Repairing infected files

[wyatt]

I've been using Avast Home for about 6 months and have been pretty happy.  Occassionally it's detected a virus, but every time I click "repair", it's failed.  I then have to remove the infected file to the Chest and delete the file.  This has been OK up till now, but I now have a file that I really want to keep but Avast won't repair it for me.  Am I doing something wrong?  How do I repair a file?

[Lisandro]

I've been using Avast Home for about 6 months and have been pretty happy.  Occassionally it's detected a virus, but every time I click "repair", it's failed.  I then have to remove the infected file to the Chest and delete the file.  This has been OK up till now, but I now have a file that I really want to keep but Avast won't repair it for me.  Am I doing something wrong?  How do I repair a file?

To be repaired, as I know, the file must be at the VRDB (virus recovery database).
A file won't be repaired if its informations were not properly stored there (for instance, if your VRDB update period is so long and the file new or, on contrary, you update VRDB so frequently that the 'infected' informations were stored over the clean ones). VRDB stores (if I'm not wrong) the last three 'versions' of the executable files of your computer.

Attached files or non-executables ones, maybe, won't be repaired at all...
Which file are you talking about?

[Eddy]

What file is it, what is its location and what virus is detected?

[wyatt]

The file is an .exe file downloaded from eMule.  It is infected with Win32:Backterra [wrm].  The file is currently in the Virus Chest but can be relocated back to the original eMule Incoming folder.

Is the VRDB the same as the "Virus Database" option in the Avast Menu?  If so, how do you use it to repair a file?

Thanks.

[S.Z.Craftec]

Here is explanation what is and what for it's used (VRDB)... browsing help file is always very helpful.

VRDB

VRDB stands for "Virus Recovery Database"; it was known as "Integrity Database" in previous avast! versions. The aim of VRDB is to help when, despite all the security measures, a virus gets inside the computer and the files are infected. With the help of VRDB, it is possible to repair infected files (return them exactly to their original state). VRBD is announced by an icon with the letter "i" in the system tray (next to the clock). If the icon is animated, the database is being created right now.

VRDB PRINCIPLE

avast! creates an integrity database, i.e. it stores information about the actual state of the files, doing it three versions back for each file. The database creation/maintenance is performed either when the computer is idle, or when the screen-saver is running (any screen-saver, not only the avast! one). This database, once it is created, is updated each three weeks (this value may be changed by editing avast4.ini).
If any file is infected by a virus, it is possible to repair it, i.e. turn it to its original state. If there are multiple versions of the file in the database, you can choose which version you want to restore.

SETTINGS

The settings of VRBD can be changed by clicking on the icon in the system tray with the right mouse button. There are three options:

Generate VRDB when computer is idle. avast! will create its database only when the computer is idle, i.e. when it is not being used.
Generate VRDB only when screen-saver is running. avast! will create its database during the time screen-saver is running. It may be any screen-saver, not only the one included in avast!
Disable VRDB generation. avast! will neither create, nor update the database. If you select this option, it will not be possible to repair virus infected files in the future!

[wyatt]

OK, I found the VRDB - the icon was hidden in the system tray, but I've now merged the icons.

I clicked on 'Generate VRDB Now".  Once that was completed, I transferred the file back to it's original folder.  Avast detected the virus and I clicked on repair - again, nothing happened.

[S.Z.Craftec]

This is quote from Technical:

A file won't be repaired if its informations were not properly stored there (for instance, if your VRDB update period is so long and the file new or, on contrary, you update VRDB so frequently that the 'infected' informations were stored over the clean ones). VRDB stores (if I'm not wrong) the last three 'versions' of the executable files of your computer.

He explained it pretty good. Your VRDB wasn't generated before, so there is no information available for succesful repair of those files. There is no information about "healthy" versions of those files that needs to be repaired. You should have turned on Generating of VRDB as soon as you installed and started your copy of avast! That way, all those information needed for succesful repairing of infected files, would be available and ready for repair process.

Cheers !

[Lisandro]

Is the VRDB the same as the "Virus Database" option in the Avast Menu?

No, VRDB (for recovery purposes) is different from VPS (the updatable database with virus signatures for detection). The second could be updated like the Program. For more info into VRDB, browse a little into 'FAQ' links on my signature.

If so, how do you use it to repair a file?

avast will automatically use the information stored there to repair the file. You can't handle it manually. It's not the purpose of the database. To do this, handle, you should work with an entire backup of your system.

[Lisandro]

OK, I found the VRDB - the icon was hidden in the system tray, but I've now merged the icons.

I clicked on 'Generate VRDB Now".  Once that was completed, I transferred the file back to it's original folder.  Avast detected the virus and I clicked on repair - again, nothing happened.

Wyatt, you're not reading what we are trying to explain...
Please, VRDB can't be generated after a virus infection... It won't work... VRDB is for clean files, done before the infection...

If the file is an .exe file downloaded from eMule why don't you simple download it again... Oh, I mean, a clean version of it!?  

[wyatt]

Yes, I understand what you're saying now.  It's just that I couldn't find the VRDB before.  Obviously with this system there is no way to repair a newly acquired infected file - you can only repair older files.  It's a shame, but I can live with this!

[Lisandro]

It's a shame, but I can live with this!

No, it's not, it's life... and backup  
VRDB has only few informations, backup the whole file