Im not a familiar user of avast, so this question may sound silly,
but once a file is sent to ‘the chest’, is there any way it can be removed/restored…
avast just picked up taskmgr.exe as well as rundll32 and some other important programs and locked them up.
furthermore, it is not being able to clean those files.
Can anyone tell me if its even possible to get applications out of the chest or do i now need to reinstall windows xp?
thanks
Sure, run avast antivirus, right click the skin and choose Chest option in the context menu.
Into Chest, right click a file to scan, restore (original place), extract (to another place), delete…
These important programs could be, really, infected. Scan files into Chest before restoring them (if they are clean). Do you have any other computer with the same operational system?
How do you know they are important other than the file name ?
Some malware use the names of common system files (usually located in different folders) to make the user think as you have that they are important, to stop you dealing with them.
The ones you mention, if they were in fact system files you would notice that rundll32.dll was missing as many other processes require it the same is true of taskmgr.exe you wouldn’t be able to open the Task Manager (though some malware disables this).
So don’t restore anything without confirmation.
What is the malware name, the infected file name and where was it found e.g. (malware name, C:\windows\system32\infected-file-name.xxx) ?
Check the avast! Log Viewer (right click the avast ‘a’ icon), Warning section, this contains information on all avast detections.
Is it possible you are looking in the chest under “system files”, which were created there by the VRDB? (This is normal. There are several sections in the chest.)
Or did Avast actually warn of a virus in those files, and quarantine them?
I think taskmgr.exe and rundll32.exe aren’t on the default system files stored into Chest (System folder). But, anyway…
That is correct these files aren’t saved into the system files section of the chest.
OK, my bad. I’ve just double checked my chest and the only system files present are instances of kernel32 and winsock32.
Another in mine is winsock.dll not winsock32.dll there is no system file of that name, what you may be thinking of is wsock32.dll
Mm. Might be winsock.dll. :-[
(note to self: don’t rush replies on a hunch, however convincing it feels…)