Author Topic: virus chest - 'add' copies file not move it  (Read 5231 times)

0 Members and 1 Guest are viewing this topic.

REDACTED

  • Guest
virus chest - 'add' copies file not move it
« on: August 16, 2014, 09:29:43 AM »
i'm trying to manually add an executable to the virus chest using the 'add' function, but files are being copied to the chest - not moved to the chest. this is ok for files i can delete from their original location, but for files i can't delete they can't be isolated in the chest.

am i missing something here? using version 2014.9.0.2021

Offline igor

  • Avast team
  • Serious Graphoman
  • *
  • Posts: 11849
    • AVAST Software
Re: virus chest - 'add' copies file not move it
« Reply #1 on: August 16, 2014, 10:07:41 AM »
Yes, that's intentional - adding a file to chest just "copies" the file to chest. avast! doesn't delete undetected files.

Offline Pondus

  • Probably Bot
  • ****
  • Posts: 37507
  • Not a avast user
Re: virus chest - 'add' copies file not move it
« Reply #2 on: August 16, 2014, 10:29:04 AM »
how to use the chest.    http://www.avast.com/faq.php?article=AVKB21

why do you want to move these files to chest ?



REDACTED

  • Guest
Re: virus chest - 'add' copies file not move it
« Reply #3 on: August 16, 2014, 10:40:41 PM »
ok - thanks for the info. that is confusing - all documentation/instructions i've seen state that using 'add' will 'move' the file to the virus chest - not copy it.

Pondus i wanted to move files for Lojack (Absolute Software Corp) and a windows media player file to the virus chest to block them from executing. I can block them with online armor, but get loads of pop ups when they try to run. since i can't delete any of these files (Lojack just reinstalls itself) i guess i can't use the virus chest for this.

Online DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 88900
  • No support PMs thanks
Re: virus chest - 'add' copies file not move it
« Reply #4 on: August 16, 2014, 11:09:59 PM »
ok - thanks for the info. that is confusing - all documentation/instructions i've seen state that using 'add' will 'move' the file to the virus chest - not copy it.

Pondus i wanted to move files for Lojack (Absolute Software Corp) and a windows media player file to the virus chest to block them from executing. I can block them with online armor, but get loads of pop ups when they try to run. since i can't delete any of these files (Lojack just reinstalls itself) i guess i can't use the virus chest for this.

Avast only moves things to the chest that it has actually detected as malware. Add to the chest only adds a copy of the file, the original remains in place; it has been that way for a very long time. This in a way is similar to Restoring a file from the chest, a copy remains in the chest.

Well if avast were to 'move it' rather than 'add' a copy to the chest, then that would essentially be the same as deletion surely as it wouldn't be in the expected location. Wouldn't Lojack do the same thing, reinstall to replace missing files.

Surely the point of having LoJack for Laptops® (presumably this is what yo have) installed is for hardware protection; if you are going to try crippling/circumventing it, should you even have it installed ?
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.2.6105 (build 24.2.8918.824) UI 1.0.799/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

REDACTED

  • Guest
Re: virus chest - 'add' copies file not move it
« Reply #5 on: August 17, 2014, 07:42:29 AM »
Avast only moves things to the chest that it has actually detected as malware. Add to the chest only adds a copy of the file, the original remains in place; it has been that way for a very long time. This in a way is similar to Restoring a file from the chest, a copy remains in the chest.

Thanks for the reply DavidR... I understand this now - my point was just that the documentation does not suggest the file will be copied

Well if avast were to 'move it' rather than 'add' a copy to the chest, then that would essentially be the same as deletion surely as it wouldn't be in the expected location. Wouldn't Lojack do the same thing, reinstall to replace missing files.

my assumption as well, but still wanted to see what would happen. however, it would have worked to block windows media player network share wmpnscfg.exe which for some reason won't shut down.

Surely the point of having LoJack for Laptops® (presumably this is what yo have) installed is for hardware protection; if you are going to try crippling/circumventing it, should you even have it installed ?

i did not install. Lojack comes pre-installed on many laptops and is bundled with other downloads. the files are supposed to be disabled until you purchase a license for Lojack - but this is not the case - my firewall is constantly blocking Lojack files. From what i've read, information on location and installed apps is sent out at every boot regardless of whether you have a license or not - creepy...

but i've found that oddly the files are easily disabled by selecting 'deny' for 'read and execute' in the security tab of the file properties - or of course you can just block them from sending info with a firewall.

i haven't found a solution to disable wmpnscfg.exe other than blocking with online armor

Online DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 88900
  • No support PMs thanks
Re: virus chest - 'add' copies file not move it
« Reply #6 on: August 17, 2014, 04:39:38 PM »
Surely LoJack must have an entry in Programs & Features to remove it ?
Though it may well be hidden given the nature of the program, they wouldn't want the thief to be able to easily remove it.

I would visit their website/forum and look for ways to remove (or disable) the it.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.2.6105 (build 24.2.8918.824) UI 1.0.799/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Offline Pondus

  • Probably Bot
  • ****
  • Posts: 37507
  • Not a avast user
Re: virus chest - 'add' copies file not move it
« Reply #7 on: August 17, 2014, 04:46:46 PM »

REDACTED

  • Guest
Re: virus chest - 'add' copies file not move it
« Reply #8 on: August 18, 2014, 07:42:09 AM »
Surely LoJack must have an entry in Programs & Features to remove it ?
Though it may well be hidden given the nature of the program, they wouldn't want the thief to be able to easily remove it.

haha - good one - it has recovery files in the bios to reinstall itself - and apparently many factory installs can even repair the bios if you try to edit or flash it.

I would visit their website/forum and look for ways to remove (or disable) the it.

Apparently Absolute Software will remove the files if you can prove the laptop is yours. i've disabled Lojack - see my previous post -



REDACTED

  • Guest
Re: virus chest - 'add' copies file not move it
« Reply #9 on: August 18, 2014, 08:03:09 AM »
some hits came up   ;)    http://lmgtfy.com/?q=how+to+uninstall+LoJack

thanks for the info - i've looked through most of these already, but there was one new method... stop rpcnet service - delete/replace the Lojack files with 'notepad' files of the same name - set the notepad dummy files to 'read only' - reboot.

as i mentioned above, i disabled Lojack by setting 'read & execute' to 'deny' in the file properties security tab for each Lojack file.

unfortunately both of these methods leave the repair files in the bios intacted, but i don't want to tinker with the bios and potentially mess things up.

Offline mchain

  • Avast Evangelist
  • Ultra Poster
  • ***
  • Posts: 5564
  • Spartan Warrior
Re: virus chest - 'add' copies file not move it
« Reply #10 on: August 18, 2014, 08:31:17 AM »
I'd leave the bios alone, no sense in risking a chance of bricking your laptop over this. 

I took the time to check out Absolute Software's FAQ's and discovered that LoJack is not limited to just laptops, it can also be installed on PC desktops too.  Really, a better solution would be to encrypt the entire drive, it would seem to me, and keep a second drive copy (unencrypted?) around in case the original drive was stolen along with the laptop or PC.

At least with encryption, you wouldn't have to deal with the issues you are dealing with now.  But, be aware that encrypting the main drive would mean that if the password was lost or forgotten, there would be no easy way to regain access to the drive again.

Only advantage to LoJack, really, is the promised ability to recover the system if lost or stolen. 

Pity it came pre-installed on your system.  There should be a way to remove it if it is not wanted, as soon as you get your laptop, and that removal should be relatively painless to do.  Simple as that. 

Looks like you need to contact Absolute in any case to get your system to work the way you want it to.  Doesn't look like there is any other way to do it. 
Windows 10 Home 64-bit 22H2 Avast Premier Security version 24.1.6099 (build 24.1.88821.762)  UI version 1.0.797
 UI version 1.0.788.  Windows 11 Home 23H2 - Windows 11 Pro 23H2 Avast Premier Security version 24.2.6105 (build 24.1.8918.827) UI version 1.0.801

REDACTED

  • Guest
Re: virus chest - 'add' copies file not move it
« Reply #11 on: August 18, 2014, 10:15:34 AM »
Only advantage to LoJack, really, is the promised ability to recover the system if lost or stolen. 

i wouldn't bank on that - the methods to disable it that i posted above are pretty simple - even i figured it out  :)

Looks like you need to contact Absolute in any case to get your system to work the way you want it to.  Doesn't look like there is any other way to do it.

i'm not going to bother - it's disabled - so as long as it stays that way i'm happy