Avast not dealing with Viruses

[system]

Hey all.

So after doing a full scan, I find some viruses. Woo.

Simply select “Move to Chest” from the dropdown list.

Click “Apply”.

Nothing. It won’t do anything. It’s like the button’s frozen.

https://dl.dropbox.com/u/17094269/avastcantremovevirus.png

I’ve tried having a look around but with all the variations on “Avast won’t work”, I decided a new thread is better.

So. Any ideas?

[DavidR]

It shouldn’t do anything as essentially there is nothing wrong with those files, other than they can’t be scanned.

Files that can’t be scanned are just that, not an indication they are suspicious/infected, just unable to be scanned.

Many programs (usually security based ones) password protect their files for legitimate reasons, there are others (and avast doesn’t know the password or have any way of using it even if it did know it).

When you run scans with the above programs and you delete harmful entries that they detect, a copy is kept (in quarantine/restore/backup) in case you need to reverse what you did. These are usually password protected, you should do some housekeeping and delete old backup/recovery/quarantine entries (older than two weeks or so), this will reduce the numbers of files that can’t be scanned.

By examining 1) the reason given by avast! for not being able to scan the files, 2) the location of the files, you can get an idea of what program they relate to. You may need to expand the column headings to see all the text.

- Decompression Bomb, a file that is highly compressed, which could be very large when decompressed. This used to be a tactic long ago to swamp the system.

[b]The name really is the most dangerous thing about this and I wish they would change it or simply not report it, a real PITA[/b].

These highly compressed files are generally 'archive' files which are inert, don't present an immediate risk until they are unpacked. If you happen to select 'All packers' in your on-demand scans then you are more likely to come across this type of thing. Personally it is a waste of time scanning 'all packers' and that is why it isn't enabled by default.


####
Do you still have A V G installed as its quarantine information is still there ?

[Lisandro]

If it helps…

Clean, Quarantine, or Delete?
http://antivirus.about.com/b/2007/03/11/clean-quarantine-or-delete.htm

[system]

@DavidR post:2

It shouldn’t do anything as essentially there is nothing wrong with those files, other than they can’t be scanned.

Files that can’t be scanned are just that, not an indication they are suspicious/infected, just unable to be scanned.

Many programs (usually security based ones) password protect their files for legitimate reasons, there are others (and avast doesn’t know the password or have any way of using it even if it did know it).

When you run scans with the above programs and you delete harmful entries that they detect, a copy is kept (in quarantine/restore/backup) in case you need to reverse what you did. These are usually password protected, you should do some housekeeping and delete old backup/recovery/quarantine entries (older than two weeks or so), this will reduce the numbers of files that can’t be scanned.

By examining 1) the reason given by avast! for not being able to scan the files, 2) the location of the files, you can get an idea of what program they relate to. You may need to expand the column headings to see all the text.

- Decompression Bomb, a file that is highly compressed, which could be very large when decompressed. This used to be a tactic long ago to swamp the system.

[b]The name really is the most dangerous thing about this and I wish they would change it or simply not report it, a real PITA[/b].

These highly compressed files are generally 'archive' files which are inert, don't present an immediate risk until they are unpacked. If you happen to select 'All packers' in your on-demand scans then you are more likely to come across this type of thing. Personally it is a waste of time scanning 'all packers' and that is why it isn't enabled by default.

Fair enough. Still fairly scary though that it spams you with “VIRUS DETECTED. WHAT DO” in the table.

Also, what about the one at the top of the table? Unless you’ve already mentioned it and I just haven’t picked up on it, but it doesn’t seem to relate to anything you’ve said.

@DavidR post:2

Do you still have A V G installed as its quarantine information is still there ?

It’s been uninstalled.

@Tech post:3

If it helps…

Clean, Quarantine, or Delete?
http://antivirus.about.com/b/2007/03/11/clean-quarantine-or-delete.htm

Thanks for the bit of info, not sure if I’m supposed to do anything with it?

[Pondus]

Thanks for the bit of info, not sure if I'm supposed to do anything with it?

read it to understand how it works ;)

Also, what about the one at the top of the table

memory block.....i guess you did a custom scan and selected "scan memory" this will give some veird scan results..... questions about this is posted a million times in here

file info. RapportMgmtService.exe. http://www.file.net/process/rapportmgmtservice.exe.html

The process known as RapportMgmtService belongs to software Rapport by Trusteer (www.trusteer.com).

[DavidR]

You may want to use the A V G removal tool to ensure all remnants are removed:
See, http://singularlabs.com/uninstallers/security-software/, this has a collection of manufactures removal tools, so that should remove any remnants, registry, etc.

The reason the Apply button is greyed out in reference to the detection in memory is because it is in memory and not a physical file but a memory block it can’t be moved.

As has been said scanning memory in a custom scan brings with it unusual results.