Author Topic: 2 troj-gen found- won't move to chest or clean/repair  (Read 17609 times)

0 Members and 1 Guest are viewing this topic.

puter illit

  • Guest
2 troj-gen found- won't move to chest or clean/repair
« on: February 03, 2009, 06:20:28 PM »
Don't know why When virus are found I can't move to chest, had this problem once before on my last lap. Ok so now Avast found 2 in the adobe Reader files 1 in start up and the other in system restore.

Ran and tried to move to chest, said it could not
ran in boot and set to repair- again said it could not

I am running Avast home - up to date, Why is it not quarentining or repairing????
What do I do other than deleting the files and or adobe?

cazoza

  • Guest
Re: 2 troj-gen found- won't move to chest or clean/repair
« Reply #1 on: February 03, 2009, 06:33:19 PM »
Instead of reapiring it in the boot scan, try to move it to Chest. and it should work

Spiritsongs

  • Guest
Adobe Reader
« Reply #2 on: February 03, 2009, 07:38:44 PM »
 :)  Hi :

 You really should seriously consider COMPLETELY REMOVING Adobe Reader
 based on the Info at http://forum.avast.com/index.php?topic=38839.0 .
 Would be wise to use either the safer and FREE "Foxit Reader" or "CutePDF" .

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 88900
  • No support PMs thanks
Re: 2 troj-gen found- won't move to chest or clean/repair
« Reply #3 on: February 03, 2009, 08:58:54 PM »
I'm not surprised that a Repair didn't work (see below), but you really shouldn't change the option from send to chest to repair and expect different results, the dea of the boot-time scan would be to get around why it couldn't be sent to the chest.

So you should run the boot-time scan again and select send to chest.

####
Trojans generally can't be repaired (either by the VRDB or avast virus cleaner), because the entire content of the file is malware, so it is either move to chest or delete, move to the chest being the best option (first do no harm). When a file is in the chest it can't do any harm and you can investigate the infected warning.

The VRDB only protects certain files, mainly .exe files, it doesn't protect data files or all files, it is not a back-up program, so there are going to be many occasions where repair won't be an option.

Only true virus infection can be repaired, e.g. when a virus infects a file it adds a small part to it, provided that file is one that avast's VRDB would monitor and you have run the VRDB, then it may be possible to repair the file to its uninfected state.

However, for the most part so called viruses, trojans (adware/spyware/malware, etc.) can't be repaired because the complete content of the file is malicious.

Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.2.6105 (build 24.2.8918.824) UI 1.0.799/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Offline rob24

  • Full Member
  • ***
  • Posts: 113
Re: 2 troj-gen found- won't move to chest or clean/repair
« Reply #4 on: February 03, 2009, 10:13:45 PM »
Don't know why When virus are found I can't move to chest, had this problem once before on my last lap. Ok so now Avast found 2 in the adobe Reader files 1 in start up and the other in system restore.

Ran and tried to move to chest, said it could not
ran in boot and set to repair- again said it could not

I am running Avast home - up to date, Why is it not quarentining or repairing????
What do I do other than deleting the files and or adobe?
I have found similar in the last three days. 2 days ago there was an infection that I didn't spot - I think the computer went into hibernate. Nothing in the Chest but in the log viewer under "Warning" it lists "Sign of "Win32:Trojan-gen {Other}" has been found in "C:\Windows\Installer\20134b.msp\Toolbar_new\Binary.ToolbarInstallerExe"....and that is as much as I can see.

Today two warning of a Trojan I did see as it scanned. I clicked "Move to Chest" and it carried on scanning and again same with the second.
"Sign of "Win32:Trojan-gen {Other}" has been found in "C:\Program Files\Adobe\Reader 8.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A83100000000......and that's as much as I can see.
"Sign of "Win32:Trojan-gen {Other}" has been found in "C:\System Volume Information\_restore{4652DFE7-7616-4AAA-A9DC-221407E8679A}\RP37... and again as much as I can see.

Why if when I click to send the items to the Chest (in the case of today anyway) they don't appear in the chest but only in the log viewer as described where nothing can be done with them. I'm not at all sure, especially with the repeats if it is dealt with or not. After the first occurrence 2 days ago I did a boot time scan, which was clean. I only knew there has been a warning at all then as my wife heard something from her bed as I was elsewhere while the scan was going on.
Thanks
Intel Core i5 CPU 4 x 3200 Mhz, 8Gb DDR3 RAM, Windows 10 64 bit, Malwarebytes' Anti-Malware 1.6 free, Superantispyware.
Samsung S3 mobile with Avast Mobile Pro and on Lenovo tablet.

puter illit

  • Guest
Re: 2 troj-gen found- won't move to chest or clean/repair
« Reply #5 on: February 03, 2009, 10:24:03 PM »
I'm not surprised that a Repair didn't work (see below), but you really shouldn't change the option from send to chest to repair and expect different results, the dea of the boot-time scan would be to get around why it couldn't be sent to the chest.

So you should run the boot-time scan again and select send to chest.

####
Trojans generally can't be repaired (either by the VRDB or avast virus cleaner), because the entire content of the file is malware, so it is either move to chest or delete, move to the chest being the best option (first do no harm). When a file is in the chest it can't do any harm and you can investigate the infected warning.

The VRDB only protects certain files, mainly .exe files, it doesn't protect data files or all files, it is not a back-up program, so there are going to be many occasions where repair won't be an option.

Only true virus infection can be repaired, e.g. when a virus infects a file it adds a small part to it, provided that file is one that avast's VRDB would monitor and you have run the VRDB, then it may be possible to repair the file to its uninfected state.

However, for the most part so called viruses, trojans (adware/spyware/malware, etc.) can't be repaired because the complete content of the file is malicious.



Well guys thanks for all your responses: BUT it will not move to Chest!!!! Which was part of my question, WHY??? Can't I move to chest, tells me it's unable too!
Just spent half the day running in boot, checking all the file extensions, running Trend, Fix blaster, ccleaner etc. etc.

I just set the chest file size to 0 (unlimited) will that help???

Offline polonus

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 33892
  • malware fighter
Re: 2 troj-gen found- won't move to chest or clean/repair
« Reply #6 on: February 03, 2009, 10:35:34 PM »
Hi puter illit, you said it found one in system restore, if system restore isn't disabled temporarily how will you remove it, if that is keeping it alive...
Re: http://www.pchell.com/virus/systemrestore.shtml
After it has gone reboot and re-enable system restore as described,
tell me if that worked for you,

pol
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!

puter illit

  • Guest
Re: 2 troj-gen found- won't move to chest or clean/repair
« Reply #7 on: February 03, 2009, 10:45:31 PM »
Hi puter illit, you said it found one in system restore, if system restore isn't disabled temporarily how will you remove it, if that is keeping it alive...
Re: http://www.pchell.com/virus/systemrestore.shtml
After it has gone reboot and re-enable system restore as described,
tell me if that worked for you,

pol

Already did that, disabled system restore and ran in boot, same results each time - can't repair will not move to chest?? :o :(, What settings am I missing ???

I just increased the file size for the chest and was just about to run avast again. Don't know why I can't move to chest. had the same problem last year on a different lap. Don't want to just delete, last year that caused a bigger problem because it was embedded in a hidden file that couldn't be deleted.

Offline polonus

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 33892
  • malware fighter
Re: 2 troj-gen found- won't move to chest or clean/repair
« Reply #8 on: February 03, 2009, 11:09:55 PM »
Hi puter illit,

The thing you could do is run a boot time scan from avast, and download DrWebCureIt from here and do a full scan: ftp://ftp.drweb.com/pub/drweb/cureit/launch.exe
How to perform n avast boot time scan:
To schedule boot scan using Avast, follow the steps below:-

    * Right click on the Avast system tray icon
    * Click on “Start Avast Anti Virus”
    * Avast anti virus window will pop up and run a memory scan
    * Once memory scan finish, you can right click on the Avast anti virus window and select “Schedule  Boot Time Scan”
    * “Schedule Boot Time Scan” window will popup, select “Scan all local disk” and check on “Advanced Options”
    * For normal infected file select “Move infected files to Chest” and select “No action” for system files and Press “Schedule” button.
    * Avast will prompt you for restart to perform the Boot time scan and click “Yes” to reboot and start the scan.
    * Done you have just scheduled a boot time scan from Avast anti virus,

polonus
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 88900
  • No support PMs thanks
Re: 2 troj-gen found- won't move to chest or clean/repair
« Reply #9 on: February 03, 2009, 11:29:42 PM »
Well guys thanks for all your responses: BUT it will not move to Chest!!!! Which was part of my question, WHY??? Can't I move to chest, tells me it's unable too!
Just spent half the day running in boot, checking all the file extensions, running Trend, Fix blaster, ccleaner etc. etc.

I just set the chest file size to 0 (unlimited) will that help???

Well avast doesn't normally leave you hanging in the wind by just saying it can't move it. It usually gives the reason why it can't move it, commonly this is because it is in use by another process, or it might be in an archive file and it can't extract it (this is what I suspect if it can't be dealt with outside of windows).

So, what is the infected file name, where was it found e.g. (C:\windows\system32\infected-file-name.xxx) ? 
Check the avast! Log Viewer (right click the avast 'a' icon), Warning section, this contains information on all avast detections. C:\Program Files\Alwil Software\Avast4\ashLogV.exe

If this is physically large file, then your increasing the size of the chest is unlikely to resolve that, there is however, another option and that is to increase the Maximum file size to send (you didn't say if you also adjusted this) that you could try, but lets find out what the file name and location is first.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.2.6105 (build 24.2.8918.824) UI 1.0.799/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

puter illit

  • Guest
Re: 2 troj-gen found- won't move to chest or clean/repair
« Reply #10 on: February 03, 2009, 11:56:57 PM »
Well guys thanks for all your responses: BUT it will not move to Chest!!!! Which was part of my question, WHY??? Can't I move to chest, tells me it's unable too!
Just spent half the day running in boot, checking all the file extensions, running Trend, Fix blaster, ccleaner etc. etc.

I just set the chest file size to 0 (unlimited) will that help???

Well avast doesn't normally leave you hanging in the wind by just saying it can't move it. It usually gives the reason why it can't move it, commonly this is because it is in use by another process, or it might be in an archive file and it can't extract it (this is what I suspect if it can't be dealt with outside of windows).

So, what is the infected file name, where was it found e.g. (C:\windows\system32\infected-file-name.xxx) ? 
Check the avast! Log Viewer (right click the avast 'a' icon), Warning section, this contains information on all avast detections. C:\Program Files\Alwil Software\Avast4\ashLogV.exe

If this is physically large file, then your increasing the size of the chest is unlikely to resolve that, there is however, another option and that is to increase the Maximum file size to send (you didn't say if you also adjusted this) that you could try, but lets find out what the file name and location is first.

Same as Rob's : Sign of "Win32:Trojan-gen {Other}" has been found in "C:\Program Files\Adobe\Reader 8.0\Setup Files\ (etc. etc. ;D)
"Sign of "Win32:Trojan-gen {Other}" has been found in "C:\System Volume Information\_restore
(ect. etc.  ;D) Thanks Rob, lol

Ok update!! I increased the chest's file size from 1024 to 10240 and ran it again in boot time with system restore OFF! 
Hellooooo it finally moved the 1st infection to chest :-*
however the 2nd :Error 42111 - "not supported for this type of archive"

OK so now what I found it in Chest in infected folder but it says -no virus-???
There was no option to scan, clean or repair???? so what do I do with it NOW :-\
I ran avast normally still while system restore was off and it came up clean :-* ;) :-\
reset system restore but it show's the chest as a Temp file, so if I clean my temp files wil it delete that file?????



Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 88900
  • No support PMs thanks
Re: 2 troj-gen found- won't move to chest or clean/repair
« Reply #11 on: February 04, 2009, 12:18:45 AM »
If having sent it to the chest and scanned it from 'within' (and that is crucial) the chest, if it has not been detected you can restore it. This can happen if the original detection was found to be a false positive (someone would have to have submitted the file) and the virus signatures corrected.

So this provides a lesson in always send to the chest 'first do no harm' and never delete.

Since this is also to do with Adobe\Reader 8.0 which is well out of date and vulnerable to attack I suggest you uninstall ir (add remove programs) and install the latest version of Adobe Acrobat PDF Reader. Or use a different pdf reader like, FoxIt reader, much less bloated.

I have to admit that you have me totally confused (not too difficult):
Quote from: puter illit
OK so now what I found it in Chest in infected folder but it says -no virus-???
There was no option to scan, clean or repair?Huh so what do I do with it NOW Undecided
I ran avast normally still while system restore was off and it came up clean Kiss Wink Undecided
reset system restore but it show's the chest as a Temp file, so if I clean my temp files wil it delete that file?Huh?

1. If you highlight the file, or right click on the file there should be those options (see image), so exactly what were you doing ?

2. When you disable system restore it clears the restore points in the System Volume Information folder including the infected one, so it isn't a surprise that nothing was found.

3. The Chest isn't in a Temp folder, this is where the chest folder is, C:\Program Files\Alwil Software\Avast4\DATA\chest. There is an _avast4_ folder in a Temp folder, which is where avast unpacks files so they can be scanned, but this is most certainly not the chest.
« Last Edit: February 04, 2009, 12:20:25 AM by DavidR »
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.2.6105 (build 24.2.8918.824) UI 1.0.799/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

puter illit

  • Guest
Re: 2 troj-gen found- won't move to chest or clean/repair
« Reply #12 on: February 04, 2009, 01:07:42 AM »
If having sent it to the chest and scanned it from 'within' (and that is crucial) the chest, if it has not been detected you can restore it. This can happen if the original detection was found to be a false positive (someone would have to have submitted the file) and the virus signatures corrected.

So this provides a lesson in always send to the chest 'first do no harm' and never delete.

Since this is also to do with Adobe\Reader 8.0 which is well out of date and vulnerable to attack I suggest you uninstall ir (add remove programs) and install the latest version of Adobe Acrobat PDF Reader. Or use a different pdf reader like, FoxIt reader, much less bloated.

I have to admit that you have me totally confused (not too difficult):
Quote from: puter illit
OK so now what I found it in Chest in infected folder but it says -no virus-???
There was no option to scan, clean or repair?Huh so what do I do with it NOW Undecided
I ran avast normally still while system restore was off and it came up clean Kiss Wink Undecided
reset system restore but it show's the chest as a Temp file, so if I clean my temp files wil it delete that file?Huh?

1. If you highlight the file, or right click on the file there should be those options (see image), so exactly what were you doing ?

2. When you disable system restore it clears the restore points in the System Volume Information folder including the infected one, so it isn't a surprise that nothing was found.

3. The Chest isn't in a Temp folder, this is where the chest folder is, C:\Program Files\Alwil Software\Avast4\DATA\chest. There is an _avast4_ folder in a Temp folder, which is where avast unpacks files so they can be scanned, but this is most certainly not the chest.


"1. If you highlight the file, or right click on the file there should be those options (see image), so exactly what were you doing ?"

Exactly that, lol. clicked on the scan and nothing happened ::)
Well, avast isn't picking it up on the last scan, so I don't know if it's because it's in the chest or if it was a fasle positive to begin with. either way until I try using adobe I won't know if I've created another problem or not. I'm just going to leave it in the chest for now.

Thanks a bunch guys for all your quick responses and suggestions.

Offline rob24

  • Full Member
  • ***
  • Posts: 113
Re: 2 troj-gen found- won't move to chest or clean/repair
« Reply #13 on: February 04, 2009, 01:51:30 AM »
Hi Thanks for this info. I'm going to have to come back to this sometime tomorrow (hospital appointment) and do another boot scan. I did turn off the system restore for tonight's boot scan. And after reading puter illit I have now increased the chest file size too now for my next scan. I was unable to chest, delete, move, repair or any option but ignore during boot scan (which included archives this time).

I did wander about getting shot of Abode Reader 8.0. Looks like The next version of Adobe Reader is 9. Is that the one you mean by DavidR by Adobe Acrobat PDF Reader? And the FoxIt Reader - does it do all that the Adobe Reader does?
« Last Edit: February 04, 2009, 01:53:25 AM by rob24 »
Intel Core i5 CPU 4 x 3200 Mhz, 8Gb DDR3 RAM, Windows 10 64 bit, Malwarebytes' Anti-Malware 1.6 free, Superantispyware.
Samsung S3 mobile with Avast Mobile Pro and on Lenovo tablet.

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 88900
  • No support PMs thanks
Re: 2 troj-gen found- won't move to chest or clean/repair
« Reply #14 on: February 04, 2009, 03:15:37 AM »
@ puter illit
I'm at a loss as to what to suggest I haven't seen that in the time I have been on the forums (a while), what if you try Highlighting the file (not right click selection), but use the top menu, File, Scan, see image.

Files in the chest are encrypted so avast scans from outside the chest will not detect anything.

Personally I got rid of Adobe Reader a long time ago and haven't looked back, but for sure I wouldn't use adobe reader version 8.0 as there are many vulnerabilities that are being exploited, that you could be putting your system at risk. I would uninstall it and either get the latest version or a different application, but I wouldn't use a vulnerable version.

@ rob24
Honestly, the chest size can be 0=unlimited but if a file that you want to place in it is greater than the Maximum file size to send figure it won't work, so all I can put this down to is a happy coincidence.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.2.6105 (build 24.2.8918.824) UI 1.0.799/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security