Author Topic: Infected file in archive:1  (Read 5370 times)

0 Members and 1 Guest are viewing this topic.

parkertd

  • Guest
Infected file in archive:1
« on: February 21, 2012, 12:11:52 AM »
I'm a mid-level user, and needs some help before I do something I regret (thanks in advance).  I just ran a scan (58 hours) and got 60 virus "hits" (all the same).  My status report show the pattern noted below (screenshots show at the bottom of this note):

Item a) The path of the infected file (always a font.exe)

Item b) A file folder, the path to the infected file (same path as Item a, above), and a status note stating the "Infected files in the archive:1

Item c) Opening the file folder I see the path to the infected file (same path as Item a, above)

My questions:
1) As a Mac user, I assume I can safely delete any ".exe" file, correct?
2) What does the status note "Infected files in archive" mean (I've looked for a while to try to figure this out)
   a) Does it mean that the noted file is a virus, and I need to delete it, or
   b) Does it mean that the file has been safely placed in an archive file, and I don't need to do anything, or
   c) Something else?
3) To be safe, do I need to go in a delete every item (it appears to always be the same virus)

Here is a sample of my status report:

Item a
/Volumes/WD HD 1TB/Backups.backupdb/Todd Parker’s iMac (803)/2009-10-07-221041/Macintosh HD/Users/Toddhome/Documents/Home Documents/Archives/Angie : John/12:03 Backup/untitled folder/font Folder/font.exe – Infection details: Win32:Klez-H [Wrm]

Item b - This is a file folder, with Item c in it:
/Volumes/WD HD 1TB/Backups.backupdb/Todd Parker’s iMac (803)/2009-10-07-221041/Macintosh HD/Users/Toddhome/Documents/Home Documents/Archives/Angie : John/12:03 Backup/untitled folder/font.zip – Infection details: Infected files in archive:1

Item c
/Volumes/WD HD 1TB/Backups.backupdb/Todd Parker’s iMac (803)/2009-10-07-221041/Macintosh HD/Users/Toddhome/Documents/Home Documents/Archives/Angie : John/12:03 Backup/untitled folder/font.zip/font.exe - Infection details: Win32:Klez-H [Wrm]

Many thanks

itsjustme2

  • Guest
Re: Infected file in archive:1
« Reply #1 on: February 21, 2012, 01:07:22 AM »
Nothing to worry about, its win32 so they don't have any effect on ur Mac.
Nevertheless, it's recommended to delete them, from the logs I've seen it may be possible that these file ain't false positive.

If they mean nothing to you, just remove them!

Offline .: Mac :.

  • Avast Überevangelist
  • Ultra Poster
  • *****
  • Posts: 5093
Re: Infected file in archive:1
« Reply #2 on: February 25, 2012, 05:18:37 AM »
These look to be part of a time machine backup? In which case you shouldn't delete the individual file from the backup as this may cause it to make that backup point unusable. Instead find where the file is on the computer you are backing up (Todd Parkers iMac) and remove it from there, then delete any infected time machine backups (or just leave them as they will be deleted to make more disk space when needed)
"People who are really serious about software should make their own hardware." - Alan Kay

parkertd

  • Guest
Re: Infected file in archive:1
« Reply #3 on: February 26, 2012, 05:03:40 PM »
Thanks for all your help.

These are indeed Time Machine backups, and I've deleted the infected file from my main drive.  I sense the safest thing to do now is to let time take its course, and the let the TM files self-delete.

I do use VM Fusion with XP.  Is leaving the virus on the TM backup making the XP side of my system vulnerable (or are they totally separated)?

If I were to delete them, I assume I'd want to do it through the Avast report screen (vs going to each file on the TM backup disk, correct?).

Thanks again

Offline .: Mac :.

  • Avast Überevangelist
  • Ultra Poster
  • *****
  • Posts: 5093
Re: Infected file in archive:1
« Reply #4 on: February 27, 2012, 09:09:45 AM »
Thanks for all your help.

These are indeed Time Machine backups, and I've deleted the infected file from my main drive.  I sense the safest thing to do now is to let time take its course, and the let the TM files self-delete.

I do use VM Fusion with XP.  Is leaving the virus on the TM backup making the XP side of my system vulnerable (or are they totally separated)?

If I were to delete them, I assume I'd want to do it through the Avast report screen (vs going to each file on the TM backup disk, correct?).

Thanks again

Time Machine backups will delete themselves as space is needed, depending on the size of your drives this should happen in about 30 days, or you can Force time machine to make a new backup set if it needs to happen immediately. If you do want do elite these files, let Avast do it on its scan report screen.

Having that file in a time machine backup would not effect the Windows VM. Unless you have installed a 3rd party Drive (such as Mac Drive) the Windows XP OS can not read the Mac HFS+ filesystem.
"People who are really serious about software should make their own hardware." - Alan Kay