the chest!??

system · 2007-11-11T13:28:03.000Z

Im not a familiar user of avast, so this question may sound silly,
but once a file is sent to ‘the chest’, is there any way it can be removed/restored…

avast just picked up taskmgr.exe as well as rundll32 and some other important programs and locked them up.
furthermore, it is not being able to clean those files.

Can anyone tell me if its even possible to get applications out of the chest or do i now need to reinstall windows xp?

thanks

Lisandro · 2007-11-11T13:30:06.000Z

Sure, run avast antivirus, right click the skin and choose Chest option in the context menu.
Into Chest, right click a file to scan, restore (original place), extract (to another place), delete…
These important programs could be, really, infected. Scan files into Chest before restoring them (if they are clean). Do you have any other computer with the same operational system?

DavidR · 2007-11-11T13:50:13.000Z

How do you know they are important other than the file name ?

Some malware use the names of common system files (usually located in different folders) to make the user think as you have that they are important, to stop you dealing with them.

The ones you mention, if they were in fact system files you would notice that rundll32.dll was missing as many other processes require it the same is true of taskmgr.exe you wouldn’t be able to open the Task Manager (though some malware disables this).

So don’t restore anything without confirmation.
What is the malware name, the infected file name and where was it found e.g. (malware name, C:\windows\system32\infected-file-name.xxx) ?
Check the avast! Log Viewer (right click the avast ‘a’ icon), Warning section, this contains information on all avast detections.

Tarq57 · 2007-11-11T23:02:21.000Z

Is it possible you are looking in the chest under “system files”, which were created there by the VRDB? (This is normal. There are several sections in the chest.)
Or did Avast actually warn of a virus in those files, and quarantine them?

Lisandro · 2007-11-12T00:18:09.000Z

Tarq57 post:4:

Is it possible you are looking in the chest under “system files”, which were created there by the VRDB? (This is normal. There are several sections in the chest.)

I think taskmgr.exe and rundll32.exe aren’t on the default system files stored into Chest (System folder). But, anyway…

DavidR · 2007-11-12T01:29:25.000Z

That is correct these files aren’t saved into the system files section of the chest.

Tarq57 · 2007-11-12T01:32:37.000Z

OK, my bad. I’ve just double checked my chest and the only system files present are instances of kernel32 and winsock32.

DavidR · 2007-11-12T02:34:10.000Z

Another in mine is winsock.dll not winsock32.dll there is no system file of that name, what you may be thinking of is wsock32.dll

Tarq57 · 2007-11-12T10:35:21.000Z

Mm. Might be winsock.dll. :-[
(note to self: don’t rush replies on a hunch, however convincing it feels…)

Announcements