Empire Virus Detected In AVAST!-By avira antivir bootup scan?

[system]

Hi there,

I did an all night scan of my pc last night in SAFE MODE-with malwarebytes,superantispyware,avast home edition version 4.8.126(resident guard active) and avira antivir(which i only use as an independent scanner - guard DISABLED not installed).

Antivir picked up D:\Program Files\Alwin Software\Avast4\Data Log\Unpack 180666451.tmp.mamp Contains recognition pattern of the Empire Virus.

Can you advise on why antivir detected a virus in avast?,what do you advise?,i quarantined the virus in antivir anyway but am concerned about what to do now?,appreciate your help on this!.

regards

southern man

ps Avast product stil excellent for me thanks all!

[Lisandro]

That is an avast temporary file. This is the price of using two antivirus (even one disabled). One picks the other one files. You can delete that file.

[system]

Thanks for the quick reply back appreciated!-i have done as you recommended and deleted it from quarantine in antivir-.
Just on an final note many people have a secondary antivirus scanner-with resident guard obviously disabled and not loaded, as a backup,do you think this is a bad idea?,i know that 2 antivirus packages on the same pc is not recommended but if the secondary av is used solely as an independent scanner and the guard is not loaded or resident shouldn’t that be ok why did antivir pick up avast tmp.mdmp?.

Thanks

regards

southern man

[system]

I use ESET Online Scanner (NOD32) for an on-demand scanner. ESET hasn’t picked any of avast!'s files. Nor has avast! complained about ESET Online Scanner (NOD32).

The only negative is having to use IE for ESET Online Scanner to work. Active X is required. :

[system]

@rdmaloyjr post:4

I use ESET Online Scanner (NOD32) for an on-demand scanner. ESET hasn’t picked any of avast!'s files. Nor has avast! complained about ESET Online Scanner (NOD32).

The only negative is having to use IE for ESET Online Scanner to work. Active X is required. :

Thanks for that useful tip!-just thought about it bit more and as i have now broadband(before slow dialup) i can of course use on-line scanners like you suggested or kapersky which i am trying out now!-do they remove the detections like trojan/virus first time i have used them?
I will now uninstall antivir as i do not need it!

thanks again

southern man

[system]

ESET’s Online Scanner will remove infections if you want it to, just check the square.

Kapersky’s online scanner won’t remove infections.

I prefer to run ESET without removing infections checked. If anything is found I’d check them with VirusTotal first before removing them.

This will require two scans one to find & the other to remove, but it’s the safe way.

[DavidR]

@Southern Man post:3

Just on an final note many people have a secondary antivirus scanner-with resident guard obviously disabled and not loaded, as a backup,do you think this is a bad idea?,i know that 2 antivirus packages on the same pc is not recommended but if the secondary av is used solely as an independent scanner and the guard is not loaded or resident shouldn't that be ok why did antivir pick up avast tmp.mdmp?.

The killer with applications that are designed to be resident is that they install low level virtual device drivers, that effectively hook file that are about to be executed/opened/modified, etc. (depending on settings) so they can be scanned first. Even when you disable an AV (to try and make it an on-demand scanner) these low level drivers are still active and it is this that can cause a conflict.

[system]

@rdmaloyjr post:6

ESET’s Online Scanner will remove infections if you want it to, just check the square.

Kapersky’s online scanner won’t remove infections.

I prefer to run ESET without removing infections checked. If anything is found I’d check them with VirusTotal first before removing them.

This will require two scans one to find & the other to remove, but it’s the safe way.

Thanks for that tip i will run ESET after kapersky is finished sometime in the next decade ha ha!

cheers again,have good weekend!

southern man

[system]

@DavidR post:7

@Southern Man post:3

Just on an final note many people have a secondary antivirus scanner-with resident guard obviously disabled and not loaded, as a backup,do you think this is a bad idea?,i know that 2 antivirus packages on the same pc is not recommended but if the secondary av is used solely as an independent scanner and the guard is not loaded or resident shouldn't that be ok why did antivir pick up avast tmp.mdmp?.

The killer with applications that are designed to be resident is that they install low level virtual device drivers, that effectively hook file that are about to be executed/opened/modified, etc. (depending on settings) so they can be scanned first. Even when you disable an AV (to try and make it an on-demand scanner) these low level drivers are still active and it is this that can cause a conflict.

Thats very interesting and educational for me-thankyou!- i have learned something i did not know!-so better to just have just 1 main AV program running with resident guard and maybe use an on-line virus checker like ESET or Kapersky or Trend micro as when required to do an independant scan?

regards

southern man

ps now living in spain,was in uk.

[davexnet]

I ran ESET, and either “delete infections” was defaulted ON, or I turned it on by mistake.
Anyway, it ended up deleting a zip file that had been quarantined by Spybot S&D.
No big deal in this case, but it does illustrate some of the considerations you have to
keep in mind.

[system]

@davexnet post:10

I ran ESET, and either “delete infections” was defaulted ON, or I turned it on by mistake.
Anyway, it ended up deleting a zip file that had been quarantined by Spybot S&D.
No big deal in this case, but it does illustrate some of the considerations you have to
keep in mind.

Yes you are dead right what you say-have to be really careful and thorough what you click and what you do not has caught me out before!!

southern man

[system]

That is why I said send the file to VirusTotal before deleting.

It can be dangerous (to the os) to delete a false positive.

[DavidR]

It seems strange to me that it was able to scan or delete from S&D quarantine, which means it either wasn’t properly in the S&D quarantine or S&D’s quarantine leaves something to be desired.

[system]

@DavidR post:7

The killer with applications that are designed to be resident is that they install low level virtual device drivers, that effectively hook file that are about to be executed/opened/modified, etc. (depending on settings) so they can be scanned first. Even when you disable an AV (to try and make it an on-demand scanner) these low level drivers are still active and it is this that can cause a conflict.

True. The interesting option for the power user is to disable the unneeded services via control panel, or change start properties to “manual”. Some applications accept/survive this, with remaining features still useful. A-squared free, for example, can live with this.

If this is true for Antivir (or Avast), I don’t know - yet.

Useful tools here are Sysinternals Process Explorer and Autoruns. Power users only!

[system]

@rdmaloyjr post:6

ESET’s Online Scanner will remove infections if you want it to, just check the square.

Kapersky’s online scanner won’t remove infections.

I prefer to run ESET without removing infections checked. If anything is found I’d check them with VirusTotal first before removing them.

This will require two scans one to find & the other to remove, but it’s the safe way.

Hi Back,

I have run Kapersky on line scan nothing detected,also e-set on line scan nothing detected,i have removed antivir altogether,defrag my pc,used crap cleaner and also disabled spybot resident as i think that was what was causing avast to flag up a message unable to check avast mail outgoing smpt check your firewall is not blocking it!.
What the cause of avast flagging up the warning message e-mail not being able to check was the fact that COMODO PRO FIREWALL was taking so long to initialise maybe 3-4+ minutes so by disabling s/bot resident that cured the problem,hope this helps someone.

regards

southern man