Author Topic: Virus Chest (Read 6987 times)

Markus · « **on:** January 19, 2004, 03:20:05 PM »

Using Avast 4.1 home with latest avi on WinME. Started simple interface and Avast flaged mchook9x.dll as a virus (Win32:Apart-A (wrm)). I put it in the virus chest, restarted simple int. and it was still there, put in the chest again. Restarted simple int. and it was still there so I put in the chest again.I believe this could have gone on til I ran out of disk space! The plugin is run by System Safety Monitor (a trusted application). I opened SSM directory and sure enough it was still there, ran another scan and it flaged it again. Checked it with another AV and it was clean. I excluded it from scan. My question is what the hell good is the Virus Chest if it doesn`t move the file only makes a copy of it??
thanks

John- · « **Reply #1 on:** January 19, 2004, 04:44:39 PM »

When Avast! says the file is in infected,...is there an option to disinfect it?....as far as I know the Vault is made to secure files that you certainly don't want to be infected. ...but hey, I can be mistaken $:-\$

igor · « **Reply #2 on:** January 19, 2004, 05:05:49 PM »

It is a false alarm. Sorry for the inconvenience; it will be fixed soon.

Markus · « **Reply #3 on:** January 19, 2004, 05:06:26 PM »

John-

If you look in avast Help under Virus Chest - it clearly states that if avast finds a file which infected - you are given a choice to MOVE it to the Virus Chest so it can`t infect your computer.

Markus

Markus · « **Reply #4 on:** January 19, 2004, 05:13:18 PM »

Igor

Thanks Igor for your quick reply. Incidently does the fix apply to the file or the action of the Virus Chest?

Markus

igor · « **Reply #5 on:** January 19, 2004, 07:34:06 PM »

The "false" signature will be removed from the virus database, i.e. the file will no longer be detected as infected.
As for the moving to chest - the plugin is probably loaded in memory (used), i.e. it cannot be deleted. Therefore, it's not actually moved to the Chest, but only copied.

Lisandro · « **Reply #6 on:** January 19, 2004, 08:21:50 PM »

Quote from: Markus on January 19, 2004, 03:20:05 PM

Using Avast 4.1 home with latest avi on WinME. Started simple interface and Avast flaged mchook9x.dll as a virus (Win32:Apart-A (wrm)). I put it in the virus chest, restarted simple int. and it was still there, put in the chest again. Restarted simple int. and it was still there so I put in the chest again.I believe this could have gone on til I ran out of disk space! The plugin is run by System Safety Monitor (a trusted application). I opened SSM directory and sure enough it was still there, ran another scan and it flaged it again. Checked it with another AV and it was clean. I excluded it from scan. My question is what the hell good is the Virus Chest if it doesn`t move the file only makes a copy of it??
thanks

Markus, no worry. I got the same (http://www.avast.com/forum/index.php?board=4;action=display;threadid=2323).

Markus · « **Reply #7 on:** January 19, 2004, 11:00:40 PM »

Igor,

Yes it was in memory. Thanks for the explanation.

Markus

Markus · « **Reply #8 on:** January 20, 2004, 08:11:10 PM »

To Avast team,

Can`t you guys add a popup msg that when Avast finds an infected file in memory such as `Warning! file is in memory. Avast cannot Move the file to the Virus Chest only copy it. You must exit the aplication before Avast can move the file to the Chest`

I know this must obvious to a programer, but not so obvious to a user. It would have saved me a great deal of confusion. Just my 2 cents worth.

Nice program by the way.

thanks,
Markus

Lisandro · « **Reply #9 on:** January 20, 2004, 08:18:08 PM »

Quote from: Markus on January 20, 2004, 08:11:10 PM

To Avast team,

Can`t you guys add a popup msg that when Avast finds an infected file in memory such as `Warning! file is in memory. Avast cannot Move the file to the Virus Chest only copy it. You must exit the aplication before Avast can move the file to the Chest`

I know this must obvious to a programer, but not so obvious to a user. It would have saved me a great deal of confusion. Just my 2 cents worth.

Nice program by the way.

thanks,
Markus

Good suggestion...
But we will save more time if we did not get the 'false positive' alarm

Markus · « **Reply #10 on:** January 20, 2004, 08:33:56 PM »

Technical,

What you say is true, but false positives are always popng up and need to be fixed. My issue is strically with moving a file to the Virus Chest. If the info was there, in the Help file or better yet with popup msg it would have saved me a lot of headaches.

regards,
Markus

Lisandro · « **Reply #11 on:** January 20, 2004, 08:35:44 PM »

Quote from: Markus on January 20, 2004, 08:33:56 PM

Technical,

What you say is true, but false positives are always popng up and need to be fixed. My issue is strically with moving a file to the Virus Chest. If the info was there, in the Help file or better yet with popup msg it would have saved me a lot of headaches.

regards,
Markus

As I said before, you are right. It's a good suggestion that will save my time too