the "Detailed Report" link, the only tab that appears is the "Warnings" tab with the note that files couldn't be scanned because either an archive was password-protected or a file was a decompression bomb, but there is no note about a virus of any kind.  (Most nights, these are the results I get.)

The only scan that states that a virus was found is from 7/2, and it is six versions of an HP-related file in various subfolders in my HP program folder (hpzscr01.exe).  I looked the file up, and apparently, it's a legitimate file so I've thought that was a false positive.  (Though I am not sure why there are multiple versions of it in different folders.) 

I've also run Malwarebytes, TDSS Killer, and iObit Malware Fighter, and none of them has picked up anything.  (Malwarebytes and iObit have caught things in the past.)

So, I have three questions at the moment that I hope someone(s) might have the answers to.
1.  Where are the reports supposed to be filed?
2.  Why might clicking on the "Details" button do nothing?
3.  Since I run this same scan every night, why isn't this threat picked up every night?

Please let me know if there's more information that you might need (though it might take a day or two before I can get it). 

Thanks for any help you can provide,
Leigh

[REDACTED]

You got the message that files could not be scanned because it was Avast's way of doing housekeeping because you are going overboard in doing scans.  Most people do a Quick scan weekly and a Full scan once a month; a Boot scan is only required when there is a problem found.  If you back off on some of the scanning, you shouldn't get this message (or shouldn't get it as much since your logs as now so long).

I'm assuming you have an Hp machine.   Here is a link to the message you got re: malware on 7/2  http://www.file.net/process/hpzscr01.exe.html.  Where is this file now...in the Virus Chest or did you delete it?  If you need assistance in removing it, let us know and we will arrange a malware specialist to assist.

BTW, are you using MBAM Premium (resident) or on-demand?  The Premium will provide you better protection.

[Pondus]

I've also run Malwarebytes, TDSS Killer, and iObit Malware Fighter, and none of them has picked up anything.  (Malwarebytes and iObit have caught things in the past.)

IOBit info
http://www.malwarebytes.org/forums/index.php?showtopic=29681
http://www.malwarebytes.org/forums/index.php?showtopic=30989
http://www.malwarebytes.org/forums/index.php?showtopic=33217

[coldair]

I am having the same problem this morning with the latest build of internet security, running on a win 7 64 machine.
the other odd behaviour IS is having is under scans to perform I get a bunch of question marks

[Asyn]

I am having the same problem this morning with the latest build of internet security, running on a win 7 64 machine.
the other odd behaviour IS is having is under scans to perform I get a bunch of question marks

1. Download avast! Internet Security: http://files.avast.com/iavs9x/avast_internet_security_setup.exe
2. Follow instructions: http://www.avast.com/uninstall-utility (Run this tool for all prior installed avast! versions..!!)
3. Reinstall avast! with the downloaded installer from point 1.
4. Reboot.

[REDACTED]

Hi, all,

Thanks so much!
Pondus, thanks for those links.
SafeSurf, I am using the Premium version of MBAM. 

I haven't removed the HP files, but I can.  (I have a Dell, but an HP printer.)  I had seen that it was an HP file, and since it was in the HP folders, I didn't immediately worry about it; nothing else picked it up, and the computer hasn't been behaving oddly.
 
But, I'm still confused about why Avast sometimes says "Threat Detected!" after a scan and sometimes not?  (And then, clicking the "Show Results" button doesn't seem to do anything.)

I can do fewer scans as you suggest, but if I'm running the same scan and not removing anything, wouldn't it find the same problem(s) every night?  I'm not sure whether it is referring to those HP files or to something else, because I can't seem to see the results.

Should I follow Asyn's suggestion to coldair and reinstall the program?

And where are the logs supposed to be stored?  If I could see those, I'd at least be able to figure out what Avast! is finding, even if I can't seem to do it through the program interface. 

Again, thank you! 

[Alikhan]

Yes, you need to do a clean install. Your avast! install is corrupt. You can tell that easily by the "?"

This could be one of the reasons why the scan has nothing in results but finds threats. If after the uninstall it has the same issue you'd need to bump the post.

You can follow either mines or Asyn's clean install option.

1. Download Avastclear, Rejzors uninstall tool and the appropriate Avast program edition

Note: It's important you used the stub online installer from the one I linked.. NOT the offline one.

Note: You need to be ONLINE during this install (online installer works in all cases whereas offline sometimes doesn't)

http://files.avast.com/iavs9x/avast_free_antivirus_setup_online.exe
http://files.avast.com/iavs9x/avast_pro_antivirus_setup_online.exe
http://files.avast.com/iavs9x/avast_internet_security_setup_online.exe
http://files.avast.com/iavs9x/avast_premier_antivirus_setup_online.exe

Avastclear : http://files.avast.com/iavs9x/avastclear.exe
Rejzors Uninstall tool: http://rejzor.wordpress.com/avast-cleanup-tool/

2. Uninstall Avast by control panel  [If you don't have Avast in control Panel go to #4]
3. Uninstall in safe mode using Avastclear.
4. Run Rejzors Uninstall Utility in Normal Mode (removes traces avastclear doesn't) - reboot.
Check : Once uninstalled check in device manager>view>show hidden devices if there is anything related to avast with a yellow triangle.. if so, uninstall it and reboot.
5. Install the version you downloaded.
6. Reboot.

Note : If you have a paid license, install it after the reboot at stage 6.

[REDACTED]

Hi, Alikhan,
I'm actually the original poster up top.  coldair is is the one who had the in their scan list.  All my scan types are fine.   I can do a clean install this weekend.  I'm in the throes of teaching a class at the moment, so won't have time until later in the week or early next week. 
Thanks!

[REDACTED]

After doing the clean installs, back off on doing the Avast scans a bit (make sure they work first).  As long as you also have MBAM Premium, you are well protected.  So you can enjoy your machine and surf and not have to scan so much. 

[REDACTED]

This is a known problem with the current version.  See also:

https://forum.avast.com/index.php?topic=152437.0

I find it amusing that people would suggest that there can be such a thing as an "excessive" level of running scans. 

And that's beside the point.  Quite clearly, "excessively" running scans has NOTHING to do with the UI popping up and incorrectly reporting a detection.

Don't let others convince you that running fewer scans is any kind of solution.  Use common sense.  Run as many scans as YOU feel comfortable with.  It's YOUR computer.

Reporting the problem here was the right thing to do.  You're clearly not alone, and I imagine it'll be fixed in the next software update.

-Noel


Edit: Bolding removed as I have been informed that it sounds confrontational.