Need help with this log file

Viruses and worms
1

Could someone please take a look at this logfile? Iam not sure if these warnings are malicous or not.
Thanks in advance!

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>CountOfInfectedObjects</key>
	<integer>0</integer>
	<key>CountOfScannedFiles</key>
	<integer>379791</integer>
	<key>CountOfScannedObjects</key>
	<integer>506478</integer>
	<key>CountOfWarnings</key>
	<integer>19</integer>
	<key>Excludes</key>
	<array/>
	<key>ExportedDetail</key>
	<string>Infections and warnings</string>
	<key>Finished</key>
	<date>2014-03-12T21:55:38Z</date>
	<key>InternalStatus</key>
	<integer>0</integer>
	<key>LoggedScanObjects</key>
<array>
<dict>
<key>Depth</key>
<integer>1</integer>
<key>Info</key>
<string>Error 42120 ARJ archive is corrupted</string>
<key>Path</key>
<string>/Applications/Microsoft Office 2011/Office/Media/Vorlagen/Drucklayoutansicht/Abgestimmte Formulare/Berichte/_Aussicht Geschäftsbericht.dotx.2|></string>
<key>Result</key>
<string>Warning</string>
</dict>
<dict>
<key>Path</key>
<string>/Applications/Microsoft Office 2011/Office/Media/Vorlagen/Drucklayoutansicht/Abgestimmte Formulare/Berichte/_Aussicht Geschäftsbericht.dotx.2</string>
<key>Result</key>
<string>Clean</string>
</dict>
<dict>
<key>Depth</key>
<integer>3</integer>
<key>Info</key>
<string>Error 42137 CPIO archive is corrupted</string>
<key>Path</key>
<string>/private/var/folders/zz/zyxvpxvq6csfxvn_n00000s0000068/C/com.apple.SoftwareUpdate/content/downloads/20/17/041-8574/i73yn7y235guc8h5zcgps01laipyz206ik/JavaForOSX.pkg/content/downloads/20/17/041-8574/i73yn7y235guc8h5zcgps01laipyz206ik/JavaForOSX.pkg|>Payload|>{gzip}|>./System/Library/Java/JavaVirtualMachines/1.6.0.jdk/Contents/Classes/classes.jar</string>
<key>Result</key>
<string>Warning</string>
</dict>
<dict>
<key>Depth</key>
<integer>1</integer>
<key>Info</key>
<string>Error 42148 Unknown error: 42148</string>
<key>Path</key>
<string>/private/var/folders/zz/zyxvpxvq6csfxvn_n00000s0000068/C/com.apple.SoftwareUpdate/content/downloads/20/17/041-8574/i73yn7y235guc8h5zcgps01laipyz206ik/JavaForOSX.pkg/content/downloads/20/17/041-8574/i73yn7y235guc8h5zcgps01laipyz206ik/JavaForOSX.pkg|>Payload</string>
<key>Result</key>
<string>Warning</string>
</dict>
<dict>
<key>Path</key>
<string>/private/var/folders/zz/zyxvpxvq6csfxvn_n00000s0000068/C/com.apple.SoftwareUpdate/content/downloads/20/17/041-8574/i73yn7y235guc8h5zcgps01laipyz206ik/JavaForOSX.pkg/content/downloads/20/17/041-8574/i73yn7y235guc8h5zcgps01laipyz206ik/JavaForOSX.pkg</string>
<key>Result</key>
<string>Clean</string>
</dict>
<dict>
<key>Depth</key>
<integer>1</integer>
<key>Info</key>
<string>Error 42148 Unknown error: 42148</string>
<key>Path</key>
<string>/private/var/folders/zz/zyxvpxvq6csfxvn_n00000s0000068/C/com.apple.SoftwareUpdate/content/downloads/50/49/zzzz041-6245/uif0ktml8jgzve8yfgg7sra78c1hx8mlmx/iTunesLibrary.pkg/content/downloads/50/49/zzzz041-6245/uif0ktml8jgzve8yfgg7sra78c1hx8mlmx/iTunesLibrary.pkg|>Scripts</string>
<key>Result</key>
<string>Warning</string>
</dict>
<dict>
<key>Depth</key>
<integer>3</integer>
<key>Info</key>
<string>Error 42137 CPIO archive is corrupted</string>
<key>Path</key>
<string>/private/var/folders/zz/zyxvpxvq6csfxvn_n00000s0000068/C/com.apple.SoftwareUpdate/content/downloads/50/49/zzzz041-6245/uif0ktml8jgzve8yfgg7sra78c1hx8mlmx/iTunesLibrary.pkg/content/downloads/50/49/zzzz041-6245/uif0ktml8jgzve8yfgg7sra78c1hx8mlmx/iTunesLibrary.pkg|>Payload|>{gzip}|>./Library/Frameworks/iTunesLibrary.framework/Versions/A/iTunesLibrary</string>
<key>Result</key>
<string>Warning</string>
</dict>
<dict>
<key>Depth</key>
<integer>1</integer>
<key>Info</key>
<string>Error 42148 Unknown error: 42148</string>
<key>Path</key>
<string>/private/var/folders/zz/zyxvpxvq6csfxvn_n00000s0000068/C/com.apple.SoftwareUpdate/content/downloads/50/49/zzzz041-6245/uif0ktml8jgzve8yfgg7sra78c1hx8mlmx/iTunesLibrary.pkg/content/downloads/50/49/zzzz041-6245/uif0ktml8jgzve8yfgg7sra78c1hx8mlmx/iTunesLibrary.pkg|>Payload</string>
<key>Result</key>
<string>Warning</string>
</dict>
<dict>
<key>Path</key>
<string>/private/var/folders/zz/zyxvpxvq6csfxvn_n00000s0000068/C/com.apple.SoftwareUpdate/content/downloads/50/49/zzzz041-6245/uif0ktml8jgzve8yfgg7sra78c1hx8mlmx/iTunesLibrary.pkg/content/downloads/50/49/zzzz041-6245/uif0ktml8jgzve8yfgg7sra78c1hx8mlmx/iTunesLibrary.pkg</string>
<key>Result</key>
<string>Clean</string>
</dict>
<dict>
<key>Depth</key>
<integer>1</integer>
<key>Info</key>
<string>Error 42110 The file is a decompression bomb</string>
<key>Path</key>
<string>/System/Library/PrivateFrameworks/MediaKit.framework/Versions/A/Loaders/MKDrivers.bundle/Contents/Resources/bootroot.loader|>bootroot.loader.dmg</string>
<key>Result</key>
<string>Warning</string>
</dict>
<dict>
<key>Path</key>
<string>/System/Library/PrivateFrameworks/MediaKit.framework/Versions/A/Loaders/MKDrivers.bundle/Contents/Resources/bootroot.loader</string>
<key>Result</key>
<string>Clean</string>
</dict>
<dict>
<key>Depth</key>
<integer>1</integer>
<key>Info</key>
<string>Error 42056 Archive is password protected</string>
<key>Path</key>
<string>/Users/+++/Downloads/InvoiceCopies-1.zip|>LH38974607.0.pdf</string>
<key>Result</key>
<string>Warning</string>
</dict>
<dict>
<key>Depth</key>
<integer>1</integer>
<key>Info</key>
<string>Error 42056 Archive is password protected</string>
<key>Path</key>
<string>/Users/+++/Downloads/InvoiceCopies-1.zip|>LH39443266.1.pdf</string>
<key>Result</key>
<string>Warning</string>
</dict>
<dict>
<key>Depth</key>
<integer>1</integer>
<key>Info</key>
<string>Error 42056 Archive is password protected</string>
<key>Path</key>
<string>/Users/+++/Downloads/InvoiceCopies-1.zip|>LH39914810.2.pdf</string>
<key>Result</key>
<string>Warning</string>
</dict>
<dict>
<key>Path</key>
<string>/Users/+++/Downloads/InvoiceCopies-1.zip</string>
<key>Result</key>
<string>Clean</string>
</dict>
<dict>
<key>Depth</key>
<integer>1</integer>
<key>Info</key>
<string>Error 42056 Archive is password protected</string>
<key>Path</key>
<string>/Users/+++/Downloads/InvoiceCopies-2.zip|>LH38974607.0.pdf</string>
<key>Result</key>
<string>Warning</string>
</dict>
<dict>
<key>Depth</key>
<integer>1</integer>
<key>Info</key>
<string>Error 42056 Archive is password protected</string>
<key>Path</key>
<string>/Users/+++/Downloads/InvoiceCopies-2.zip|>LH39443266.1.pdf</string>
<key>Result</key>
<string>Warning</string>
</dict>
<dict>
<key>Depth</key>
<integer>1</integer>
<key>Info</key>
<string>Error 42056 Archive is password protected</string>
<key>Path</key>
<string>/Users/+++/Downloads/InvoiceCopies-2.zip|>LH39914810.2.pdf</string>
<key>Result</key>
<string>Warning</string>
</dict>
<dict>
<key>Path</key>
<string>/Users/+++/Downloads/InvoiceCopies-2.zip</string>
<key>Result</key>
<string>Clean</string>
</dict>
<dict>
<key>Depth</key>
<integer>1</integer>
<key>Info</key>
<string>Error 42056 Archive is password protected</string>
<key>Path</key>
<string>/Users/+++/Downloads/InvoiceCopies-3.zip|>LH38974607.0.pdf</string>
<key>Result</key>
<string>Warning</string>
</dict>
<dict>
<key>Depth</key>
<integer>1</integer>
<key>Info</key>
<string>Error 42056 Archive is password protected</string>
<key>Path</key>
<string>/Users/+++/Downloads/InvoiceCopies-3.zip|>LH39443266.1.pdf</string>
<key>Result</key>
<string>Warning</string>
</dict>
<dict>
<key>Depth</key>
<integer>1</integer>
<key>Info</key>
<string>Error 42056 Archive is password protected</string>
<key>Path</key>
<string>/Users/+++/Downloads/InvoiceCopies-3.zip|>LH39914810.2.pdf</string>
<key>Result</key>
<string>Warning</string>
</dict>
<dict>
<key>Path</key>
<string>/Users/+++/Downloads/InvoiceCopies-3.zip</string>
<key>Result</key>
<string>Clean</string>
</dict>
<dict>
<key>Depth</key>
<integer>1</integer>
<key>Info</key>
<string>Error 42056 Archive is password protected</string>
<key>Path</key>
<string>/Users/+++/Downloads/InvoiceCopies.zip|>LH38974607.0.pdf</string>
<key>Result</key>
<string>Warning</string>
</dict>
<dict>
<key>Depth</key>
<integer>1</integer>
<key>Info</key>
<string>Error 42056 Archive is password protected</string>
<key>Path</key>
<string>/Users/+++/Downloads/InvoiceCopies.zip|>LH39443266.1.pdf</string>
<key>Result</key>
<string>Warning</string>
</dict>
<dict>
<key>Depth</key>
<integer>1</integer>
<key>Info</key>
<string>Error 42056 Archive is password protected</string>
<key>Path</key>
<string>/Users/+++/Downloads/InvoiceCopies.zip|>LH39914810.2.pdf</string>
<key>Result</key>
<string>Warning</string>
</dict>
<dict>
<key>Path</key>
<string>/Users/+++/Downloads/InvoiceCopies.zip</string>
<key>Result</key>
<string>Clean</string>
</dict>
</array>
	<key>Paths</key>
	<array>
		<string>/</string>
	</array>
	<key>Started</key>
	<date>2014-03-12T21:31:08Z</date>
	<key>Status</key>
	<integer>200</integer>
	<key>Type</key>
	<string>ScanTypeFullSystem</string>
</dict>
</plist>
2

Where did you get this Log from? What program?

3

I’m using avast and it is running on a mac OS.

4

Looks to me like a scan result of an avast! Full System Scan. Is this what it is? Unable to scan archived files errors are normal as avast! is unable to open these files as it does not know the embedded password needed to properly open them for scanning. It cannot open these files at all as it does not know the password.

Please attach a .jpeg of the scan results as these are much easier to understand and is the usual way to present such findings.

5

exactly. It is a avast full scan. Here is a picture:

6

Certainly appears to be all archive scanning errors. Unknown passwords will do that; avast! cannot open these files to scan them and is simply reporting that fact as only a scanning error.

Archived files are inert and cannot do harm to your system unless they are opened by you and also contain malicious files within them. If not ever opened, they cannot be malicious even with known malware within; avast! will alert and block any malicious files detected inside an archived file the moment they are opened manually by you, however. avast! will automatically scan the opened archive file as it is being uncompressed from its compressed state.

A part of the .jpeg is not viewable. Could you attach a second picture showing the rest of the detection lines by sliding the bar to the right?

[EDIT:]

http://forum.avast.com/index.php?topic=147725.msg1072754#msg1072754 Thank you Pondus, for this link.

7

to the right there is only one more column named “status” with no entries in it. Should I still take a new screenshot?

8

Nope.

9

Sorry for my late reply. I misunderstood you. Here is a new picture, sadly I can’t expand the column any further:

10

The above displays archived files that would need a known password for avast! to open and then scan. Password is unknown, avast! can’t open it to scan. Thus the resulting error.

11

So that means they are not malicious, right?

12

Correct, just can’t be scanned because it has a password. Lots of AV’s products password protect things. Spyboy Search & Destroy for example does.

13

As does adobe flash full installer, most program installer programs use a password, so if avast! does not know the password, it cannot look inside the installer file and so reports the ‘cannot scan error’. This password is internal and only known to the installer program so as to be able to open and extract the compressed files to run the install program.

IF avast! knows the password==>THEN the archived file/installer program is opened and scanned by avast!
IF avast! does not know the password==>THEN the archived file/installer program is not opened and scanned by avast!

Avast! then reports the scanning error, as it is supposed to be able to scan all files on the hard drive, but fails to do so here.

It cannot when the password is unknown. Passwords are used in archived files/installer programs to protect them from malicious modification by people with malicious intent and also maintain file integrity by preventing these people from easily opening the file to make any undesirable changes to it.

The only time an archived file/installer file can be malicious is when it is opened by the user of the system. Avast! File Shield will automatically block any known malware being unloaded and uncompressed at the moment it is run from an archived file.

So, if avast! cannot scan an archived file because it does not know the password, don’t worry. Archived files cannot harm your system just sitting there; they must be opened by you to cause harm, and avast! is ready to block any malicious or suspicious files from running at the moment they are opened on your system, if detected, to prevent damage to your system.

Archived files=inactive files=cannot harm your system in an inactive state even if malicious.

14

Thank You very much for your help and explanation!!!