Viruses in Memory - "Move to Chest" and "Delete" not working

gradenigo · 2015-07-11T17:34:12.000Z

Hello Forum Members !

For the last few months Avast-Pro has found in my computer a virus in a Memory Block.

Now suddenly there are seven viruses in memory blocks - following “Scan Memory” with Heuristics Sensitivity “High”.

“Scan Results” brings the message that “delete” and “move to chest” don’t work in this case of a virus in a memory block.

http://i230.photobucket.com/albums/ee117/gradenigo_2/Viruses-in-Memory-Scan_2015-07-11_17-48-20_zpskmvopo7b.jpg

I tried a boot-time-scan but no change - viruses not removed.

What to do ??? :-\ :o ??

Or do the following posts say what is happening ??

Asyn post:2:

Don’t worry, these are signatures, that WD loads unecrypted into memory.
asyn

DavidR post:9:

darrenjedwards post:6:

ok guys thanks for the replies. Because I had so many viruses, I set avast to full sensitivity, checking all files, memory, unpacking all files etc. So there is nothing to worry about then. I dont quite understand what they are. Are these traces of old viruses I have had?

You’re welcome.

As has been said, Windows Defender (WD) has loaded its unencrypted virus signatures into memory and you have asked avast to do a thorough scan of memory, looking for viruses and it is looking for specific signatures (and it found them).

WD loads these virus signatures into memory because it is quicker to check against memory than it is to check against the Hard Disk when searching for viruses. The problem being other security software scanning memory is going to find them because they aren’t encrypted (which would slow things as they would also need decrypted).

Setting to full sensitivity isn’t necessarily going to increase your protection, especially on an on-demand scan as in effect it is scanning files that would otherwise be inert or dormant. That is the whole purpose of the resident, on-access scanners to scan files before they are created, modified, opened or run, etc.

It is in the resident Shields that sensitivity could be bumped up (rather than in on-demand scans), but again you have to take care as increasing heuristic sensitivity could well flag files that are good but suspect. PUPs (Potentially Unwanted Program) for instance and the alert is more likely to cause you anxiety than the actual file itself.

Thanks in advance for advice and help.
Bob

Here is the corresponding report file from my “Scan Memory”:

Avast Scan Report
Scan name: Memory
Started on: Saturday, July 11, 2015 5:42:15 PM
VPS: 150711-0, 11.07.2015

Process 884 [services.exe], memory block 0x0000000100000000, block size 241664 [L] Win64:Evo-gen [Susp] (0)
During the file delete, error occurred: The operation is not supported for this type of archive.

Process 3392 [cce.exe], memory block 0x0000000006090000, block size 24576 [L] Win32:Agent-ZXJ [Trj] (0)
During the file delete, error occurred: The operation is not supported for this type of archive.

Process 3392 [cce.exe], memory block 0x00000000060A0000, block size 843776 [L] Win32:Delf-DNW [Trj] (0)
During the file delete, error occurred: The operation is not supported for this type of archive.

Process 3392 [cce.exe], memory block 0x0000000006180000, block size 364544 [L] HTML:Illiframe [Trj] (0)
During the file delete, error occurred: The operation is not supported for this type of archive.

Process 3392 [cce.exe], memory block 0x000000000D270000, block size 2097152 [L] Win32:FakeVimes-B [Trj] (0)
During the file delete, error occurred: The operation is not supported for this type of archive.

Process 3392 [cce.exe], memory block 0x000000000D470000, block size 2682880 [L] Win32:FakeVimes-B [Trj] (0)
During the file delete, error occurred: The operation is not supported for this type of archive.

Process 3392 [cce.exe], memory block 0x000000000E2E0000, block size 802816 [L] Win32:FakeVimes-B [Trj] (0)
During the file delete, error occurred: The operation is not supported for this type of archive.

Infected files: 7
Total files: 19730
Total folders: 0
Total size: 2.9 GB

Scan stopped: Saturday, July 11, 2015 5:45:29 PM
Run-time was 3 minute(s), 3 second(s)

Pondus · 2015-07-11T17:40:11.000Z

This is a old one, explained a million times … not seen for a long time since users seems to have stopped playing with scan settings

First it is a process in memory detection and not a file … you cant delete, move a process to chest

Second, i guess you have changed default scan settings and selected scan memory ?

If so, remove that selection and detection should be gone … use default scan settings for a problem free avast operation

Eddy · 2015-07-11T18:43:22.000Z

cce.exe > COMODO Cleaning Essentials (several tools including a av)
You should not run at the same time with avast.

https://blog.kaspersky.com/multiple-antivirus-programs-bad-idea/

Announcements