Access is Denied when moving file to chest - Version 5

[Allochthonous]

I keep getting an Access is Denied error when i try to move an "infected" file to the chest.

Whats the deal?

Version 5 Free
Windows 7 32 bit

I have tried as a user account and as an admin account.

Paul

[kadenk]

the malware is running and can't be stopped right now here's what you do: reboot, if that doesn't let you move it to the chest open up task manager, then go to processes and look for any suspicious processes end them then try again if that doesn't work I don't know what else to tell you.

[Allochthonous]

I will try that, but i am fairly certain this is a false positive. I have posted in that forum as well.

pk

[DavidR]

What is the malware name, the file name and location ?

As has been mentioned it is possible malware blocking, but given your comment, Access is Denied error when i try to move an "infected" file to the chest."

So is it access to the chest or access to the chest that is denied ?

If the file and you have Win2k, XP, vista or Win7 (all 32bit), you could enable a boot time scan.

[Allochthonous]

Here is my post with the details about this file (The Sims 2 Deluxe_uninst.exe)

http://forum.avast.com/index.php?topic=53906.0

When I scan the folder that the file is in (C:\Program Files\EA GAMES\ The Sims 2 Deluxe\Support\), it warns about the infection. When I go to Show Results and Apply to move to chest, i get the Access is Denied error.

After I close that window, I do get a warning about how a virus was detected in operational memory or something like that and how I should do a boot time scan (which is what i am doing now and why my details are a bit sketchy). It found the file in the boot scan and i apparently was able to move it at this time.

I really cannot imagine that this is a real infection.  It's a fairly fresh install of Windows 7 and has been carefully used. Also, the file comes up hot on another machine straight off of the Sims 2 CD. And VirusTotal only has 2 hits.

PK

[DavidR]

I have seen it and just posted how to check for an FP at virustotal.

[Allochthonous]

Yeah, i had already scanned with VirusTotal.  I have been through this several times with other files.

This is the first time i have not been able to move a file to the chest though.  This is the first "hit" while using version 5. The other instances were with previous versions.

PK

[Allochthonous]

Well, the false positive seems to be fixed, but I am still having problems with the virus vault.  Now it will not restore the file out of the vault back into its original location (nor can I extract it there).  It moved the file, along with the Sims Complete uninst file, during a boot time scan.  Apparently the Sims Complete file is not an issue, as it successfully restored and extracted to its original location.

However, I WAS able to extract the Sims 2 Deluxe file to a location other than the original location.  When i restore though, it does nothing.  No error, nothing.

So now I am wondering if it is an issue with the folder??

PK

[DavidR]

You say it does nothing, when you right click on the file in the chest and select Restore do you see image1 ?

If yes, then did you select Overwrite or Overwrite all (or I think any other option would fail) ?

I just tested using the file in the image (Overwrite) and that worked, the file is back in the original location. A copy remains in the chest (backup until you confirm the file is back in the original location), so is this why you think it does nothing ?

[Hermite15]

I also had an access denied when attempting to move to Chest an FP yesterday. It was teracopy, obviously constantly in use by the system. What I did to submit it to avast was deactivate the fileshield temporarily, made a copy of the executable, and added it to Chest manually.

[wonderwrench]

In Windows Vista and Windows 7 the Program files folder is protected. This could be causing Avast to fail when trying to move the file to the chest.
A work around would be to take ownership of the folder the file is in. See http://technet.microsoft.com/en-us/library/cc753659.aspx
This may also fix the restore file problem. I would only recommend doing this to prove whats causing the problem. Once proven or dis-proven set the ownership back to trusted installer.

[Hermite15]

In Windows Vista and Windows 7 the Program files folder is protected. This could be causing Avast to fail when trying to move the file to the chest

not protected from preventing an AV from send files to Chest (would be a serious issue for AVs  ), I just tried manually and it worked without any problem, exe is in Chest. And forget about changing a program file folder ownership, this is not advised at all; folders and files owners are either admin or system there and it should remain this way.

[wonderwrench]

In Windows Vista and Windows 7 the Program files folder is protected. This could be causing Avast to fail when trying to move the file to the chest

not protected from preventing an AV from send files to Chest, I just tried manually and it worked without any problem, exe is in Chest. And forget about changing a program file folder ownership, this is not advised at all; folders and files owners are either admin or system there and it should remain this way.

Sorry but no user account including admin has ownership of protected folders. Only the trusted installer does. I should have been more specific.
Take ownership of the folder the file in question is in not the program files folder. Because as you said its not advisable to take ownership of the program files folder as this would defeat the protection Microsoft designed into Vista and Seven. This may or may not allow the files to be moved to and from the chest but it will help diagnose the cause of the problem. And as I said after testing set the folder ownership back to the default of trusted installer.

[Hermite15]

any what I said before doesn't prove anything as adding a file manually to Chest doesn't remove it from its original location (just checked).
 You said the program file folder was a protected folder right ? and trusted installer was the owner, that's only true for the program files folder, not for sub-folders 

[Allochthonous]

DavidR - I know it does nothing because I check the original location and the file is not there.  There is no warning, error, or confirmation from Avast either.

Everyone else - That is an interesting theory, but why then did the Sims Complete file restore back to its original location?  This file is also nested within the Program Files folder. Note though that I do not know whether the Avast GUI would have been able to move this file to the chest, since it was moved during a boot time scan.

I guess i could check out the permissions on this Support folder (the folder that each of the files is in - one being in a Maxis\Sims Complete\ path, the other in a EA Games\Sims 2 Deluxe path).  Maybe there is something funky on the Sims 2 folder permissions?

I did try moving to chest as both a user and admin though.

PK