Author Topic: Unable to delete virus-file  (Read 9135 times)

0 Members and 1 Guest are viewing this topic.

Offline Lars-Erik

  • Avast Evangelist
  • Sr. Member
  • ***
  • Posts: 394
    • Lars-Erik Østerud
Unable to delete virus-file
« on: February 29, 2004, 02:21:29 PM »
A friend of mine (using Outlook) got a virus in the mail, and even though she did not start it she got a warning (that's good). BUT when she tried to delete og repair the file she gets a "unable to process" (or something) mesage, and the virus-warning reappear.  I got the same problem myself a while back (when I accidentally clicked a attachement).  It seems like the mail-program is locking the file, and avast! is not able to access it.  And this is not a good situation (you got a virus trying to start, and can't delete it).  We tried stopping the mail program (to free the file-lock) but of course avast! is preventing any actions (freezing Windows).

Any ideas?
www.osterud.name - ICQ: 7297605 - AIM/Yahoo/Facebook/Skype/Astra: LarsErikOsterud

Offline Vlk

  • Avast CEO
  • Serious Graphoman
  • *
  • Posts: 11665
  • Please don't send me IM's. Email only. Thx.
    • ALWIL Software
Re:Unable to delete virus-file
« Reply #1 on: February 29, 2004, 02:26:00 PM »
Is it Outlook Express or full Outlook? What is the operating system, and most importantly, what is the name of the virus?

Was the infected file wrapped in an archive (e.g. ZIP)?

thanks
If at first you don't succeed, then skydiving's not for you.

Offline Lars-Erik

  • Avast Evangelist
  • Sr. Member
  • ***
  • Posts: 394
    • Lars-Erik Østerud
Re:Unable to delete virus-file
« Reply #2 on: February 29, 2004, 02:28:54 PM »
Full Outlook, preview on
Windows 98se
It was win32:Netsky-B[Wrm]
Filname: textfile.exe
« Last Edit: February 29, 2004, 02:33:10 PM by Lars-Erik »
www.osterud.name - ICQ: 7297605 - AIM/Yahoo/Facebook/Skype/Astra: LarsErikOsterud

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67274
Re:Unable to delete virus-file
« Reply #3 on: February 29, 2004, 02:29:37 PM »
Can you run a scan at boot-time?  ::)

Sorry, I did not read you are using the 98...
Can you use the avast! Cleaner (standalone application)?
« Last Edit: February 29, 2004, 02:33:02 PM by Technical »
The best things in life are free.

Offline Vlk

  • Avast CEO
  • Serious Graphoman
  • *
  • Posts: 11665
  • Please don't send me IM's. Email only. Thx.
    • ALWIL Software
Re:Unable to delete virus-file
« Reply #4 on: February 29, 2004, 02:34:11 PM »
Technical, this won't help - it's in the Outlook store.

What you could do is let the message be delivered and then delete it... But I understand this is not exactly what you wanted to hear... :-\

What was the name of the virus, again? (If you remember)
Does this happen often, or it only happened once?

Did she react immediately after she saw the virus warning (e.g. try the button 'Delete') or did she first call you -- I'm asking because it may be a timing thing -- if the warning is on the screen for a longer period of time, some extra actions are taken to prevent lockups...
If at first you don't succeed, then skydiving's not for you.

Offline Lars-Erik

  • Avast Evangelist
  • Sr. Member
  • ***
  • Posts: 394
    • Lars-Erik Østerud
Re:Unable to delete virus-file
« Reply #5 on: February 29, 2004, 02:36:02 PM »
When doing a full scan after boot no viruses was found. Then she started Oulook again (still with preview on :-) and looked at the message again - virus warning again :-)  BUT this time she was allowed to delete the virus attachment!

Seems like there is a problem when a process on the computer is locking the file. Can avast! do somthing to "unlock" the file before trying to delete/clean it ?

(btw:  I'll try to help her setting up mail scanning, she's
obviously only running normal file scanning right now)
www.osterud.name - ICQ: 7297605 - AIM/Yahoo/Facebook/Skype/Astra: LarsErikOsterud

Offline Lars-Erik

  • Avast Evangelist
  • Sr. Member
  • ***
  • Posts: 394
    • Lars-Erik Østerud
Re:Unable to delete virus-file
« Reply #6 on: February 29, 2004, 02:37:20 PM »
I posted a message further up with the details :-)
She called me first (they always do :-)
www.osterud.name - ICQ: 7297605 - AIM/Yahoo/Facebook/Skype/Astra: LarsErikOsterud

Offline RejZoR

  • Polymorphic Sheep
  • Serious Graphoman
  • *****
  • Posts: 9353
  • We are supersheep, resistance is futile!
    • RejZoR's Flock of Sheep
Re:Unable to delete virus-file
« Reply #7 on: February 29, 2004, 02:39:46 PM »
But isn't Internet Mail module better than Outlook/Exchange?
As i understand this Internet Mail catches virus at entry point (as soon as downloaded from mail server,Outlook/Exchange catches it when it already enters the system and stores itself in Outlook mailbox files (mail archive). And localhost can be also set for Outlook as for any mail client. Or am i wrong somewhere?
Visit my webpage Angry Sheep Blog

Offline Lars-Erik

  • Avast Evangelist
  • Sr. Member
  • ***
  • Posts: 394
    • Lars-Erik Østerud
Re:Unable to delete virus-file
« Reply #8 on: February 29, 2004, 02:40:42 PM »
BTW:  Found the posting a while ago where I had some similar problems. The URL for the post is:

http://forum.avast.com/index.php?board=2;action=display;threadid=2068;start=msg14145#msg14145
www.osterud.name - ICQ: 7297605 - AIM/Yahoo/Facebook/Skype/Astra: LarsErikOsterud

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67274
Re:Unable to delete virus-file
« Reply #9 on: February 29, 2004, 03:03:06 PM »
Lars, to see what is locking (using) the file, try this nice and small application: http://mstsoftware.com/Files/mstIsUsedBy13e.exe

It's perfect to see what is locking the file (but your system could not be 'lock' at that time, of course...)  ;)
The best things in life are free.

Offline Lars-Erik

  • Avast Evangelist
  • Sr. Member
  • ***
  • Posts: 394
    • Lars-Erik Østerud
Re:Unable to delete virus-file
« Reply #10 on: February 29, 2004, 03:10:37 PM »
OK. If it happends again I'll try it.  But still, could avast! be made to forcefully unlock the file when it contains a virus?
www.osterud.name - ICQ: 7297605 - AIM/Yahoo/Facebook/Skype/Astra: LarsErikOsterud

Offline Vlk

  • Avast CEO
  • Serious Graphoman
  • *
  • Posts: 11665
  • Please don't send me IM's. Email only. Thx.
    • ALWIL Software
Re:Unable to delete virus-file
« Reply #11 on: February 29, 2004, 03:12:47 PM »
I don't think the 'locking theory' is correct. While the virus warning is on the screen, the file should be somewhere in the %TEMP% folder, with a name in the form AvOxxxx.tmp (xxxx is some number). You can check if it's there, and if it's locked or not...
If at first you don't succeed, then skydiving's not for you.

Offline Lars-Erik

  • Avast Evangelist
  • Sr. Member
  • ***
  • Posts: 394
    • Lars-Erik Østerud
Re:Unable to delete virus-file
« Reply #12 on: February 29, 2004, 03:35:02 PM »
But was it then the problem? As you saw in the link I had a similar problem. And sometimes avast! can delete the infected file OK, sometimes not (just a message that it's unable to access the file, and if you then click OK you get a new virus warning).  For a novice user it a TERRIBLE situation to get a virus-warning and not beeing able to neither delete, repair or move to chest.  You really don't want to clik OK on a virus-warning message box :-((((
www.osterud.name - ICQ: 7297605 - AIM/Yahoo/Facebook/Skype/Astra: LarsErikOsterud

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67274
Re:Unable to delete virus-file
« Reply #13 on: February 29, 2004, 03:55:52 PM »
But was it then the problem? As you saw in the link I had a similar problem. And sometimes avast! can delete the infected file OK, sometimes not (just a message that it's unable to access the file, and if you then click OK you get a new virus warning).  For a novice user it a TERRIBLE situation to get a virus-warning and not beeing able to neither delete, repair or move to chest.  You really don't want to clik OK on a virus-warning message box :-((((

Lars is correct Vlk, in my opinion.
Sometimes I had the same situation even with eicar.com test file... We cannot delete the temporary file and the user feeling is to be unprotected, left behind by the av  :'(
The best things in life are free.

Offline notme

  • Jr. Member
  • **
  • Posts: 50
  • WebHappy
Re:Unable to delete virus-file
« Reply #14 on: February 29, 2004, 08:50:26 PM »
Try turning preview pane off, then delete the file/message.
newme/notme = never accept a no from someone who is not in the position to give you a yes!