avast says it can’t delete or move to chest these files >:(:
c:/windows/installer/3db2c6.msi
c:/windows/installer/3db2cd.msi
how do i get rid of them?!?!
avast says it can’t delete or move to chest these files >:(:
c:/windows/installer/3db2c6.msi
c:/windows/installer/3db2cd.msi
how do i get rid of them?!?!
Download Puppy Linux 4.1.2 (be sure to get that version, NOT 4.2.1) at a friend’s house and burn the image to a blank CD. DON’T just burn the file to CD, you have to burn it as an IMAGE, or it won’t work properly. All CD burner software that I know of offers that functionality, and if you are in doubt, use Burnatonce (freeware) because that’s all it does.
Then find the hard drive partition from the icons at the bottom of the screen that contains the files, and just delete them! Linux doesn’t know that those files don’t want to be deleted!
True, Linux will kill the bastards.
But it would be interesting to know: have you run (either intentionally or by bad chance) those installers already on your machine?
If you did, your PC is already infected and needs deeper investigation.
:
[font=Segoe UI] Hi syc2506 and welcome to the forums,
I suggest sending those files to VirusTotal for further analysis. Please provide a link to the results. Thank you.
erm linux? my os is windows xp ??? i haven’t run the installers on my pc, just that avast detects them and can’t delete or send to chest. i have heard that deleting those files may ruin my laptop???
It shouldn’t ruin the laptop, a google search for those files names returns only this topic.
Why can’t it move to the chest or delete the files what errors are displayed ?
If it relates to size, you can increase the size of the Chest, File size you can send, Program Settings, Chest, see image.
If it relates to file in use, etc. unlikely as they wouldn’t/shouldn’t be running or some other permissions/protection, etc. then a boot-time scan could get round that:
Enable a boot time scan. Right click the avast icon, select Start avast! Antivirus, a memory scan will take place followed by the opening of the Simple User Interface, Menu, ‘Schedule boot-time scan…’ Or see http://www.digitalred.com/avast-boot-time.php. Don’t opt for deletion (you have no options left), always send to the chest and investigate.
the error says that the operation does not support the archive when i try to move it to the chest and the max size of chest is 256MB.
sooo really confused now ???
L’arc?
these are the results for 1 of the files
http://www.virustotal.com/analisis/9fa424489eeba2b4800436bad32ea4268d65f4bc2cef1e0515db85be02bcbae1-1257380401
Then the path you posted isn’t complete, as it appears what avast is detecting is a file within the .msi (MicroSoft Installation) file. avast can’t extract the file it detected from within the installation archive without possibly corrupting it. That is why you get the unsupported archive error.
Since it wasn’t size related (nothing like that in the error you stated) any change to the chest sizes would have no effect.
It appears you had a piece of Adware/PUP (Potentially Unwanted Program) called MarketScore Relevant Knowledge.
Remove it with MBAM or SuperAntiSpyware Free.
i downloaded MBAM and super anti spyware and they did not detect the VBS:agent-CM[trj] ???
Did you put it into the avast virus chest, if so then they wouldn’t be able to scan it ?
there not in the virus chest but they are hidden files and maybe thats why they can’t find them??
i still don’t know how to get rid of this trojan >:(
Hidden or not, avast can find them and depending on size (files over a certain size aren’t scanned by default in SAS) I would have thought that the other two would have been able to fine them.
Now the .msi file isn’t one that is running, its purpose is to install something and if it had installed something them I would have expected that to be found outside of the .msi file, wherever it was installed (which doesn’t seem to be the case). So it may be that they haven’t been run.
The Installer folder I don’t believe should be hidden and you have obviously been able to access it to upload one of those files to virustotal. If you hover the mouse over the file name there should be a tooltip pop-up to show details of the file (see image) avast may alert (so you could pause the standard shield temporarily). Is there any meaningful information that might help identify the author/program to which they relate ?
I certainly feel that they warrant further investigation by avast so I would like you to manually add them to the chest and upload them to avast for analysis.
Add the file to the User Files (File, Add) section of the avast chest (see image, you need to have first opened the chest) where it can do no harm and send it from there. A copy of the file/s will remain in the original location.
Send it/them from the User Files section of the chest (select the file, right click, email to Alwil Software).
A form should pop-up that needs some basic details, you are reporting it as a possible false positive and you could give a link to this topic.
It will be uploaded (not actually emailed) to avast when the next avast auto (or manual) update is done.
erm i added the files to the user files in the chest and i tried sending them to ALWIL software but i got no form popping up? So i assume they have been emailed?
And looking at the file information it seems to be from the cursors i downloaded with the author as :FileSubmit
No they haven’t been emailed (so something is blocking the form), the new process uploads directly, that is why the form is required to gather some information.
As strange as this might seem, try this:
You will be prompted by the avast! Self-defence module if this is OK answer Yes. Whilst this is primarily for Sunbelt or Kerio Personal Firewalls it may well work even if you don’t use either of these firewalls. You may need to reboot to have the changes in the avast4.ini file to come into effect.
If that doesn’t allow the menu to appear it might be quicker to do it the old fashioned way:
Send the sample to virus@avast.com zipped and password protected with the password in email body, a link to this topic might help and possible false positive in the subject.
In addition to what DavidR has said, it may just be the virus chest send limit…
I just tested this with a file I have in the chest that is over the size limit for sending via the chest. When you click email to ALWIL, nothing happens…
But if you up the size limit to accomodate the file, the window pops up.
So:
Right click the file in the chest → Properties → this will tell you of the size of the file.
Then right click the avast! tray icon → program settings -->chest -->Increase the value: ‘Maximum size of file to be sent’ to fit the file.
Then try sending the file again.
-Scott-
If the size limit is breached, then I would have thought that it wouldn’t have got into the chest in the first place as the setting is used for both, sending to the chest and sending to Alwil.
The settings for the chest are different, the limit is in MB, but the send limit is in KB, so there is a factor of 1000 involved. This could allow for a file to be added to the chest, but not sent.
I was just showing what I have noticed, which is with two files in the chest, that don’t show a submit window, when I increase the send limit to accomodate for them, the submit window appears.
The chest size limit is in MB but the maximum ‘file size’ is in KB and it is this setting that frequently stops a ‘file’ from being sent to the chest; rather than the chest size is to small as that would also breach the file size restriction which is much lower.
This isn’t something that I have noticed, so I don’t know what the circumstances are/were on your system.
If you pull the trick of submitting using the path to the file rather than being in the chest then the file size restriction would likely be the issue, but I haven’t tried that and don’t know if it has to be imported into the chest first for avast to encrypt and upload.