Author Topic: "File is not packed", but could it be related to an earlier Trojan  (Read 3226 times)

0 Members and 1 Guest are viewing this topic.

Offline hawker

  • Newbie
  • *
  • Posts: 3
Avast identified five files infected with WIN32 Trojan-gen(UPX) and WIN32 Trojan-gen(Other). Three of them included “digitalriver” in the file name and were located in C:\WINDOWS files; the other two were located in C:\System Volume Information_restore. I moved them all to the chest. The next scan identified the Trojan in a different file in C:\System Volume Information_restore, so I flushed System Restore (as recommended in other threads). The next scan was clear.

However, a scan today has shown as “Unable to Scan” two files in C:\System Volume Information_restore. Although other threads have said that “Unable to scan” is usually not suspicious, I was worried about these two files since they had names very similar to the ones containing the Trojan. For example, one of the original infected files was named “C:\System Volume Information\_restore{D6CCD645-9008-4178-9EDA-C25D0D93F525}\RP4 \A0000149.exe”; the names of the two “Unable to scan” files (and what I did with them) were:

C:\System Volume Information\_restore{D6CCD645-9008-4178-9EDA-C25D0D93F525}\RP4\A0000149.exe\lnno0001.bin (this one I moved to the chest without problem)

C:\System Volume Information\_restore{D6CCD645-9008-4178-9EDA-C25D0D93F525}\RP4\A0000149.exe\lnno0003.bin  (this one I tried to move to the chest, but got the message “Error occurred during moving file to chest. File is not packed”).

Do you think I need to take further action on this, and, if so, what action should I take?

(As I’m writing this, it’s just struck me that in the same scan there were two Firefox profiles files with “bin” extensions, with the same “Unable to scan” messages as the two files I’m worried about; do you think they are related? Sorry, haven’t kept a note of the file names)

Grateful for any help anybody can offer.



Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67255
Re: "File is not packed", but could it be related to an earlier Trojan
« Reply #1 on: March 17, 2008, 07:34:17 PM »
I don't think the files into Firefox profile are related to the ones on system restore.
Anyway, can you try boot time scanning? Access rights won't be a problem then.
The best things in life are free.

Offline hawker

  • Newbie
  • *
  • Posts: 3
Re: "File is not packed", but could it be related to an earlier Trojan
« Reply #2 on: March 17, 2008, 08:12:05 PM »
Tech - thanks for your reply. I've now done boot-time scanning on C:\System Volume Information, but the report just said the number of files scanned and no infections, ie didn't say "unable to scan" for anything.

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67255
Re: "File is not packed", but could it be related to an earlier Trojan
« Reply #3 on: March 17, 2008, 08:19:57 PM »
Tech - thanks for your reply. I've now done boot-time scanning on C:\System Volume Information, but the report just said the number of files scanned and no infections, ie didn't say "unable to scan" for anything.
So, is everything ok now?
The best things in life are free.

Offline hawker

  • Newbie
  • *
  • Posts: 3
Re: "File is not packed", but could it be related to an earlier Trojan
« Reply #4 on: March 17, 2008, 08:39:57 PM »
Well, I don't know. My concern is what has happened to that suspicious file in C:\System Volume Information\_restore that Avast was unable to scan. Any ideas as to how I can reassure myself? (Excuse my ignorance, but I can't find C:\System Volume Information to see if that suspicious file is actually shown there).

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67255
Re: "File is not packed", but could it be related to an earlier Trojan
« Reply #5 on: March 17, 2008, 09:20:24 PM »
Any ideas as to how I can reassure myself? (Excuse my ignorance, but I can't find C:\System Volume Information to see if that suspicious file is actually shown there).
You have nothing to be excused... If you don't ask, you won't learn.
System Volume Information is a hidden folder that belongs to system (and not to the user). Files inside it are restore points. avast can't scan some of them because they're protected by Windows. There isn't anything wrong on this. Boot time scanning should do the work, or, like you've done, flushing the restore points.
The best things in life are free.