VBS:malware-gen

Avast Mac Security
1

I have just installed Avast for MAC and it immediately threw up VBS:Malware-gen on the very first scan. If it is a generator what else might it have done that has not been seen by Avast. In the Avast literature it says that no one product will find all the problems. Do you recommend a particular partner product?

2

What file did it report as infected?

3

I wrote down the file name (3BDAE9BBd01) but I am afraid I destroyed the path when I unintentionally cleared it from the virus chest - sorry

4

The other problem is that whenever I run a scan when I come back to the MAC I get two message windows, one saying deamon has died scanning / and the other saying that com.avast.macavast.MAD has unexpectedly quit do I want to relaunch. I have run 3 cans since downloading my license and i get this every time. I don’t particularly sit in front of my iMAC for an hour or so to catch it at the point it gives up. Any thoughts on what I should try next?

5

I found the following in the log,

14.08.08 05:35:19.811 Got expiration “13.10.2009”
14.08.08 05:35:19.813 Licence OK
14.08.08 05:39:15.111 Checking for update (manually: 0)
14.08.08 05:39:15.415 Update failed (507), falling back…
14.08.08 05:42:57.336 File operation: Move to Chest, 1 objects
14.08.08 05:42:57.825 real operation: Move to Chest on “/Users/Keith/Library/Caches/Firefox/Profiles/27v46w6i.default/Cache/3BDAE9BBd01” (chested (null)) success 1
14.08.08 05:44:15.688 Got expiration “13.10.2009”
14.08.08 05:44:15.689 Licence OK
14.08.08 05:44:30.334 Scanning 1 paths (auto 0):
14.08.08 05:44:30.335 /
14.08.08 07:25:47.786 Daemon launched
14.08.08 07:25:52.265 Scanned: aborted 0, items: 975224, files: 776731, viruses: 0, warnings: 427
14.08.08 07:25:54.199 Daemon pid 2969 priority 0 reports trial 0 (0.000000 days)
14.08.08 07:25:54.270 Got expiration “13.10.2009”
14.08.08 07:25:54.272 Licence OK

Hope it helps

6

Try Applying the patch thats detailed in the following thread:
http://forum.avast.com/index.php?topic=36197.msg303743#msg303743

7

yes, it might be this long-path problem - apply the fix, and tell us whether the bug disappeared.
VBS:malware-gen is a generic detection for VB scripts.

pc

8

I applied the patch and ran again. The “Deamon died” problem went away but now the scan didn’t stop. I left it going and when I got back 3.5 hours later it was showing 2680793 items in 2179100 files and still going. (It showed repeats of files with err 13)

9

Hallo,

as long as hard link is not allowed for directories (and softlinks aren’t followed) the “loop in recursion” shouldn’t occur. But, there might be some archives, cd-images and other things, that can make the count of items higher - maybe 3.5 hr for the whole disk wasn’t enough in your case.

Please, check this:

  • is the daemon that’s in use really 0.0.69 (hover mouse cursos over the VPS xxxx-xx-xx in left upper corner to see this)?
  • is it really cycling over and over - which files is it processing in a loop?

regards,
pc

10

It is definitely 0.0.69

I set it scanning last night and it was still going this morning

By copying the list to Excel I saw that the scan had gone into the Time Machine volume even though I had selected ‘scan volume’ and specified ‘Macintosh HD’. That is why I was seeing some duplicate file names. Interestly enough it found the trojan WIN32:small-HUF on the 2008-07-13 backup but it hasn’t found it in the main volume and I don’t remember ever seeing it found before.

It was in my virtual windows hard drive under Parallels

/Volumes/Time Machine Backups/Backups.backupdb/khimac/2008-07-13-055956/Macintosh HD/Users/Keith/Documents/Parallels/Microsoft Windows 2000/win2000.hdd
/Volumes/Time Machine Backups/Backups.backupdb/khimac/2008-07-13-055956/Macintosh HD/Users/Keith/Documents/Parallels/Microsoft Windows 2000/win2000.hdd/win2000.hdd.0.{5fbaabe3-6958-40ff-92a7-860e329aab41}.hds

I re-ran ‘scan folder’ and that stopped O.K.

11

I can see why it would scan the Time machine backup as its mounted in the /Volumes folder on the Hard Disk. You would need to exclude /Volumes/Time Machine Backups from the scanner to stop this.

12

I am sorry to have to ask for your patience again but how do I exclude /Volumes/Time Machine Backups from the scan

13

You know what, thats a good question. I dont see a way to :-\

14

I am going to start another topic specific to this because I can’t let it just run as long as it is - perhaps someone out there has solved it somehow