Author Topic: Threat cannot be deleted  (Read 1433 times)

0 Members and 1 Guest are viewing this topic.

Offline stibi

  • Sr. Member
  • ****
  • Posts: 386
Threat cannot be deleted
« on: February 13, 2019, 07:32:30 PM »
Hi,
this morning I got a message "Bedrohung kann nicht entfernt werden" which means Thread cannot be deleted or sent to virus container.

A check in the files system shows no such file.
Malwarebytes shows nothing suspicious.

Has someone an idea?
« Last Edit: February 14, 2019, 10:41:34 AM by stibi »

Offline mchain

  • Avast Evangelist
  • Ultra Poster
  • ***
  • Posts: 5420
  • Spartan Warrior
Re: Thread cannot be deleted
« Reply #1 on: February 14, 2019, 03:11:51 AM »
English translation would be:  "Threat cannot be deleted" rather than Thread cannot be deleted.

Were you trying to install Flash executable into a browser at the time?

Look in your virus chest and see if the file is there.  Translation is 'Open Virus-Container' which could mean the file is in there.

[EDIT:]  Looking more closely, seems Behavior Shield is involved.
« Last Edit: February 14, 2019, 03:14:21 AM by mchain »
Windows 10 Home 64-bit 20H2 Avast Premier Security version 21.3.2459 (build 21.3.6164.652) UI version 1.0.612.

Offline stibi

  • Sr. Member
  • ****
  • Posts: 386
Re: Threat cannot be deleted
« Reply #2 on: February 14, 2019, 10:42:40 AM »
Hi,
I don't use Flash. And didn't try to install it.
Virus chest i empty.

Offline Cluster-Lizard2014

  • Sr. Member
  • ****
  • Posts: 306
Re: Threat cannot be deleted
« Reply #3 on: February 14, 2019, 01:41:47 PM »
Check your browser addons for Shockwave Flash. If you have browser updating set to automatic you may still be using and, possibly, getting Flash updates too, depending on the browser/addons settings.

This should not apply to AVAST 'Free' but it may be that AVAST's own automatic Software Updater (Premier) is what has caused the problem and provoked this message. It would be ironic if AVAST is now seeing Flash updates as a potential security threat even though it is an AVAST tool doing the automatic updating.

But why you get that message about the Virus Chest who knows? Hopefully someone here does.   

Offline s.ophietanar

  • Newbie
  • *
  • Posts: 3
Re: Threat cannot be deleted
« Reply #4 on: February 14, 2019, 01:50:10 PM »
Did you install new software or added add-on to your browser?
I have faced same type of problem with my new Autel maxisys pro ms908p scanner https://obd2scanners.org/autel/maxisys-pro-ms908p-reviews-automotive-diagnostic-scanner/. I have installed window operating system and also start to showing some suspicious files.
After some dig out find some add-on was creating this issue.
« Last Edit: February 23, 2019, 12:56:24 PM by s.ophietanar »
.

Offline stibi

  • Sr. Member
  • ****
  • Posts: 386
Re: Threat cannot be deleted
« Reply #5 on: February 14, 2019, 07:07:14 PM »
there is only duckduckgo and avertising blocker. Nochting else ...
« Last Edit: February 14, 2019, 07:09:31 PM by stibi »

Offline stibi

  • Sr. Member
  • ****
  • Posts: 386
Re: Threat cannot be deleted
« Reply #6 on: February 19, 2019, 11:03:42 AM »
No idea?



Next trouble - this morning tne computer started normally, after some minutes the system froze, no reaction at the GUI. It was not even possible to fall back to the task manager with CTRL ALT DEL.

Cold start by power off was the only way to come back to a living system (Win7/64).

Later I detected an Avast Free Antiviirus Update 19.2.
About a quarter of an hour testing and searching for nothing but a failed update ... one more of this and I kick avast away from my computer.


Offline alanb

  • Poster
  • *
  • Posts: 559
Re: Threat cannot be deleted
« Reply #7 on: February 19, 2019, 03:58:21 PM »
Does the path "C:\Windows\SysWOW64\Macromed\Temp" exist on your PC?

If so, are there any files in it?

There are many malware processes that call themselves "installflashplayer.exe", and it seems many hijack the official Macromedia install path.

Offline stibi

  • Sr. Member
  • ****
  • Posts: 386
Re: Threat cannot be deleted
« Reply #8 on: February 19, 2019, 06:24:32 PM »
Very interesting.

1) "C:\Windows\SysWOW64\Macromed\Temp" exist with an empty folder, no data.

2) There is also a folder "C:\Windows\SysWOW64\Macromed\Flash" with 14 files (FlashPlayerPlugin_32_0_0_142 etc...),  new from the date when I got the message in #1.

3) A longer search found in IrfanView's plungin.txt an entry flash.dll

4) IrfanView reports 2 Flash-PlugIns from Adobe & Macromedia; don't know where they com from, never used that.

5) "installflashplayer.exe" doesn't exist here.

6) system control shows an old version of Flash player, never used that.

thx