Author Topic: 2015-RC2 Zero bytes file leftovers after quarantining  (Read 5184 times)

0 Members and 1 Guest are viewing this topic.

Offline RejZoR

  • Polymorphic Sheep
  • Serious Graphoman
  • *****
  • Posts: 9406
  • We are supersheep, resistance is futile!
    • RejZoR's Flock of Sheep
2015-RC2 Zero bytes file leftovers after quarantining
« on: October 15, 2014, 11:47:52 AM »
Steps to reproduce:

1. Disable Web Shield

2. Download either of these two files:
http://www.eicar.org/download/eicar.com
https://secure.eicar.org/eicar.com

3. avast! blocks and moves to chest

4. In my Downloads folder, 0 byte EICAR files remain on the disk and even if you refresh the folder by pressing F5, files remain there until you delete them by hand.

I'm using avast! RC2 build, Firefox 33 (Final) on Windows 8.1 Update 1 64bit (NTFS filesystem). I'm also using Malwarebytes Anti-Exploit which i partially suspect it might be doing this, but would be easier if anyone without it can also confirm this.
Visit my webpage Angry Sheep Blog

Offline igor

  • Moderator
  • Serious Graphoman
  • *
  • Posts: 11849
    • AVAST Software
Re: 2015-RC2 Zero bytes file leftovers after quarantining
« Reply #1 on: October 15, 2014, 10:46:35 PM »
Have you tried another browser? I can imagine the browser could also be creating the empty file (after avast! removes the real one).

Offline Eddy

  • Avast Evangelist
  • Maybe Bot
  • ***
  • Posts: 31080
  • Watching (over?) you
    • Malware removal, Biljart and other things.
Re: 2015-RC2 Zero bytes file leftovers after quarantining
« Reply #2 on: October 15, 2014, 10:56:11 PM »
What action did you select?
Move to chest, fix automatically or... ?

Offline RejZoR

  • Polymorphic Sheep
  • Serious Graphoman
  • *****
  • Posts: 9406
  • We are supersheep, resistance is futile!
    • RejZoR's Flock of Sheep
Re: 2015-RC2 Zero bytes file leftovers after quarantining
« Reply #3 on: October 15, 2014, 11:03:25 PM »
I don't think that's the case. Firefox creates temp file with "original_filename.ext.part". When it's done, .part is removed.

@Eddy
Default avast! actions. So, move to chest for everything automatically.
Visit my webpage Angry Sheep Blog

Offline Eddy

  • Avast Evangelist
  • Maybe Bot
  • ***
  • Posts: 31080
  • Watching (over?) you
    • Malware removal, Biljart and other things.
Re: 2015-RC2 Zero bytes file leftovers after quarantining
« Reply #4 on: October 15, 2014, 11:24:53 PM »
Win XP SP3
Opera as browser
FileShield set to move to chest > ask
I get a popup from ask, file is not moved to the chest at all.
Nothing in the download folder.
After choosing fix automatically I get:

Offline RejZoR

  • Polymorphic Sheep
  • Serious Graphoman
  • *****
  • Posts: 9406
  • We are supersheep, resistance is futile!
    • RejZoR's Flock of Sheep
Re: 2015-RC2 Zero bytes file leftovers after quarantining
« Reply #5 on: October 18, 2014, 08:47:06 AM »
Still happneing with RC3. May i ask why no one has looked into this one? igor stopped by and said i should try another browser. Well i don't want another browaser, i'm using Firefox...
Visit my webpage Angry Sheep Blog