Can't move file to chest

[lfb41]

When I perform a scan with Avast, it finds several files (malware/spyware) which it cannot move to the chest.  It also cannot delete them.  In my most recent scan, the files found are:

Win32:AntiSpyware-B[Tool]  (found this one twice)
Win32:Agent-AWB[Adw]

For the first one, Avast says "File is not packed."
For the second, Avast says "The operation is not supported for this type of archive."

Can someone tell me what the problem is, and should I worry about it?  Thanks

[DavidR]

What is the infected file name, where was it found e.g. (C:\windows\system32\infected-file-name.xxx) ?
Check the avast! Log Viewer (right click the avast 'a' icon), Warning section, this contains information on all avast detections.

It is possible that this file was in an archive which avast couldn't extract it, the file information may point to why.

Deletion isn't really a good first option (you have none left), 'first do no harm' don't delete, send virus to the chest and investigate.

If you have XP, vista32bit or Win2k, you could enable a boot time scan. Right click the avast icon, select Start avast! Antivirus, Menu, 'Schedule boot-time scan...' Or see http://www.digitalred.com/avast-boot-time.php.

[lfb41]

Below is the info from the log.  Does this help?

These were not moved:

D:\Downloads\Agent Scanner\setup.exe\{app}\Launcher.exe [L] Win32:AntiSpyware-B [Tool] (0).  While moving file to chest, error occurred: File is not packed.

D:\System Volume Information\_restore{69B73AFB-4769-499B-B1DE-D0C163563E05}\RP326\A0222546.exe\{tmp}\SetupInst.exe\Setup.exe [L] Win32:Agent-AWB [Adw] (0)
While moving file to chest, error occurred: The operation is not supported for this type of archive.

D:\System Volume Information\_restore{69B73AFB-4769-499B-B1DE-D0C163563E05}\RP344\A0227675.exe\{app}\Launcher.exe [L] Win32:AntiSpyware-B [Tool] (0)    While moving file to chest, error occurred: File is not packed.

These were moved successfully:

D:\Downloads\Agent Scanner\setup.exe\{app}\AntiSpyware.exe [L] Win32:AntiSpyware [Tool] (0)     File was successfully moved to chest..

D:\System Volume Information\_restore{69B73AFB-4769-499B-B1DE-D0C163563E05}\RP344\A0227675.exe\{app}\AntiSpyware.exe [L] Win32:AntiSpyware [Tool] (0)    File was successfully moved to chest...

Thanks, in advance, for your help.

[DavidR]

So what is this Agent Scanner that was in your downloads folder, did you download it ?

The setup.exe file is an installation file that is packed with other files that are used to install the underlying application/s now avast has expected that to be a packed file but there appears to be a problem with it. Probably similar to the "While moving file to chest, error occurred: The operation is not supported for this type of archive." you had with one other.

You will also notice the [Tool] suffix on some of the detections as this means there could be a legitimate purpose for this and if you installed it, then it is probably OK. This is where my question about Agent Scanner is important.

I would suggest cleaning out the system restore (System Volume Information\_restore) points when you decide what should be done with the agent scanner in the downloads folder.

Create Clean Restore Point - Clear old Restore Points.

Create a clean System Restore point:
1. Click Start, All Programs, Accessories, System tools, System Restore.
2. In the pop-up that appears fill in the radio button to Create a Restore Point
3. Click NEXT
4. Enter a useful name that you will remember if you need to find this again (Clean Restore Point)
5. Click CREATE

You now have a clean restore point, you should clear the old ones:
1. Click Start, All Programs, Accessories, System tools, Disk Clean Up
2. Click OK on the C: drive
3. Click the More Options tab
4. In the System Restore section click the Clean Up button

[lfb41]

The Agent Scanner was a spyware scanning program I downloaded from the Internet.  I tried it, didn't like it, and uninstalled it.  After the scan, I checked the Agent Scanner folder and it was empty.  Guess Avast had already moved the setup.exe file to the chest.  (I checked and it IS in the virus chest.)  Anyway, I deleted the Agent Scanner folder.  I just scanned the D:\Download folder again and had NO hits.  So, I guess that problem is solved. 

Tomorrow I will clean the system restore points as you suggested.  Hopefully, that will take care of the other problems.

Thanks for you help.

[DavidR]

No problem, glad I could help.

Looks like its uninstaller was as good as the program, cr*p, thankfully it is now taken care of.

Welcome to the forums.

[juditelucas]

Hello.
This is my first time here, I'm not sure I should be using relpy or starting a new post, but since my problem is related to this one, here it goes.

I have been having hundreds of problems with virus (SexCity.jpg.wsf and Ne0k.s** [forgot the name] were the most resilient ones). I have installed and unistalled several anti-virus programs, several cleaner, done on-line cleaners and so on. Yesterday, I asked someone to have a look at my computer, and after some time cleaning up, I was advised to format my laptop.
So I have set my mind to it. First, however, I need to save all my information. Saving to CDs or DVDs doesn't please me, because it's A LOT of data, most of which is still unorganised or unexplored. I bought an external portable hard disk, and am copying my folder and files into there. However, AVAST tells me I have a virus there, or signs of the virus: Win32:Agent-AWB.

The file cannot be cleaned or moved to Quarantine. I tried deleting it mannually, but I can't. I'm told it's a system file.

What should I do?
Thanks in advance.

One other question: will I receive an e-mail everytime there is a post or reply in the foruns I visit or use?

Judite Lucas

[DavidR]

I would suggest you create a new topic as this one seems related in only one thing (you may also have other problems) and people can try to help in that topic without things becoming confused in this one.

In that new topic say what your OS, browser and firewall are.
Also what is the infected file name, where was it found e.g. (C:\windows\system32\infected-file-name.xxx) ? 
Check the avast! Log Viewer (right click the avast 'a' icon), Warning section, this contains information on all avast detections.

In the forum profile settings if you elected to be notified when people reply, yes you will get an email.

[juditelucas]

Ok, Just did it.
Thanks.

[DavidR]

No problem, I see polonus has started the ball rolling.

Welcome to the forums.

[Darth AkSarBen]

BTW I read that some of the Maxtor external hard drive, made in a plant in China, came loaded with a virus, and I certainly belive it is the Win32:Agent-AWB.  It was devised to scan your computer for game passwords and send them back to a receiving site in China.  They sort of got their " **ts in a ringer" for that one.  Maxtor is owned by Seagate now.  It had mostly to do with "Worlds Of Warcraft" gaming.
After reading about the external HD issue, I thought I might mention it, as there may be others out there backing up stuff and come across this.

Links: http://www.hqlaptops.com/hard-drives/infected-seagate-hard-drives   Virus Bulletin
http://nexus404.com/Blog/2007/11/11/segate-maxtor-ps3200-external-hard-disk-drives-supplied-with-virus-targeting-world-of-warcraft/
http://www.lockergnome.com/blade/2007/11/13/maxtor-basics-hard-disk-virus-installed-from-factory/