Avast going nuts after today's update (solved)

[madmack]

the latest update, did not fix my problem.

[Will91]

I'm having problems too!  I am careful on the internet and last night for the FIRST time with Avast, it turned up FOUR problems.  One was related to Dell's MyWay Search Assistant they install on new pcs, two were dll files associated with two ISP programs on my pc that have dial-up accelerator features, and one was buried somewhere in the system restore folder (which I couldn't even find with windows explorer).

The newest update today 645-1 did NOT fix the problems.  Avast is still indicating these same files as threats.

Avast, PLEASE check into this.

[Delta]

One was related to Dell's MyWay Search Assistant they install on new pcs

Could this be a genuine detection?

Castle Cops
Dell Fourums

Are a couple of links amongst many others.

[Lisandro]

Avast is still indicating these same files as threats.

To know if a file is a false positive, please submit it to JOTTI or VirusTotal and let us know the result. If it is indeed a false positive, send it in a password protected zip to virus@avast.com

Please, mention in the body of the message why you think it is a false positive and the password used. Thanks.

[Will91]

Hi:

I don't think these files are real threats at all.  Two of them were dll files associated with my ISP dial-up accelerator folders.  One was in Earthlink (which I use) and the other was in Netscape (which I don't use but was on the pc from Dell).  The third file was another dll that Avast found in MyWaySA.  I understand this is some sort of search assistant put on the pc by Dell BUT Avast has never flagged this one before either.  The fourth file was something I couldn't make heads or tails out of...it was in the System Restore folder and I couldn't even view it with Windows Explorer.

I tried to email the dll files to Avast but for some reason it keeps saying access denied.  I don't know what to do about this if I can't cut and paste them into an email to Avast or some of the other recommended places.  What should I do about that??

Again, I still think there is something strange with the recent Avast updates as I believe these files have always been on the pc and Avast has NEVER flagged them before even with the most rigorous, thorough scanning feature selected.

[Lisandro]

Can you check if with the last VPS 645-3 the false positives are still round?

[Will91]

I sure will.

This is two versions newer than what auto-installed this morning.  Were some corrections made at Avast regarding some of these issues??

I'm looking forward to updating this on my home pc tonight and checking results.   I'll be holding my breath!

[alanrf]

I think that we can guess, given the frequency of the updates, that the avast team has been responding to the concerns about false positives. 

Tech, like you and me is a user of avast ... Tech provides his vast knowledge of avast to help other users but, in moments like this, I suspect his guess is as good as yours or mine.   

[avatar2005]

I tried to email the dll files to Avast but for some reason it keeps saying access denied.  I don't know what to do about this if I can't cut and paste them into an email to Avast or some of the other recommended places.  What should I do about that??

Try to sent it like a zip password rpotected archive
EDIT:
Or try to use this form on http://www.avast.com/i_kat_72.php?lang=ENG

[Will91]

Thank you everyone.

Good news and bad news.

First of all, the newest update no longer says that the two dll files associated with my two ISP programs are threats.

The bad news is that Avast is still saying there is something suspicious about two files in my C:/System Volume Information.  It has NEVER reported this before.  I can not find this folder with Windows Explorer but here are the two file names as reported by Avast.  I also tried a search on the A0015775.dll files including hidden folders but it couldn't find it either.  The first one says "infection Win3" and the second one says "unable to scan"

C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP108\A0015775.dll  INFECTION Win3
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP39  UNABLE TO SCAN

[avatar2005]

Hi!
Do this:
1) disable system restore
2) schedule the boot time scanning & reboot
3) boot up again & ran a full system scan
4) enable back system restore.

[DavidR]

As avatar2005 says, the only way to clean infected _restore points is to disable system restore and reboot. This will clear ALL _restore points.

As for the one that was unable to be scanned is not a problem, as well as being told it can't be scanned, avast will also say why it couldn't be scanned, why couldn't it be scanned ?

There are many legitimate reasons why a file can't be scanned. Many programs (usually security based ones) password protect their files for legitimate reasons such as AdAware and Spybot Search & Destroy, there are others (and avast doesn't know the password or have any way of using it even if it did know it).

Files that can't be scanned are just that, not an indication they are suspicious/infected, just unable to be scanned.

[Will91]

Hi:

Could someone please give me a little more information on clearing the system restore?

I think I can find the screen where it can be turned off, but what is meant by "schedule the boot time scanning & reboot"?  I'm going to need some idiot-proof step by step instructions here.  I'm using Windows XP.

Also, after I do this, does this mean my Windows Restore points will be lost so that if I wanted to go back in time, this will not be possible?  What could Avast have found in this System Volume Information folder (which I now understand is assocatied with the Restore Feature).

thanks

[oldman]

Boot scan

right click the "a" ball, click start avast antivirus
click menu, select schedule boot time scan
select the path  ie the drive you want to scan.

Make sure system restore is off. Restart your computor.

Yes, all restore points will be removed. Files in system restore are protected and can't be removed with system restore enabled. System restore is a double edged sword. It protects/saves certain system, even those infected. If you don't disable it, infections will keep reoccuring from the infected files.

After you are sure you are clean, re-enable system restore and if you want create a resore point.

[DavidR]

Win XP-ME - How to disable System Restore

Files that are found in system folders if infected and deleted without previously having disabling system restore are saved into the c:\System Volume Information folder _restore point/s, unfortunately because of windows protection of that area the only way to deal with an infected restore point is to disable system restore, losing ALL restore points.

This is unfortunately a fact of life and many virus removal procedures clearly mention disabling system restore prior to deleting/moving files from the system folders. If you don't do this, in the future if you use the system restore function you could well be restoring the prior infected file/s.

When you re-enable system restore (after confirming you are clear) you will be creating a restore point of a clean system at that point in time, this will be as far back as you can go. System Restore is far from a perfect tool and not something I rely on, mine is permanently disabled, however, to do this you need your own means of recovering from problems.

I do a weekly image (exact copy) of my partitions and save them to a second hard disk and I do daily back-ups of my data files (things that are likely to change, .doc, .xls, emails, address book, bookmarks, etc. This way I have a tried and tested means of recovery.