Win32:Kryptik-PFA [Trj] - False Positive ?

[mmanous]

@kaidomac post:82

@schester post:78

Well this seemed to only work on one computer. I ran the task on the group and checked another computer that said done and the files weren’t there. I then tried running the task on that single computer and waited for it and the task still reported done, but the files were not restored. From the local machine I was able to restore them and it instantly worked.

What gives?

I’ve been doing it manually as well. What a nightmare. I just had 200 computers blow up yesterday. It cost my client a LOT of money to have everyone go down like that. It ate everything from email to database software. Really really really bad. I was able to get the update pushed out to the bulk of them last night, but there were still a handful that required manually restoring files from the vault on the local machine to work properly. I can’t believe how bad this is. I haven’t even gotten a generic emergency support email or a “sorry” email or anything either, disappointed that there’s basically been radio silence from Avast. I had to go online & dig to find this thread to figure out what was going on.

Will I change antivirus vendors for the future? Not sure. Mistakes happen. The software has been very good up until this point, and they did roll out the fix-it patch same-day. I’ve had this happen with Windows Updates as well, so no company is immune to problems of this magnitude. The Avast fix hasn’t been 100% effective for every machine, but as of this morning I have 95% of my users back up & running. I understand that mistakes happen. Just a bit upset that they didn’t even send out an email notice or anything for a status update.

I’ve had zero luck running the restore task as well. I temporarily disabled Windows Firewall on both my AEA server and the client I was trying to run the restore task to. It still didn’t work with both firewalls turned off.

I also discovered that I was unable to use the Remote Virus Chest feature (I’ve never had a need before now). For those that don’t know, you need to open port 135 and 16108 for the Remote Virus Chest to work. This can be configured in Group Policy. Computer Configuration → Policies → Administrative Templates → Network → Network Connections → Windows Firewall → Domain Profile → Windows Firewall: Define inbound port exceptions. At least now I don’t have to go office to office or use VNC to manually restore.