quarantine folder on hard disk

Avast Free Antivirus / Premium Security
1

hello,

I’m french. After updating AVAST to the version 6.0, my computer can’t restart because the new version has detected viruses on files used to the start the computer.
I would see the quarantine folder on the hard disk to see the infected files, but i can’t enter in WINDOWS XP. I see the hard disk on an other computer.

Please can you tell me in what folder the infected files are stocked ?

thank’s for your response and sorry for my english

2

Here
C:\ProgramData\AVAST Software\Avast\chest
But they don’t have extensions, so you will cannot access them.

And Can you please tell me what files/folders are detected and what infection was found?
Can you access to safe mode? (when booting start pushing F8 and choose safe mode)

So

  1. Enter the Safemode WITH INTERNET
  2. Restore quarantined files to it’s original location
  3. Pack the folder with detected files to *rar extension
  4. Open explorer and type in ftp://ftp.avast.com/incoming/
  5. Send the archive to this address
3

thank’s for your response.

i haven’t the folder “chest” in C:\ProgramData\AVAST Software\Avast\

i have :
C:\ProgramData\AVAST Software\Avast\1036
C:\ProgramData\AVAST Software\Avast\chrome
C:\ProgramData\AVAST Software\Avast\defs
C:\ProgramData\AVAST Software\Avast\flash
C:\ProgramData\AVAST Software\Avast\setup
C:\ProgramData\AVAST Software\Avast\WebRep

but no chest

an other idea ?

4

Wow, I don’t have any of these files you listed me.
C:\ProgramData\AVAST Software\Avast\

So, access to safe mode, open avast! GUI, open maintenance and Chest.
Then restore files to original location, pack the files to archive and send them to
ftp.avast.com/incoming/
Don’t forget to name the package like coco3117 infected.rar. BTW don’t forget to enter password “Infected”

5

sorry, i make a mistake, these folders are in C:\Program Files and not in c:\ProgramData like this :
C:\Program Files\AVAST Software\Avast\1036
C:\Program Files\AVAST Software\Avast\chrome
C:\Program Files\AVAST Software\Avast\defs
C:\Program Files\AVAST Software\Avast\flash
C:\Program Files\AVAST Software\Avast\setup
C:\Program Files\AVAST Software\Avast\WebRep

no folder c:\ProgramData in my disk, it’s normal ?

6

Yes It’s normal, you don’t have Windows 7. But please follow my previous post.

→

  1. Enter the Safemode WITH INTERNET
  2. Restore quarantined files to it’s original location
  3. Pack the folder with detected files to *rar extension, name the *rar “coco3117 infected” and enter name infected
  4. Open explorer and type in http://ftp://ftp.avast.com/incoming/
  5. Send the archive to this address
7

And the purpose of this excercise is? Restore infected files so that you can boot and get more of them infected, or what? ??? ??? ??? You need to restore the files from a known clean source, NOT from the chest.

8

Look in C:\Documents and Settings\All Users\Application Data\AVAST Software\Avast\chest

9

Stop entering your stupid notes and give him some help >:(

10

You know what? Stop giving stupid “advice”. Restoring infected system files required for boot makes no sense. Either they will immediately get deleted again or they will be missed by avast! and infection will spread. I gave him correct non-stupid advice.

11

I want to let him restore files, send them to avast lab to check

12

Then I offer help as you are running Windows 7 x64 and I am running XP!

13

And how is it going to help with his unbootable system? Uh. And it is irrelevant which system you are using. Infected system files need to be replaced from known clean source, instead of restoring the infection. ::slight_smile:

14

I don’t think he wants to restore the files… well I hope not. But as he cannot boot anymore as a result of these files being quarantined, he just wants to see them in the chest folder from another OS install (or networked computer).

15

i have find the folder F:\Documents and Settings\All Users\Application Data\AVAST Software\Avast\chest with 33 files named “0000000A” to “00000020” and ondex.xml.

what can i do ? Send the folder to avast lab ?

16

Yes

17

oui :wink:

18

I don’t want him to restore the files forever, I want just to let him send these files to avast! If this is false positive or he’s infected,

19

these sound like restore point or recycled files…

20

Ignore the quarantined crap in the chest for now, you can submit them via chest normally once you have fixed your system properly. Do you have XP install media at hand? If so, take note of the missing files when XP fails to boot, you can use expand.exe to replace them when you boot to XP recovery console (from the F8 boot menu or from the CD).

Nah, avast! is mangling the filenames as well. There is index.xml file with information about the original names and location of the renamed files in the chest folder.