Cannot Scan Selected Files & Warning & Error Messages

Avast Free Antivirus / Premium Security
1

Hi,

I have been posting in other forums trying to resolve some issues but think it may be best to post here. Instead of re-writing, I will copy & paste some of my other forum posts here so if the following doesn’t read exactly right, this would be why. I look forward to your replies. Thanks!

This first post from bleepingcomputer.com is rather long so I will link to it:
http://www.bleepingcomputer.com/forums/topic269492.html

Also,

I have had no further postmortem debugger issues as indicated in the above link but I did receive another “unable to scan” message from Avast. Shortly before I scanned, I thought my FF browser was acting strange as when I was logging into a Google Apps account, the Google favicon wouldn’t load in the address bar & when I cleared my cache, Google was still pulling a user name that I had previously used, which is not normal considering the cache was cleared. The issue corrected & that’s when I scanned.

The full system scam came up clean, however, as it happened the other day as described in my other post on bleepingcomputer.com linked above, not everything could be scanned. This has never happened to me before with Avast. I also scan with MBAM & AdAware. I check all new website with MacAfee Site Advisor & run Spywareblaster so I would like to think that I am not infected but now I am not sure.

Here are some of the errors & warning reports that I pulled from the event viewer which did not necessarily occur during a scan:

Event Type: Error
Event Source: avast!
Event Category: Client
Event ID: 90
Date: 11/08/2009
Time: 1:46:22 PM
User: N/A
Computer:
Description:
AAVM - scanning error: x_AavmCheckFileDirectEx: avfilesScanReal of C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\m29i26zi.default\sessionstore-1.js failed, 0000A413.

Event Type: Warning
Event Source: avast!
Event Category: Client
Event ID: 90
Date: 11/08/2009
Time: 1:46:22 PM
User: N/A
Computer:
Description:
AAVM - scanning warning: x_AavmCheckFileDirectEx [UNI]: C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\m29i26zi.default\sessionstore-1.js (C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\m29i26zi.default\sessionstore-1.js) returning error, 0000A413.

Event Type: Warning
Event Source: avast!
Event Category: Client
Event ID: 90
Date: 11/07/2009
Time: 12:44:13 AM
User: N/A
Computer:
Description:
AAVM - scanning warning: x_AavmCheckFileDirectEx: http://help.twitter.com/javascripts/tiny_mce/plugins/visualchars/editor_plugin.js (C:\WINDOWS\TEMP_avast4_\unp221421909.tmp) returning error, 0000A413.

Event Type: Error
Event Source: avast!
Event Category: Client
Event ID: 90
Date: 11/07/2009
Time: 12:44:13 AM
User: N/A
Computer:
Description:
AAVM - scanning error: x_AavmCheckFileDirectEx: avfilesScanReal of http://help.twitter.com/javascripts/tiny_mce/plugins/visualchars/editor_plugin.js failed, 0000A413.

Event Type: Warning
Event Source: avast!
Event Category: Client
Event ID: 90
Date: 11/06/2009
Time: 2:21:19 AM
User: N/A
Computer:
Description:
AAVM - scanning warning: x_AavmCheckFileDirectEx: http://clients1.google.com/complete/search?hl=en&client=hp&q=Obc5Md6cP3QZj&cp=13 (C:\WINDOWS\TEMP_avast4_\unp212433553.tmp) returning error, 0000A413.

Event Type: Error
Event Source: avast!
Event Category: Client
Event ID: 90
Date: 11/05/2009
Time: 6:31:51 PM
User: N/A
Computer:
Description:
AAVM - scanning error: x_AavmCheckFileDirectEx: avfilesScanReal of http://api.facebook.com/restserver.php?v=1.0&method=fql.query&query=select%20url%2C%20share_count%20from%20link_stat%20where%20url%20in%20('http%3A%2F%2Fwww.huffingtonpost.com%2F2009%2F02%2F19%2Fbailed-out-chase-ceo-dimo_n_168121.html')&format=json&cal failed, 0000A413.

Event Type: Warning
Event Source: avast!
Event Category: Client
Event ID: 90
Date: 10/12/2009
Time: 10:29:15 AM
User: N/A
Computer:
Description:
Sign of “JS:Pdfka-JR [Expl]” has been found in “http://modloaded.com/flash/pdf.php” file.

There are some more of the same or similar, as well. Most of these errors/warning have occurred over the past 5 days, the same time that my printer spooler error occurred causing me to re-install the drivers. This is explained in the link to bleeping above. Prior to the past 5 days, there are only occasional warning messages, 2 of which I listed above but for the most part, there are only information messages in the logs, going back months.

Going way back, there were the following messages, which I believe I thoroughly addressed at the time & learned that there may at one time been have been an infection on the machine which had been cleared up & that Avast was just picking up traces of it or that they were false positives…I do not recall exactly.

Event Type: Warning
Event Source: avast!
Event Category: Client
Event ID: 90
Date: 04/29/2009
Time: 10:30:06 PM
User: N/A
Computer:
Description:
Sign of “Win32:Trojan-gen {Other}” has been found in “C:\System Volume Information_restore{94EBE69A-E7F9-4D99-94FD-297EEDF5C601}\RP39\A0002495.exe” file.

Event Type: Warning
Event Source: avast!
Event Category: Client
Event ID: 90
Date: 04/29/2009
Time: 10:15:36 PM
User: N/A
Computer:
Description:
Sign of “Win32:Trojan-gen {Other}” has been found in “C:\Program Files\Hewlett-Packard\OrderReminder\uninstall\hpuninstaller.exe” file.

Event Type: Warning
Event Source: avast!
Event Category: Client
Event ID: 90
Date: 04/29/2009
Time: 9:27:36 PM
User: N/A
Computer:
Description:
Sign of “Win32:Trojan-gen {Other}” has been found in “C:\Documents and Settings\Owner\Local Settings\Temp\hpuninstaller.exe” file.

I also recall updating FF Firebug recently so I followed the warning path above & found a bunch of Firebug files. I proceeded to delete Firebug, rescanned & this time, all files were scanned. Understand, that Avast has not considered any of these errors & warnings as infections.

Any ideas?

2

The scanning errors aren’t really problems. Files in use, temporary files. Don’t worry.
The infected files, well, you could clean the restore points (deleting all restore points and creating a new clean one) or, generally, send files to Chest will clean the system.

3

THANKS FOR THE REPLY!

As far as the old errors pertaining to restore points…yes, I deleted such restores a long time ago. Just thought I would mention them. You said…

The scanning errors aren't really problems. Files in use, temporary files. Don't worry.

Can you explain why I had a few days of so many errors & warnings & the “unable to scan selected files” results? I never received that message before.

Also, in case you didn’t see them in the link to bleepingcomputer.com, here are a couple of messages from Avast that popped up after scans…see attached files.

Thanks!

4

By examining 1) the reason given by avast! for not being able to scan the files, 2) the location of the files, you can get an idea of what program they relate to. You may need to expand the column headings to see all the text.
Files that can’t be scanned are just that, not an indication they are suspicious/infected, just unable to be scanned.
Files could be temporary, files could be in use.

5

Did you see the attached files? I hear you & did investigate to the best of my ability but I am still a bit confused. I have been using Avast since earlier this year & NEVER had files that could not be scanned until recently. And the ironic part about this is that around the same time, I began having printer spooler problems, forcing me to reinstall the printer, Firefox issues, where it wouldn’t clear my cache & the Avast warnings & errors, of course. I updated Firebug for Firefox around the same time as well, and after I deleted that plugin & all its files, I have not had many, if any, errors & warnings or “unable to scan selected files” from Avast, even though these plugin files were not the files that could not be scanned. Maybe just a coincidence.

I don’t know why all of a sudden, Avast would have so many errors, warnings & “unable to scan” issues. I am confused…

6

Maybe you can submit the file that generates the internal program error.
Send it to virus (at) avast (dot) com and explains what happened. Maybe a link to this thread.

7

OK…But what exactly do you mean by

the internal program error
?

Are you saying that you see a problem?

Thanks!

8

Maybe.
In this screenshot “screenshot-YahooError.JPG” there is the error. Send that file for analysis.

9

Thanks! I did initially research that Yahoo error & the “vitalities.xml” file did seem to be a normal Yahoo file pertaining to the messenger widget. I deleted Yahoo Messenger & re-installed & the issue has not reappeared but I will also send that file specifically to Avast. However, as you’ve seen, within the next day or so two other files showed up in an Avast scan that could not be scanned which had nothing to do with Yahoo. Hmmm…

10

What Tech meant was… please send the file whose filename you see in that screenshot for analysis… not the screenshot image file itself, that’s not very useful.
Thanks.

11

igor,

Thank you…although I feel a bit dumb. So that I can feel dumber :wink: I just want to confirm that I have sent the file to Avast as instructed. The only way I know how to send or access that Yahoo file in question is to send it to Alwil via the send feature in the Avast chest. So, that’s what I did but it indicates there that I will not receive a response which doesn’t help me to know if I have been infected.

??
Thanks

12

Well, I received (or rather, was forwarded by somebody who received) a message (sent at 8:19PM) with the “screenshot-YahooError.jpg” attachment.
What I’d like to see is the mentioned file, i.e.
C:\Program Files\Yahoo!\Messenger\cache\0bc5Md6cP3QZjPTDR1mBjQ–.vitalities.xml

  • if it still exists (it’s a cache, so it may have disappeared in between). Also, I’m not sure I retyped the path correctly :slight_smile:

Maybe you sent another message in between, or maybe the attachment was removed somewhere on the way, but that …vitalities.xml file was not in the message I got.

13

igor,

I sent the file from the via the Avast chest about 15 minutes ago. The only place that the file seems to exist on my computer is in the chest. I know of no other way to send it other than the via the “email to Alwil software” method via the chest. Is there something else I should be doing?

14

You can extract it from Chest to a folder in your computer (e.g., your Desktop).
Attach the file to an email to virus@avast.com
Please mention in the email body a link to this thread.

15

Done!

btw- when I moved said file in question to the chest, I was prompted with a message saying that the file was “ok”

The other two files, of which there are screenshots attached above in this thread, were not permitted to move to the chest & I believe they are now gone as I uninstalled & reinstalled the Firefox plugin called Firebug & then the entire Firefox program.

16

Any news?

17

Hi Tech & igor,

Any word on that file I sent you?

Thanks!

18

Bub12, I’m an user like you… the file was sent to “them” (not to me).

19

Didn’t realize that Tech.

igor…you still there? Any word on that file I sent you?

20

Hi Bub12

Other than these few issues, is your computer running smoothly?

I think you are placing too much significance on these files that don’t seem to affecting your system performance. True, you should to send the files to avast just in case. When you have done this, then I am certain you will be notified if they are likely to harm your system.