Author Topic: quarantine folder on hard disk  (Read 27915 times)

0 Members and 1 Guest are viewing this topic.

Offline danny96

  • Malware Fighter
  • Advanced Poster
  • **
  • Posts: 668
  • No-malware!
Re: quarantine folder on hard disk
« Reply #15 on: April 03, 2011, 02:33:50 PM »
And the purpose of this excercise is? Restore infected files so that you can boot and get more of them infected, or what?  ??? ??? ???
Stop entering your stupid notes and give him some help  >:(
Then I offer help as you are running Windows 7 x64 and I am running XP!
Yes
Real-time protection and Firewall: COMODO Internet Security 12.0.0.6810 -- Additional Protection: Web Of Trust, Ublock, NoScript, Malwarebytes Premium, Avast! Online Security, Hitman Pro -- OS: Windows 10

Hermite15

  • Guest
Re: quarantine folder on hard disk
« Reply #16 on: April 03, 2011, 02:34:45 PM »
i have find the folder F:\Documents and Settings\All Users\Application Data\AVAST Software\Avast\chest with 33 files named "0000000A" to "00000020" and ondex.xml.

what can i do ? Send the folder to avast lab ?


oui ;)

Offline danny96

  • Malware Fighter
  • Advanced Poster
  • **
  • Posts: 668
  • No-malware!
Re: quarantine folder on hard disk
« Reply #17 on: April 03, 2011, 02:35:04 PM »
I don't think he wants to restore the files... well I hope not. But as he cannot boot anymore as a result of these files being quarantined, he just wants to see them in the chest folder from another OS install.
I don't want him to restore the files forever, I want just to let him send these files to avast! If this is false positive or he's infected,
Real-time protection and Firewall: COMODO Internet Security 12.0.0.6810 -- Additional Protection: Web Of Trust, Ublock, NoScript, Malwarebytes Premium, Avast! Online Security, Hitman Pro -- OS: Windows 10

Hermite15

  • Guest
Re: quarantine folder on hard disk
« Reply #18 on: April 03, 2011, 02:35:51 PM »
these sound like restore point or recycled files..

doktornotor

  • Guest
Re: quarantine folder on hard disk
« Reply #19 on: April 03, 2011, 02:36:59 PM »
Ignore the quarantined crap in the chest for now, you can submit them via chest normally once you have fixed your system properly. Do you have XP install media at hand? If so, take note of the missing files when XP fails to boot, you can use expand.exe to replace them when you boot to XP recovery console (from the F8 boot menu or from the CD).

these sound like restore point or recycled files..

Nah, avast! is mangling the filenames as well. There is index.xml file with information about the original names and location of the renamed files in the chest folder.
« Last Edit: April 03, 2011, 02:43:28 PM by doktornotor »

coco3117

  • Guest
Re: quarantine folder on hard disk
« Reply #20 on: April 03, 2011, 02:47:54 PM »
can i open the index.xml with all security ????


Hermite15

  • Guest
Re: quarantine folder on hard disk
« Reply #21 on: April 03, 2011, 02:49:14 PM »
can i open the index.xml with all security ????



what for ?

coco3117

  • Guest
Re: quarantine folder on hard disk
« Reply #22 on: April 03, 2011, 02:52:30 PM »
to look the files names

Hermite15

  • Guest
Re: quarantine folder on hard disk
« Reply #23 on: April 03, 2011, 02:54:49 PM »
look, we have no idea why your files got detected and blocked in the first place. If I were you, I'd leave all that junk alone and re-install XP from scratch. I wouldn't even attempt a repair of it. A repair could work... but I just wouldn't trust the setup.

doktornotor

  • Guest
Re: quarantine folder on hard disk
« Reply #24 on: April 03, 2011, 03:04:54 PM »
look, we have no idea why your files got detected and blocked in the first place. If I were you, I'd leave all that junk alone and re-install XP from scratch. I wouldn't even attempt a repair of it. A repair could work... but I just wouldn't trust the setup.

I can assist him with repair of his system via the XP recovery console if he wishes and has at least the bootable CD at hand. Not going to help in any way with restoring the junk though. As said, that can be done properly once the system is back alive and kicking and will not help with fixing the system in any way. Chances that those are FPs are so slim that this is basically just waste of time, it is not like avast! would render people systems unbootable due to FPs every day.


« Last Edit: April 03, 2011, 03:06:38 PM by doktornotor »

coco3117

  • Guest
Re: quarantine folder on hard disk
« Reply #25 on: April 03, 2011, 03:24:13 PM »
i have a problem to send the rar at the address : http://ftp://ftp.avast.com/incoming/ 

the reply is : "Google chrome could not find ftp"


Offline DavidR

  • Avast √úberevangelist
  • Certainly Bot
  • *****
  • Posts: 88170
  • No support PMs thanks
Re: quarantine folder on hard disk
« Reply #26 on: April 03, 2011, 04:22:24 PM »
i have find the folder F:\Documents and Settings\All Users\Application Data\AVAST Software\Avast\chest with 33 files named "0000000A" to "00000020" and ondex.xml.

what can i do ? Send the folder to avast lab ?


You can't work with the files from outside the avast chest, they are encrypted. You have to open the avast chest, avastUI, Maintenance, Virus Chest.

Files can be submitted to avast for analysis by right clicking on them and select Submit to virus lab... Unfortunately there is no means to send multiple samples to the labs together.

I'm not sure what it is that you are trying to achieve by sending them to the avast virus labs ?
With 33 detections I rather suspect it might be some sort of file infecter rather than 33 false positive detections that you want resolved. The virus labs can't clean files that you send them if they are infected if they couldn't be Repaired previously as part of the detection.

Can you give us some examples of the file name, malware name and the original location e.g. (C:\windows\system32\infected-file-name.xxx) ?
All of this information should be available to you in the chest, by right clicking on the file and select Properties.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 23.9.6082 (build 23.9.8494.792) UI 1.0.781/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

doktornotor

  • Guest
Re: quarantine folder on hard disk
« Reply #27 on: April 03, 2011, 04:41:23 PM »
Can you give us some examples of the file name, malware name and the original location e.g. (C:\windows\system32\infected-file-name.xxx) ?
All of this information should be available to you in the chest, by right clicking on the file and select Properties.

It does not work for him, unbootable system. He can just attach the index.xml file here (rename to index.txt so that it works) and we will see what got quarantined. Anywhere, no idea what is the purpose of this as well.

Hermite15

  • Guest
Re: quarantine folder on hard disk
« Reply #28 on: April 03, 2011, 04:59:01 PM »
@DavidR yeah I forgot that lol ... chest files are encrypted anyway (quarantine process) and won't be accessible from an external system. Thing is the guy can't boot the infected system anymore. Remains index.xml, well there's no reason for this one to be encrypted and that would give an idea of what happened.

coco3117

  • Guest
Re: quarantine folder on hard disk
« Reply #29 on: April 03, 2011, 05:42:55 PM »
i sea the files names in index.xml.
I think that i reinstall Win XP properly after formatting the disk.



Thank's very much everybody for your responses.