Virus Chest Question

[A Avast User]

Hi All,

I just downloaded and installed the latest version of Avast! Free on a computer belonging to a friend of mine last evening. (I'm in the Midwest, USA). This computer is running a dual boot configuration of Windows XP and Windows 7. The installation of Avast! Free resides within Windows 7. When I ran a scan Avast came up with some files that should have been left alone. I inadvertently Quarantined 3 of these files. (Please see attached screen shot of the Virus Chest.)

These files are system files belonging to the Windows XP operating system. (They specifically belong to its Task Manager.) Those three files still show up in the Virus Chest even though I right clicked on each to "Restore" them back to their original locations. I looked within the XP installation by going to C:\Windows\etc. ... to see if I could find those files after "Restoring" them. I could NOT find them. How do I get them back to where they belong and OUT of that virus chest???

Thank you so very much for any and all help you may be able to give me. @};---

P.S.: It may be a day or few before I can get back over to my friend's house to continue working on their computer so if I don't answer back right away please don't think much of it. I WILL be back, eventually, as soon as I can get back onto that computer. I am tracking this post.

[Lisandro]

When you restore a file, it is kept into the Chest. It's not a move, but a restore/copy.
You need to manually delete files after restoring.
Check, rescan, if the files are really clean.

Windows.old is a folder created when you upgrade/repair an existing installation of Windows.
Files there are just for backup. The folder/file could be hidden as well.

[DavidR]

You won't find them in C:\Windows\etc if you look at your image again they 'were' in the C:\Windows.old\ folder, this is a copy of your old windows installation. Presumably you did an OS upgrade rather than a clean install of your existing OS ?

Trying to actually Restore them is a bit of a pointless exercise as avast would normally alert when they are sent back to the original location, unless you had created exclusions for them. However, since you mention you inadvertently sent them to the chest, how was that, if they weren't detected as infected ?

When you Restore a file, a copy is retained in the chest, this is effectively a backup if the Restore failed then you would have no copy of the file. So if the file was back in the original c:\windows.old\etc... folder then you could safely delete the copy in the chest.

~~~~
Unless the ehexthost.exe file is confirmed as an FP you shouldn't be even contemplating restoring it: