Win32:Kryptik-PFA

system · 2015-05-06T19:10:24.000Z

I am all of a sudden receiving reports from several computers with the following message regarding Win32:Kryptik-PFA:

File “C:\Windows\System32\ZenLgn.dll” is infected by “Win32:Kryptik-PFA [Trj]” virus.
“File System Shield” task used
Version of current VPS file is 150506-3, 05/06/2015

How do I know if Avast truly resolved the issue, quarantined it or just left it untouched?

system · 2015-05-06T19:21:43.000Z

If you check the Avast End-Point forum this is apparently widespread. Sounds like a bad Avast Virus Definition update. Hopefully Avast is working on the issue.

system · 2015-05-06T19:25:52.000Z

I believe we have a problem with virus definition updates.
I received an identical quarantine notice for three DLL files, one from my email program and two from my video driver.
The email DLL has a file date of 14 November-2014. The other two files are dated 2-July-2014.
I disabled Avast via the shields control and restored the files from quarantine.

I hope this gets fixed quickly. I don’t relish the thought of our IT staff having to go through the same issue with all 400 members of our organization.

Eddy · 2015-05-06T19:34:25.000Z

Submit it to avast as a possible false positive:
https://blog.avast.com/tag/false-positive/

system · 2015-05-06T19:43:30.000Z

I will submit it as a false-positive but it is running ramped on many files. Do I need to submit it as a false positive for each file reported?

system · 2015-05-06T20:02:01.000Z

Same problem at our institution… Not good…

system · 2015-05-06T20:09:45.000Z

So when we can have a solution to this false positive problem?

system · 2015-05-06T20:10:48.000Z

We are also experiencing the same issue – since about 10:30AM Pacific.

system · 2015-05-06T20:15:47.000Z

Same here, we have thousands of messages with files being moved to chest and its even flagging the Chrome executable.
the Virus page at avast shows that
https://www.avast.com/en-us/virus-update-history shows …

6.5.2015 - 150506-3
This VPS update contains only fixes to existing definitions or removal of false alarms.

but we are still getting thousands of notifications.

system · 2015-05-06T20:18:42.000Z

There’s some discussion here, too: https://forum.avast.com/index.php?topic=170705.0

Based on the discussion here I’m changed the “Action” on my “File System Shield” to “Do Nothing” across the board (at the root of my “Computer Catalog”). This stopped the files from being put into the “Virus Chest” but I’m still receiving notifications.

Announcements