I posted this earlier but I think I made a mistake by including it in a thread marked Resolved so I am trying again.
I have the exact same problem described by RufusO on December 28, 2007:
“Avast! reported that “C:\System Volume Information\catalog.wci\00000002.PS2” was a Win32:Agent-OLD [trj]” I have been able to delete it but it keeps reappearing.
I’ve tested the file with Norton Security, AVG Antivirus, AVG Antispyware, AVG AntiRootkit, Kaspersky online, TrendMicro online, Spybot, and AdAware but none of them identify it as a problem. The first time it was identified by Avast I was able to move it to the Moved directory. Avast found it there during the next scan and I was able to move it from there to the Chest. It is a large file: 29425664 bytes.
Unfortunately it soon reappeared in the original folder C:\System Volume Information\catalog.wci. I have been marking it for deletion on reboot and Avast is able to delete it that way but it always comes back again within a couple of hours.
Has this been identified as a false positive?
Thanks for any help. I have a HijackThis file so I might as well include it:
(actually it took me over my character limit so I just included the running processes)
Logfile of HijackThis v1.99.1
Scan saved at 6:56:19 PM, on 1/1/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
If you have knowledge to take the ownership of that folder, you can copy or directly send it for analysis on www.virustotal.com. Then you can know if it is a false positive. If so, you can add the file (do not add the whole folder!) to avast exclusion list of Standard Shield.
If you don’t want to have this work, just disable the System Restore (it will delete the ‘infected’ restore points), click ‘Apply or Ok’, enable it again.
Your hjt log is only partially there, you need to use more postings to send the complete logfile, then we can analyze it. You might have to block third party cookies in Firefox:
Type about:config in the location bar
Type “cookie” in the Filter field
Right-click network.cookie.cookieBehavior and select “Modify” from the pop-up menu
Change the value to 1
Click OK.
Close the window
Waiting for your complete hjt logfile to analyze,
OK thanks Polonus. Here is a hjt scan I did right after Avast told me it found the trj again and before I did anything with the file through Avast. And here is a clue that is probably significant: it finds several thousand files in the System Volume Information folder but it always tells me it has found an infected file while the display still says “Tested files: 1”.
(I’ll send the rest of the hjt log in another post, it’s too long for one)
Logfile of HijackThis v1.99.1
Scan saved at 10:13:21 AM, on 1/2/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Tech, thanks to you too. The most recent time Avast found the file I moved and renamed it. Then I zipped it and sent it to virustotal. It is about 27MB unzipped and they say their limit is 10MB so I hope they accept zipped files. It zipped to less than 2 MB. If I hear from them I will let you know.
Polonus, I also took your advice and reconfigured my third-party cookies in Firefox according to your instructions.
Below are the results from my submission to virustotal.com. Note that I had renamed the file according to how Avast had referred to it and their version of Avast came up with the same description.
Complete scanning result of “Agent-OLD[trj].zip”, processed in VirusTotal at 01/02/2008 17:25:22 (CET).
[ file data ]
name: Agent-OLD[trj].zip
size: 1832753
md5.: c31615a7c25b5cf32087ec5d4a915144
sha1: bac3ec4315da68060934d245ae368472b718e74a
peid…: -
[ scan result ]
AhnLab-V3 2008.1.2.10/20080102 found nothing
AntiVir 7.6.0.46/20080102 found nothing
Authentium 4.93.8/20080102 found nothing
Avast 4.7.1098.0/20080101 found [Win32:Agent-OLD]
AVG 7.5.0.516/20080102 found nothing
BitDefender 7.2/20080102 found nothing
CAT-QuickHeal 9.00/20071231 found nothing
ClamAV 0.91.2/20080102 found nothing
DrWeb 4.44.0.09170/20080102 found nothing
eSafe 7.0.15.0/20080101 found nothing
eTrust-Vet 31.3.5424/20080102 found nothing
Ewido 4.0/20080102 found nothing
F-Prot 4.4.2.54/20080101 found [Unknown format or compression method]
F-Secure 6.70.13030.0/20080102 found nothing
FileAdvisor 1/20080102 found nothing
Fortinet 3.14.0.0/20080102 found nothing
Ikarus T3.1.1.15/20080102 found nothing
Kaspersky 7.0.0.125/20080102 found nothing
McAfee 5196/20071231 found nothing
Microsoft 1.3109/20080102 found nothing
NOD32v2 2761/20080102 found [error - unknown compression method ]
Norman 5.80.02/20080102 found nothing
Panda 9.0.0.4/20080101 found nothing
Prevx1 V2/20080102 found nothing
Rising 20.25.22.00/20080102 found nothing
Sophos 4.24.0/20080102 found nothing
Sunbelt 2.2.907.0/20071230 found nothing
Symantec 10/20080102 found nothing
TheHacker 6.2.9.176/20080101 found nothing
VBA32 3.12.2.5/20080102 found nothing
VirusBuster 4.3.26:9/20080102 found nothing
Webwasher-Gateway 6.6.2/20080102 found nothing
You could consider to fix this adware hjt entry:
O8 - Extra context menu item: &Winamp Toolbar Search - C:\Documents and Settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
I submitted it again to virustotal in a different zip format and this time all the software packages were able to decompress it. All but Avast said “nothing found”.
Would you say it is safe to assume it is a false positive now?
Should I upload the file to Avast?
Polonus, I took your advice about fixing the Winamp adware that hjt flagged.
I want to say it again because from your response I think you misunderstood me (It did not make sense when you wrote:“I suppose the other scanners say the same (nothing found).”)
Avast does NOT say “nothing found”. Avast still thinks it is a trojan but all the others say “nothing found”.
"1. If you have knowledge to take the ownership of that folder, you can copy or directly send it for analysis on www.virustotal.com. Then you can know if it is a false positive. If so, you can add the file (do not add the whole folder!) to avast exclusion list of Standard Shield."
Tech, this is what you had suggested earlier. Do you still think I should add it to the exclusion list now that you think it is a false positive? If you do, can you tell me how?
Thanks for your help.
And thank you too, Polonus.
My mind is much relieved now. ;D
For the Standard Shield provider (on-access scanning):
Left click the ‘a’ blue icon, click on the provider icon at left and then Customize.
Go to Advanced tab and click on Add button…
Write down exactly this:
C:\System Volume Information\catalog.wci\00000002.PS2
I suggest you add this file to Chest, right clicking the Chest folder (User folder) and adding the same file. After that, please, periodically check it - scan it into Chest, right clicking the file - there should still be a copy in the chest even though you restored it to the original location. When it is no longer detected as being infected then you can also remove it from the Exclusion list.
OK, thanks again. I’ve followed your latest suggestions and I will probably also send it off to virustotal.com again periodically if it continues to be flagged by Avast, just to see if any of the other scanners decide to agree with Avast that it is a Trojan.
I don’t think it is necessary. Check into Chest when avast corrects the false positive detection, then submit it again to virustotal and only after that restore the file.