Author Topic: Disadvantages to moving files to chest  (Read 2476 times)

0 Members and 1 Guest are viewing this topic.

Eric Hawaii

  • Guest
Disadvantages to moving files to chest
« on: January 08, 2009, 08:41:48 PM »
Hi, after being infected with win32:adware-gen and related bugs and rootkits, I moved a number of files to chest in Avast, which prompted an "are you sure?" alert each time because they were located in WINNT folders that might affect operations. Nonetheless, I chose to quarantine the files. I wonder how to find out if such action will have negative consequences and whether to unquarantine them.

I also came to the realization that the bugs seemed to be wise to Avast's "repair" function, because any attempt to repair them automatically generated an error which made further action impossible and caused the bug to apparently replicate itself somewhere else. As a result, I couldn't get all the bugs, and I'm still infected somewhere that Avast can't seem to locate.

Eric

Offline DavidR

  • Avast √úberevangelist
  • Certainly Bot
  • *****
  • Posts: 87075
  • No support PMs thanks
Re: Disadvantages to moving files to chest
« Reply #1 on: January 08, 2009, 09:03:02 PM »
For me there is little in the way of a disadvantage in moving a file to the chest. There is however a major disadvantage in deleting a file as you are left with no options.

You have done the right thing, 'first do no harm' don't delete, send virus to the chest and investigate.

You don't say what the file name was nor do you say what your OS is (both of which can help us to help you) ?

avast is exercising extreme care when the detection is in a system folder.

They aren't wise to avast's repair function - Trojans generally can't be repaired (either by the VRDB or avast virus cleaner), because the entire content of the file is malware, so it is either move to chest or delete, move to the chest being the best option (first do no harm). When a file is in the chest it can't do any harm and you can investigate the infected warning.

The VRDB only protects certain files, mainly .exe files, it doesn't protect data files or all files, it is not a back-up program, so there are going to be many occasions where repair won't be an option.

Only true virus infection can be repaired, e.g. when a virus infects a file it adds a small part to it, provided that file is one that avast's VRDB would monitor and you have run the VRDB, then it may be possible to repair the file to its uninfected state.

However, for the most part so called viruses, trojans (adware/spyware/malware, etc.) can't be repaired because the complete content of the file is malicious.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 22.10.6038 (build 22.10.7633.734) UI 1.0.733/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security