Author Topic: A0358766.com is infected by EICAR Test-NOT virus  (Read 3087 times)

0 Members and 1 Guest are viewing this topic.

Avastfan1

  • Guest
A0358766.com is infected by EICAR Test-NOT virus
« on: December 15, 2010, 05:54:45 PM »
Dear Forum,

Can I safely delete the file A0358766.com from a System Volume Information folder?

Avast detected EICAR Test-NOT virus in C:\System Volume Information\_restore{..}\RP1061\A0358766.com, and as far as I am aware, this file is harmless.

I would like to delete it if possible. I am not sure, however, whether this will twat any Window$ files.

Thanks in advance!

Avastfan1

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67241
Re: A0358766.com is infected by EICAR Test-NOT virus
« Reply #1 on: December 15, 2010, 06:02:54 PM »
You can always delete files from C:\System Volume Information\_restore{..}\
You'll lose that particular restore point (once broken, all the point is discarded).
I suggest you run a full avast scanning.
The best things in life are free.

Offline SpeedyPC

  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 3357
  • Avast shall conquer the whole world
Re: A0358766.com is infected by EICAR Test-NOT virus
« Reply #2 on: December 15, 2010, 06:03:29 PM »
Yes you can delete it only IF you have move this file to Chest after the full scan that way you can delete from the chest section easier and not from the restore point as Tech said.
« Last Edit: December 15, 2010, 06:05:21 PM by SpeedyPC »
ASUS G75VX-T4153H | Avast Premium v22.4.6011 | Avast SecureLine VPN | Avast Secure Browser | Avast Driver Updater | Avast BreachGuard | W8.1 64bit | Firefox 64bit | Thunderbird 64bit | MBAM Premium | Adguard Premium | CryptoPrevent Premium | CCleaner Portable | MCShield | Macrium Reflect | 7-Zip

Offline DavidR

  • Avast √úberevangelist
  • Certainly Bot
  • *****
  • Posts: 86501
  • No support PMs thanks
Re: A0358766.com is infected by EICAR Test-NOT virus
« Reply #3 on: December 15, 2010, 06:20:12 PM »
This file is only in the C:\System Volume Information restore point because it was previously deleted or moved, so yes you can delete it without issue.

Generally deletion isn't advised, but to move it to the chest and leave it there for a few weeks, scan it again and if still detected delete it from within the chest.

But in this case:
- Infected Restore Points - There really is little benefit in chasing a detection in the system volume information folder. It is only there because it had previously been deleted or moved from the system folders and this is a back-up created by system restore.
 
- Worst case scenario it isn't infected and you delete it, you can't use that restore point in the future, not much of a loss and the older the restore point is the less of an issue it is.
 
- So if there is any suspicion about a restore point then it is best removed from the system volume information folder or it could bite you in the rear at some point in the future when you use system restore if it included that restore point.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 22.2.6003 (build 22.2.7013.717) UI 1.0.697/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Avastfan1

  • Guest
Re: A0358766.com is infected by EICAR Test-NOT virus
« Reply #4 on: December 15, 2010, 08:34:47 PM »
Thanks for the advice. I manually deleted the EICAR file.

A second boot-time scan found another instance of EICAR in another System Volume restore point directory.

This is to be expected, as the first scan was aborted after finding the first file.

I manually deleted the EICAR second file.

Now, for a complete third, and hopefully final, boot-time scan.

Will post the results when it is finished.

Avastfan1

PS: The second scan completed with no other instances of EICAR or anything else.

Offline DavidR

  • Avast √úberevangelist
  • Certainly Bot
  • *****
  • Posts: 86501
  • No support PMs thanks
Re: A0358766.com is infected by EICAR Test-NOT virus
« Reply #5 on: December 15, 2010, 09:56:17 PM »
You're welcome.

Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 22.2.6003 (build 22.2.7013.717) UI 1.0.697/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security