Win32:Delf-MZG

[street_lethal]

No, "No action" certainly doesn't modify the file.
Yes, it doesn't allow it to be loaded - but after the virus database is updated, it's possible to restart the affected program (OK, if it's an auto-start program, it might be better to restart the computer to get into the "ordinary" state).

I clicked "no action" on every warning, turned off Avast's shields, couldn't start Spybot one of the files couldn't be found. Granted I hadn't ran Spybot on the laptop for a long time but it worked the last time I used it. Who knows, I uninstalled it anyway, don't need it.

[Bernez]

Hello, It is OK but when the files were restored, they remain in the quarantine zone (or double). Do you can safely remove it for now there is nothing in the quarantine zone? ? ?
Thank you very much
Bernez

[Sesame]

Hello, It is OK but when the files were restored, they remain in the quarantine zone (or double). Do you can safely remove it for now there is nothing in the quarantine zone? ? ?

In theory, you can remove them safely but there are always the possibility of human errors.  So, please make sure that the applications related with the files work properly before deleting them.

[Bernez]

Rumpel    OK, I'll wait a few days to see if everything works perfectly before deleting
Thank you very much
Bernez

[DavidR]

The Restore and Extract options for that matter, is actually a copy and paste, a copy will remain in the chest.

After you Restored. check the original location it was sent to and if present then you can delete the copy in the chest. This is the reason a copy is left in the chest (I believe), to ensure that the extract/restore succeed, otherwise you could be left with no copy.

[Bernez]

Yes, but when you're not a computer specialist, it is not always easy to find the original file to see if restoration is made........

[DavidR]

No need to be an expert, if the copy of the file is in the chest as it should be, then the location will be listed under the Original Location Heading

Or you can right click on it and select properties and it will show what the original location is and more detailed information.

[Apttec55]

I too fell for the old Delf-MZG, totally wiped my system out, afraid to restart, most files it could not repair, so I rescanned and deleted...that was the second mistake, now in restoring most of my software, cannot due to date sensitive freeware and such, also deleted several files from Win 32 system folder ...so I am up s*** Creek without a paddle! I have not restarted, am moving files to large thumb drive and putting in new system...I guess its time to redo this one and sell it, new one has been built for about 3 months now...so this pushes me into switching over to it...only good thing to come from this...I understand it was a false positive, but too little too late for me! But Avast has always been good for me and does an excellent job so I am keeping it. OH WELL!

[Lisandro]

Apttec55, can we help you in anything? Everybody is terrible sorry with the fact...

[Apttec55]

No, but I do much appreciate the offer, my luck to just happen to be on the computer during that 5 hour period of time when this occurred...just one of those things. It will force me to move and start using my new system here...thats good. I am always reluctant to start up a new system but this time I will move old Sata drive to new system as no 2 and be able to move a lot of software that way...its XP Home, the new system is XP Pro, so looking forward to starting it up..its an AMD Quad Core 9550, glad to get away from this Athlon 2800...its been a good one. Thanks again. Ric

[Lisandro]

You're welcome. Feel free to come back any time you need help or just to change experiences

[Bernez]

A Davidr  Of course, I understand that, unfortunately, all records are such as :C:\System Volume Information\restore{_5259299F-BD84-4AB7-8D71-4A5979BD915A}\RP530
and when I access it, Windows tells me: "Access Denied" but that's OK, I'll leave it doubles the area of food
Thank you again to all
Bernez

[DavidR]

The C:\System Volume Information is a windows protected area under the control of system restore and that is why windows blocks it.

- Infected/Suspect Restore Points - There really is little benefit in chasing a detection in the system volume information folder. It is only there because it had previously been deleted or moved from the system folders and this is a back-up created by system restore.
 
- Worst case scenario it isn't infected and you delete it, you can't use that restore point in the future, not much of a loss and the older the restore point is the less of an issue it is.
 
- So if there is any suspicion about a restore point then it is best removed from the system volume information folder or it could bite you in the rear at some point in the future when you use system restore if it included that restore point.

So unfortunately you won't be able to restore any of these restore points which happened to get caught up in the Win32:Delf-MZG FP, but because of the above this is a less serious loss. So personally I would call it a day on those detected restore points and delete them from the avast chest.

[Bernez]

To DavidR   It's OK, thank you for all these explanations and for the time you take on this forum

[DavidR]

You're welcome.