Author Topic: Cannot scan password protected file  (Read 8152 times)

0 Members and 1 Guest are viewing this topic.

Xircal

  • Guest
Cannot scan password protected file
« on: November 10, 2011, 10:54:23 AM »
When performing a full system scan, results show that one particular file couldn't be scanned because it's password protected. The file in question is "install_flashplayer11x32_mssd_aih.exe" which is the standard Flash update file which you get when you choose to download Flash from http://get.adobe.com/flashplayer/?promoid=BUIGP

To my way of thinking, this raises security issues since it implies that Avast cannot handle what might be an infected file simply because it's password protected.

Moreover, in the scan results -see image- none of the elements can be selected which means that the "Apply" button remains greyed out. That's probably because they all pertain to the same file. In that respect, what's needed is something like a "Select All" button I think.

Having said all that, I'm of the opinion that this is a bug rather than a security issue because scanning the file using the context menu functions normally. Similarly, using the scan option to scan an individual folder also appears to work properly.

ady4um

  • Guest
Re: Cannot scan password protected file
« Reply #1 on: November 10, 2011, 11:01:46 AM »
The reason for not being possible to take action is that those "files" are not "really" there. They are "inside" the archive, or they are memory objects (not real files).

About password protected files, there is no way for Avast to scan them. How would Avast be able to open them? By guessing the password?

Offline Pondus

  • Probably Bot
  • ****
  • Posts: 37507
  • Not a avast user
Re: Cannot scan password protected file
« Reply #2 on: November 10, 2011, 11:04:37 AM »
Quote
To my way of thinking, this raises security issues since it implies that Avast cannot handle what might be an infected file simply because it's password protected.
If AV programs could scan password protected files then the hole idea with password protecting would be useless

avast does not know the password and there are no AV programs that have any means to use passwords...


files that can not be scanned are just that, it does not mean they are infected...
you will often see this if you have other security programs installed as they protect there own files
« Last Edit: November 10, 2011, 11:07:28 AM by Pondus »

AdrianH

  • Guest
Re: Cannot scan password protected file
« Reply #3 on: November 10, 2011, 11:22:27 AM »
You might like to read through the "Help Center" which is available in the GUI.

Quote
Processing the scan results

If a virus or other malware is detected, you will see the "Virus Found" message in the bottom half of the scan window. Here you can find other summary information about the scan such as number of files tested, number of infected files etc. Click on "Show Results" to see information about the virus and where it was detected.

On the "Scan Results" screen, you can also specify what further action to take, if none was taken automatically based on the scan settings - see the detailed scan settings section.

Click on the "v" icon in the column "Action to take" to reveal the list of options - Repair, Move to Chest, Delete, Do Nothing. The recommended action is "Move to Chest".

To apply the same action to all files, select the required action from the list at the bottom of the screen. You can change the action for any specific file by selecting the required action from the list in that particular row.

Once you have specified what action to take for each file, click "Apply" to carry out the selected actions.

The action taken will then be shown in the "result" column.

If you do not want to do anything at this stage, just select "Do nothing" and close the screen. You can return to this screen later by clicking on "Scan Logs", then selecting the particular scan by clicking on it once, and then clicking on "View results".

Special cases:

Sometimes the "Results" column shows you that a file could not be scanned e.g. a password-protected file, or a corrupted archive file, or it may show that something suspicious was detected in a memory file. This does not necessarily mean the file is infected.

Archive file is password protected - Some programs use password-protected archives to store their data (the password is hardcoded in the program) so such files may be reported even if you did not set the password yourself. avast! tells you that it wasn't able to extract the content of the archive, however the "wrapper" file was scanned.

Archive file is corrupted - A file may be corrupted, for example if the internet connection was terminated during a download, or it may be a special type of archive that avast! cannot open. Again, this means that the content could not be scanned but the "wrapper" file itself was scanned.

Memory detections - If the scan results show a detection in "Process X, memory block Y, Block size Z" it means that a virus signature was not found in a file on disk, but rather in the memory. This may suggest that there is something suspicious in the system memory so it is recommended to run a boot-time scan to check the system before the virus can activate. However, such memory detections can also be caused by running other security programs. avast! may have simply detected the virus signatures used by the other program. In that case, nothing would be detected on disk or during the boot-time scan. The reported "Process ID" should be followed by the name of the process file, which should help identify the specific application.