I have just done a boot scan for the first time and it found infected files but they’re in the avast program files. should i delete them? if they stay infected( they’re in the chest).
What are the paths / filenames?
Name- PSKILL.EXE.2.vir
original location- C:\Program Files\Alwil Software\Avast 4\DATA\moved
Virus- Win32:Pskill-E [Tool]
That is something that you previously detected and elected to move it (hence the .vir suffix) and not Move to chest.
Is this what you previously did with pskill.exe ?
I’m not sure. i remember moving something but that was because it wouldn’t move to the chest. (it’ in the chest now). so it might not have been pskill.exe
Well it would have to be pskill related otherwise the files name, the renamed file name in the moved folder plus the virus name wouldn’t have been PSKILL.EXE.2.vir.
Unfortunately because you sent it to the moved folder it won’t have recorded the original location or file name. You could check the avast! Log Viewer (right click the avast icon and select), look in the warning section and see if there any entries relating to this (roughly the same date and time).
I’ve checked the log file but theres no match. the last date in the log is the 3rd where as the infected file as the date of the 12th.
OK, there have been a few recent topics about the detection of pskill.exe, so a forum search for this file will return some hits, those should confirm if your detection is good or not, mainly by the location of the folder in which it was originally found.
This topic gives a common location where it may have been, http://forum.avast.com/index.php?topic=24846.0, check your system and see if these locations exist, namely the OEMCUST folder which would tent to indicate it isn’t intended for malicious use.
Personally you have nothing to worry about with this being in the moved folder since it has also been renamed even if its purpose was malicious usage of this file it couldn’t be found (in its original location) or executed (because of the renaming).
So should i restore it as well? (from the chest).
I can’t make that decision for you, I don’t have the full facts.
Before you do anything you have to confirm the location and purpose, that is the whole idea of giving the other information,