Author Topic: Need help with Avast scan  (Read 9046 times)

0 Members and 1 Guest are viewing this topic.

Offline Nikilet

  • Sr. Member
  • ****
  • Posts: 379
Need help with Avast scan
« on: November 21, 2011, 04:54:39 AM »
\This is regarding an older \Gateway laptop with XP on it. I got it going for my grandson to play games on & haven't had it on for a while. Turned it on and updated, did a scan tonight \and got a whole page full of stuff it says it can't scan. Malwarebytes scan turned out fine. Can someone tell me where to find this log so I can attach it for someone to take a look at?
Vista Home Premium SP2 - 32 Bit / 4GB RAM / IE9 / Firefox / Pale Moon / Google Chrome 26/ Avast Internet Security 8 / WinPatrol Plus / Malwarebytes Pro / SUPERAntispyware Pro / CCleaner / Zappit / Diskeeper 2009 / SpywareBlaster / LastPass / KeyScrambler Pro

Offline ady4um

  • Massive Poster
  • ****
  • Posts: 2667
Re: Need help with Avast scan
« Reply #1 on: November 21, 2011, 10:35:50 AM »
There are many different logs (in different locations), and I'm not 100% which one exactly you are looking for.

Maybe avast main GUI -> Scan Computer -> scan logs? (extend the width of the columns.)

Some test logs are in the application data -> avast (or alwil) -> avast(5) -> log -> then you have several logs.

Or maybe you want the reports, which is almost the same: application data -> avast (or alwil) -> avast(5) -> report -> then you have several reports.

The above path is of course not exact, but you should be able to find it in your system (the exact path depends on the OS language and the exact versions of Avast updated in your system).

In any case, when the result says that the file is "password protected" and that Avast can't scan it, it does NOT mean that you have some malware. It just mean that Avast doesn't know the password, so it can't scan the specific file deeper.

In any case, please report back.
ADD/REMOVE PROGS -> avast -> CHANGE/REMOVE -> REPAIR & REBOOT
Avast! 7 FAQ | FAQ & KB | Docs | Removal Utils | Configure Mail Shield | report FP | License Registration | UNSECURED?

Offline Nikilet

  • Sr. Member
  • ****
  • Posts: 379
Re: Need help with Avast scan
« Reply #2 on: November 21, 2011, 07:51:00 PM »
First, I want the location of the log of this scan which will show someone who knows more than me what was found. I want someone to look at my scan log.

"In any case, when the result says that the file is "password protected" and that Avast can't scan it, it does NOT mean that you have some malware. It just mean that Avast doesn't know the password, so it can't scan the specific file deeper."

I understand your statement above, but there is something wrong. When I last had this machine on regularly everything was fine. I turned if off on October 29 and it has been off since then. I turned it on last night, updated Avast Internet Security and Malwarebytes and did scans and, as I explained, I've got a whole page full of stuff on the Avast scan. Why? Nothing had changed so what has happened? Why didn't these "password protected" items show up in any of my daily scans with Avast previously? Again, the machine has been turned off and there have been no changes made to anything.

Also, what does a person do with all of these items? I really need someone to look at the log of this scan.

Vista Home Premium SP2 - 32 Bit / 4GB RAM / IE9 / Firefox / Pale Moon / Google Chrome 26/ Avast Internet Security 8 / WinPatrol Plus / Malwarebytes Pro / SUPERAntispyware Pro / CCleaner / Zappit / Diskeeper 2009 / SpywareBlaster / LastPass / KeyScrambler Pro

Offline ady4um

  • Massive Poster
  • ****
  • Posts: 2667
Re: Need help with Avast scan
« Reply #3 on: November 21, 2011, 08:01:08 PM »
You are basically repeating your first post. I told you where in the main GUI of Avast the logs can be seen.

The other 2 locations are for reports and logs. Each file is related to a certain type of scan.

If you can provide which specific scan you ran, then maybe we can tell you which file to open so to view the results. Then knowing the correct file, you could attach it here in your next post so someone here can review it and give some answer.

So, if you could provide more specific information, we can try our best to help you answer your doubts.
ADD/REMOVE PROGS -> avast -> CHANGE/REMOVE -> REPAIR & REBOOT
Avast! 7 FAQ | FAQ & KB | Docs | Removal Utils | Configure Mail Shield | report FP | License Registration | UNSECURED?

Offline Asyn

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 72857
    • >>>  Avast Forum - Deutschsprachiger Bereich  <<<
Re: Need help with Avast scan
« Reply #4 on: November 21, 2011, 08:04:00 PM »
Also, what does a person do with all of these items? I really need someone to look at the log of this scan.

Please post a screenshot.
Win 8.1 [x64] - Avast PremSec 21.10.6772.IBC [UI.679] - EEK - Firefox ESR 91.3 [NS/uBO/PB] - TB 91.3.2
Avast-Tools: Secure Browser 96.0 - Cleanup 21.3 - SecureLine 5.14 - Driver Updater 21.3 - CCleaner 5.87
Avast Wissenswertes (Downloads, Anleitungen & Infos): https://forum.avast.com/index.php?topic=60523.0

Offline Nikilet

  • Sr. Member
  • ****
  • Posts: 379
Re: Need help with Avast scan
« Reply #5 on: November 21, 2011, 10:41:36 PM »
To Asyn: I finally found within A|vast where you can request a report of your scan. I am attaching that and hope it works. It took me 6 or 7 screenshots to get everything that came through. If this doesn't work I can attach those.
Vista Home Premium SP2 - 32 Bit / 4GB RAM / IE9 / Firefox / Pale Moon / Google Chrome 26/ Avast Internet Security 8 / WinPatrol Plus / Malwarebytes Pro / SUPERAntispyware Pro / CCleaner / Zappit / Diskeeper 2009 / SpywareBlaster / LastPass / KeyScrambler Pro

Offline Asyn

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 72857
    • >>>  Avast Forum - Deutschsprachiger Bereich  <<<
Re: Need help with Avast scan
« Reply #6 on: November 21, 2011, 10:47:15 PM »
To Asyn: I finally found within A|vast where you can request a report of your scan. I am attaching that and hope it works.

Yes, it worked. :)
These files are all related to password protected Adobe files. So nothing to worry about.
Win 8.1 [x64] - Avast PremSec 21.10.6772.IBC [UI.679] - EEK - Firefox ESR 91.3 [NS/uBO/PB] - TB 91.3.2
Avast-Tools: Secure Browser 96.0 - Cleanup 21.3 - SecureLine 5.14 - Driver Updater 21.3 - CCleaner 5.87
Avast Wissenswertes (Downloads, Anleitungen & Infos): https://forum.avast.com/index.php?topic=60523.0

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 85959
  • No support PMs thanks
Re: Need help with Avast scan
« Reply #7 on: November 21, 2011, 10:55:17 PM »
Looks like you have done something with Adobe, updated it etc. and that has created the system restore (SR) point (now renamed by SR to A0007239.exe) ?

Something within the A0007239.exe are a number of password protected files in the adobe\_js and images folder, this isn't unusual as some applications as it appears to be protecting that folder and other files within the A0007239.exe file itself, perhaps to prevent the content being infected/changed, etc. This is to me very understandable given the target that Adobe reader, etc. is to malware.

Essentially you have nothing to be concerned with.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 21.9.2494 (build 21.9.6698.703) UI 1.0.672/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Offline ady4um

  • Massive Poster
  • ****
  • Posts: 2667
Re: Need help with Avast scan
« Reply #8 on: November 21, 2011, 11:43:43 PM »
To Asyn...

@Nikilet,

So, essentially it is exactly what I already told you. And you respond as if you "happen to find" those reports, while I told you where to look for them. If something was not clear, you should had said so.

In addition, you previously said "nothing changed" for this to happen. Well, "something" happened. As mentioned, those were files for an update. There is a reason for me to have asked you to post the report.

I'm glad all is clear, and this is not the end of the world for anyone, but I would say your attitude was "not nice".
ADD/REMOVE PROGS -> avast -> CHANGE/REMOVE -> REPAIR & REBOOT
Avast! 7 FAQ | FAQ & KB | Docs | Removal Utils | Configure Mail Shield | report FP | License Registration | UNSECURED?

Offline Nikilet

  • Sr. Member
  • ****
  • Posts: 379
Re: Need help with Avast scan
« Reply #9 on: November 22, 2011, 12:20:59 AM »
No, it is not essentially exactly what you told me. Go back and read your answer to me and try to put yourself in the shoes of a novice computer person. You jumped all over the place and confused me and when I tried to write back and nail you down to something then you told me I was repeating myself. I thought the same as you, that your attitude was not very nice. For instance, you did not tell me that to get a log file of the scan I had to go into the scan settings and check the box to request one. And to the best of my knowledge, nothing had changed. I did update Adobe Shockwave today, but this first scan came through Yesterday.
Vista Home Premium SP2 - 32 Bit / 4GB RAM / IE9 / Firefox / Pale Moon / Google Chrome 26/ Avast Internet Security 8 / WinPatrol Plus / Malwarebytes Pro / SUPERAntispyware Pro / CCleaner / Zappit / Diskeeper 2009 / SpywareBlaster / LastPass / KeyScrambler Pro

Offline Nikilet

  • Sr. Member
  • ****
  • Posts: 379
Re: Need help with Avast scan
« Reply #10 on: November 22, 2011, 12:25:30 AM »
I know these items aren't infections, but I still don't understand why they did not show up in all the scans done previously, and now they do.

Not sure I understood DavidR's comments about a restore point, but there is nothing in my System Restore which would refer to this A0007239.exe

Is there any way to stop this big, long list from coming up every time I scan?
Vista Home Premium SP2 - 32 Bit / 4GB RAM / IE9 / Firefox / Pale Moon / Google Chrome 26/ Avast Internet Security 8 / WinPatrol Plus / Malwarebytes Pro / SUPERAntispyware Pro / CCleaner / Zappit / Diskeeper 2009 / SpywareBlaster / LastPass / KeyScrambler Pro

Offline ady4um

  • Massive Poster
  • ****
  • Posts: 2667
Re: Need help with Avast scan
« Reply #11 on: November 22, 2011, 12:32:10 AM »
We just see it differently. Let's move on.

What David said was based on your report. The specific path shown there just shows that there is some Restore Point. Yet, there is a possibility for a Restore Point to be still in the system, but not listed in the respective list (For example, CCleaner deletes the list, not the files).

Adobe has an "autoupdate" feature. It may have been activated "sometime", and in rare cases this could happen really "automatically" (with no notification to the user). I don't know if this is the case of your system. I'm just offering a possible case that fits your description and the report attached.
ADD/REMOVE PROGS -> avast -> CHANGE/REMOVE -> REPAIR & REBOOT
Avast! 7 FAQ | FAQ & KB | Docs | Removal Utils | Configure Mail Shield | report FP | License Registration | UNSECURED?

Offline Nikilet

  • Sr. Member
  • ****
  • Posts: 379
Re: Need help with Avast scan
« Reply #12 on: November 22, 2011, 12:38:57 AM »
So is there anything I can do to keep all this from coming through every time I do a scan?
Vista Home Premium SP2 - 32 Bit / 4GB RAM / IE9 / Firefox / Pale Moon / Google Chrome 26/ Avast Internet Security 8 / WinPatrol Plus / Malwarebytes Pro / SUPERAntispyware Pro / CCleaner / Zappit / Diskeeper 2009 / SpywareBlaster / LastPass / KeyScrambler Pro

Offline Asyn

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 72857
    • >>>  Avast Forum - Deutschsprachiger Bereich  <<<
Re: Need help with Avast scan
« Reply #13 on: November 22, 2011, 12:42:37 AM »
1. I know these items aren't infections, but I still don't understand why they did not show up in all the scans done previously, and now they do.

2. Is there any way to stop this big, long list from coming up every time I scan?

1. Because they weren't there before. ;)
2. Either you just ignore it, as it is no threat at all, or you have to clean your restore point.
Win 8.1 [x64] - Avast PremSec 21.10.6772.IBC [UI.679] - EEK - Firefox ESR 91.3 [NS/uBO/PB] - TB 91.3.2
Avast-Tools: Secure Browser 96.0 - Cleanup 21.3 - SecureLine 5.14 - Driver Updater 21.3 - CCleaner 5.87
Avast Wissenswertes (Downloads, Anleitungen & Infos): https://forum.avast.com/index.php?topic=60523.0

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 85959
  • No support PMs thanks
Re: Need help with Avast scan
« Reply #14 on: November 22, 2011, 12:43:48 AM »
So is there anything I can do to keep all this from coming through every time I do a scan?

If you can't find any reference to A0007239.exe then perhaps avast won't find it later.

However, I rather doubt System Restore refers to file names as such as such generally it is by RP number RP48 (in this case) or by date, etc.

There would be little point in referring to the A0007239.exe file name as that in itself is a name assigned by SR and not the original file name. Only the file type .exe is retained so you know the file type (which isn't a great deal of help); you/we are only getting an idea of what it was because of the information the avast log produced as to what is inside the A0007239.exe file.

So what can you do, A) keep ignoring, B) set an exclusion for that <path>RP48\A0007239.exe or C) manually delete restore point RP48.

The full path being C:\System Volume Information\_restore{EA9CB5E9-A5F1-4370-B918-FB61F50F4DE8}\RP48.

Generally I give this advice for detections in the system restore points, it could equally be applied (manual removal if you don't want to follow A or B above) in your case.
- Infected/suspect Restore Points:
There really is little benefit in chasing a detection in the system volume information folder. It is only there because it had previously been deleted or moved from the system folders and this is a back-up created by system restore.
- Worst case scenario it isn't infected and you delete it, you can't use that restore point in the future, not much of a loss and the older the restore point is the less of an issue it is.
 
- So if there is any suspicion about a restore point then it is best removed from the system volume information folder or it could bite you in the rear at some point in the future when you use system restore if it included that restore point.

####
Obviously I can't make that choice for you but I have laid out your options.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 21.9.2494 (build 21.9.6698.703) UI 1.0.672/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security