Author Topic: .pif mails that avast! does not says is Virus ????  (Read 6873 times)

0 Members and 1 Guest are viewing this topic.

Offline Lars-Erik

  • Avast Evangelist
  • Sr. Member
  • ***
  • Posts: 394
    • Lars-Erik Østerud
.pif mails that avast! does not says is Virus ????
« on: March 08, 2004, 08:52:36 PM »
After I got the latest DB update today (10 minutes ago) I got two mail with .pif attachments marked as [suspicous] by avast! but even when saving them there is no virus warning.

What should I do with them (does the avast! team like to check them, they have all usual virus-mail characteristics)?

BTW:  The Explorer shell extension has no "Scan..." for .pif files?  Where do you setup what files has this extension?
www.osterud.name - ICQ: 7297605 - AIM/Yahoo/Facebook/Skype/Astra: LarsErikOsterud

Offline igor

  • Avast team
  • Serious Graphoman
  • *
  • Posts: 11865
    • AVAST Software
Re:.pif mails that avast! does not says is Virus ????
« Reply #1 on: March 08, 2004, 09:23:39 PM »
Yes, if you could send them to virus(at)asw.cz, it would be nice. The warning is given just because of the suspicious extension, but obviously the virus has not been detected.

As for the shell extension... it may be a problem of Windows itself. It seems that the HKCR\* key doesn't apply for .pif files (at least on Win98).

Offline Lars-Erik

  • Avast Evangelist
  • Sr. Member
  • ***
  • Posts: 394
    • Lars-Erik Østerud
Re:.pif mails that avast! does not says is Virus ????
« Reply #2 on: March 08, 2004, 09:26:41 PM »
Yes, if you could send them to virus(at)asw.cz, it would be nice. The warning is given just because of the suspicious extension, but obviously the virus has not been detected.

OK, mailed them both there...  Good hunting :-)

As for the shell extension... it may be a problem of Windows itself. It seems that the HKCR\* key doesn't apply for .pif files (at least on Win98).

Anything I can add to the registry to fix this (can I just add some keys, or copy them from another filetype or something like that)?
www.osterud.name - ICQ: 7297605 - AIM/Yahoo/Facebook/Skype/Astra: LarsErikOsterud

Offline RejZoR

  • Polymorphic Sheep
  • Serious Graphoman
  • *****
  • Posts: 9408
  • We are supersheep, resistance is futile!
    • RejZoR's Flock of Sheep
Re:.pif mails that avast! does not says is Virus ????
« Reply #3 on: March 08, 2004, 09:31:47 PM »
*.pif doesn't have Shell extension command under XP too...

Guess it can be achieved with manual reg editing,but currently i don't know the commands... I'll try to find out...
Visit my webpage Angry Sheep Blog

Offline igor

  • Avast team
  • Serious Graphoman
  • *
  • Posts: 11865
    • AVAST Software
Re:.pif mails that avast! does not says is Virus ????
« Reply #4 on: March 08, 2004, 09:35:12 PM »
Quote
Anything I can add to the registry to fix this (can I just add some keys, or copy them from another filetype or something like that)?

Go to HKCR\*\shellex\ContextMenuHandlers, copy the avast subkey and put the same (subkey) to
HKCR\piffile\shellex\ContextMenuHandlers
- hopefully it will work.

Offline Lars-Erik

  • Avast Evangelist
  • Sr. Member
  • ***
  • Posts: 394
    • Lars-Erik Østerud
Re:.pif mails that avast! does not says is Virus ????
« Reply #5 on: March 08, 2004, 09:48:16 PM »
Go to HKCR\*\shellex\ContextMenuHandlers, copy the avast subkey and put the same (subkey) to
HKCR\piffile\shellex\ContextMenuHandlers
- hopefully it will work.

Couldn't find anything on any ContextMenuHandlers. Not even on "exefile" (and that has the "Scan..." extension in Explorer)
www.osterud.name - ICQ: 7297605 - AIM/Yahoo/Facebook/Skype/Astra: LarsErikOsterud

Offline igor

  • Avast team
  • Serious Graphoman
  • *
  • Posts: 11865
    • AVAST Software
Re:.pif mails that avast! does not says is Virus ????
« Reply #6 on: March 08, 2004, 10:06:30 PM »
I didn't mean you should substitute the asterisk for the particular file types - the key really should be HKCR\*. That should cover all files... but apparently, it doesn't work for .pif. Ask Microsoft  ;D

Offline Lars-Erik

  • Avast Evangelist
  • Sr. Member
  • ***
  • Posts: 394
    • Lars-Erik Østerud
Re:.pif mails that avast! does not says is Virus ????
« Reply #7 on: March 08, 2004, 10:12:48 PM »
I didn't mean you should substitute the asterisk for the particular file types - the key really should be HKCR\*. That should cover all files... but apparently, it doesn't work for .pif. Ask Microsoft  ;D

Aha, OK, then it worked.  But shouldn't avast! set this key on Win98 by it self during installation if this is a known bug ?
www.osterud.name - ICQ: 7297605 - AIM/Yahoo/Facebook/Skype/Astra: LarsErikOsterud

Offline RejZoR

  • Polymorphic Sheep
  • Serious Graphoman
  • *****
  • Posts: 9408
  • We are supersheep, resistance is futile!
    • RejZoR's Flock of Sheep
Re:.pif mails that avast! does not says is Virus ????
« Reply #8 on: March 08, 2004, 10:14:10 PM »
I throw such *.pif files into some folder and right-click on that folder and select Scan. Not so fast,but its not too complicated and it can take you like 5 sec ;)
Visit my webpage Angry Sheep Blog

Offline igor

  • Avast team
  • Serious Graphoman
  • *
  • Posts: 11865
    • AVAST Software
Re:.pif mails that avast! does not says is Virus ????
« Reply #9 on: March 08, 2004, 10:34:43 PM »
But shouldn't avast! set this key on Win98 by it self during installation if this is a known bug?

It is a known bug now, when you noticed ;D
I didn't know it before and nobody ever complained... I think it should be easy to fix.
(And if I understand it correctly, the problem is not limited to Win9x.)
« Last Edit: March 08, 2004, 10:35:08 PM by igor »