[Resolved] Found Something Bad

[Para-Noid]

The report:
C:\WINDOWS\SYSTEM32\APISlice.dll
Severity: High
Threat: WIN32MALWARE
Action: Moved to chest.
Sorry I don’t know how to do screen captures.
What is this? I am glad avast caught it. And for a change I was not looking for trouble…it found me.

[system]

what do you have as a firewall ?

[Para-Noid]

@marc-d-l post:2

what do you have as a firewall ?

Window firewall.

[schmidthouse]

@Para-Noid post:1

The report:
C:\WINDOWS\SYSTEM32\APISlice.dll
Severity: High
Threat: WIN32MALWARE
Action: Moved to chest.
Sorry I don’t know how to do screen captures.
What is this? I am glad avast caught it. And for a change I was not looking for trouble…it found me.

Did you submit the item in the Chest to Avast for analysis. If you right click the file in the chest what options does it show…if any ???

[DavidR]

I don’t believe there is any need to submit it to avast as it is fairly clear that it is a good detection, see http://www.virustotal.com/file-scan/report.html?id=fc3b5e2c9e3338e6b722dacf49bdc819a0f3504ffca43882300e2c356fb2b38c-1293831396, where 16 of 43 scanners find something in it.

There is no rush to delete anything from the chest, a protected area where it can do no harm. Anything that you send to the chest you should leave there for a few weeks. If after that time you have suffered no adverse effects from moving these to the chest, scan them again (inside the chest) and if they are still detected as viruses, delete them.

[schmidthouse]

@DavidR post:5

I don’t believe there is any need to submit it to avast as it is fairly clear that it is a good detection, see http://www.virustotal.com/file-scan/report.html?id=fc3b5e2c9e3338e6b722dacf49bdc819a0f3504ffca43882300e2c356fb2b38c-1293831396, where 16 of 43 scanners find something in it.

There is no rush to delete anything from the chest, a protected area where it can do no harm. Anything that you send to the chest you should leave there for a few weeks. If after that time you have suffered no adverse effects from moving these to the chest, scan them again (inside the chest) and if they are still detected as viruses, delete them.

Hey DavidR: What is the general process as I have not had a virus with Avast installed as yet. ;D
Is it typical to run with Virus Total first( before thinking of submitting to Avast)? Or not. ???

[DavidR]

There is only a need to submit to avast of you believe it to be a false positive detection. and before you can do that it needs to be confirmed at somewhere like virustotal.

[schmidthouse]

@DavidR post:7

There is only a need to submit to avast of you believe it to be a false positive detection. and before you can do that it needs to be confirmed at somewhere like virustotal.

Thanks

[system]

@Para-Noid post:1

Sorry I don’t know how to do screen captures.

Use Snipping Tool to capture screen shots
http://windows.microsoft.com/en-US/windows-vista/Use-Snipping-Tool-to-capture-screen-shots

[Para-Noid]

@schmidthouse post:4

@Para-Noid post:1

The report:
C:\WINDOWS\SYSTEM32\APISlice.dll
Severity: High
Threat: WIN32MALWARE
Action: Moved to chest.
Sorry I don’t know how to do screen captures.
What is this? I am glad avast caught it. And for a change I was not looking for trouble…it found me.

Did you submit the item in the Chest to Avast for analysis. If you right click the file in the chest what options does it show…if any ???

No. When I right clicked nothing happened.

[Para-Noid]

@DavidR post:5

I don’t believe there is any need to submit it to avast as it is fairly clear that it is a good detection, see http://www.virustotal.com/file-scan/report.html?id=fc3b5e2c9e3338e6b722dacf49bdc819a0f3504ffca43882300e2c356fb2b38c-1293831396, where 16 of 43 scanners find something in it.

There is no rush to delete anything from the chest, a protected area where it can do no harm. Anything that you send to the chest you should leave there for a few weeks. If after that time you have suffered no adverse effects from moving these to the chest, scan them again (inside the chest) and if they are still detected as viruses, delete them.

How do you re-scan an item in the Virus Chest?

[schmidthouse]

@Para-Noid post:10

@schmidthouse post:4

@Para-Noid post:1

The report:
C:\WINDOWS\SYSTEM32\APISlice.dll
Severity: High
Threat: WIN32MALWARE
Action: Moved to chest.
Sorry I don’t know how to do screen captures.
What is this? I am glad avast caught it. And for a change I was not looking for trouble…it found me.

Did you submit the item in the Chest to Avast for analysis. If you right click the file in the chest what options does it show…if any ???

No. When I right clicked nothing happened.

No worries, I wasn’t sure as I have not had to submit anything from the Virus Chest. And as DavidR mentioned, there isn’t any need in any case.
Like everyone else…I live and learn :-\

[Para-Noid]

@DavidR post:5

I don’t believe there is any need to submit it to avast as it is fairly clear that it is a good detection, see http://www.virustotal.com/file-scan/report.html?id=fc3b5e2c9e3338e6b722dacf49bdc819a0f3504ffca43882300e2c356fb2b38c-1293831396, where 16 of 43 scanners find something in it.

There is no rush to delete anything from the chest, a protected area where it can do no harm. Anything that you send to the chest you should leave there for a few weeks. If after that time you have suffered no adverse effects from moving these to the chest, scan them again (inside the chest) and if they are still detected as viruses, delete them.

Went to virustotal and no waiting for results.

[Para-Noid]

@DavidR post:5

I don’t believe there is any need to submit it to avast as it is fairly clear that it is a good detection, see http://www.virustotal.com/file-scan/report.html?id=fc3b5e2c9e3338e6b722dacf49bdc819a0f3504ffca43882300e2c356fb2b38c-1293831396, where 16 of 43 scanners find something in it.

There is no rush to delete anything from the chest, a protected area where it can do no harm. Anything that you send to the chest you should leave there for a few weeks. If after that time you have suffered no adverse effects from moving these to the chest, scan them again (inside the chest) and if they are still detected as viruses, delete them.

What does 16/43 means a good detection?

[system]

I would say yes, that is conclusive enough to call it a good detection.

[Para-Noid]

Thanks to all. Once again I learned something new. You guys rock!

[system]

I too had a full scan report this as a high risk item. This file has been on the PC since 2/2007 according to the properties information. When I tried to move it to the chest, I get this message: Error: Access is denied(5). This is on an Acer laptop, and I purchased it 12/2006. Is it possible this is an Acer API? There is one that runs every time the computer is booted.

[DJBone]

@pinseeker1964 post:17

I too had a full scan report this as a high risk item. This file has been on the PC since 2/2007 according to the properties information. When I tried to move it to the chest, I get this message: Error: Access is denied(5). This is on an Acer laptop, and I purchased it 12/2006. Is it possible this is an Acer API? There is one that runs every time the computer is booted.

probably it’s a false positive. what’s the file name?

DJBone

[system]

Is Acer eDataSecurity Management on that acer laptop.

I reported the same file : http://forum.avast.com/index.php?topic=68836.0

I’m not using Acer eDataSecurity Management (disabled) on this particular acer laptop. And I din’t get the message: Error: Access is denied(5) when moving the file to the chest.