Assumption (Avast remove system file by accident)

[tlee]

Hi,

As for the topic,

since, I checked the default setting of action for all kind of threats is to move to Chest.

So, will it cause able boot to Windows?

How to recover it while happend? touch wood ...........

Thanks,
tlee

[DavidR]

I believe there are protections on moving genuine system files as they should be digitally signed, and I think that there is meant to be a white list for unchanged signed files, etc.

[Lisandro]

If you really got a necessary file to boot infected and if avast move it to Chest (for instance in boot time scanning), you'll need to replace that file with a clean one or restore Windows.
Indeed, you can have an un-bootable computer if avast move that file to Chest. Like David said, it won't happen by accident as avast also checks the signature of the file. But if it is infected, and avast moves it to Chest...

We already ask for a bootable CD...

[DavidR]

There are some system files that even if infected won't be moved to the chest (or deleted, etc.) as in doing so it could impact on the system. This was very common in the win32:patched infections in system files. They ended having to be repaired by a 3rd party application I believe. So I don't think that is so common an occurrence.

[tlee]

Hello,

Thank you so much for yours explanation.

What I afraid that is the false positive detection. Since, even Symantec or other AV also that the issue of false positive detection.

tlee

[DavidR]

You're welcome.

So are you saying that avast has detected something that you think is a false positive ?

If so if you can provide the infected file name, where was it found e.g. (C:\windows\system32\infected-file-name.xxx) ?