Kaspersky and corrupted files

[infini]

I did a scan with Kaspersky antivirus and it reported that found some corrupted files. Is there a way to find which files are exactly corrupted? Anybody knows what I/O Errors are?

[Lisa]

Hi,
Below you can find the definition of Corrupted Files:-

"Kaspersky Anti-Virus displays the message "corrupted" if it assumes the checked file is in a certain format, but cannot find this format.
The reasons for this vary and could be any of the following:
1. the com-file is larger than 64 K;
2. the entry point in the executable file (COM, EXE, SYS, NE, PE, LE, LX) is outside the file limits;
3. the file archive, OLE document etc. has a defective format/interval structure."

In simple words, this situation occurs when one big file is divided into two or more parts which are in different archives. For example, some Win98 installation cab files contain "corrupted" files. And certainly they are not corrupted


I/O errors are Input/Output errors and are files locked out from being scanned usually by Windows - again nothing to worry about.

Regards

Lisa
KL UK

[infini]

Once i found a corrupted file that was an infected exe. I scanned my computer for second time with Kaspersky only after a while after the first time and it found a variant of P2P Interor worm inside a chm file, in an html file. This wormed was not found in the first scan and i had a long time to use this file. Another strange thing is that when Kaspersky finds an infected files, although i press to delete the file, the file remains.

[controler]

Oh yes and KAV reports those errors on some infected files it has no def's for at this time. It is one way of knowing you have something but just are not sure what yet.

con

[infini]

I think it is useless if Kaspersky just tells you that some files are corrupted (maybe infected with a virus) and not which exactly these files are.

[Lisa]

Hi Infini,
We do tell you where these corrupted files are - just look in the report file - if you ran the scan via the KAV Control Centre - right click on the Scan task and choose View Report - it tells you the full path to the files - as I mentioned previously a corrupted file is not an infected file.

This is not to be confused with Suspicious Files - always take very latest updates and rescan - if still detected as suspicious send a sample of the file (zipped and with a password) to newvirus@kaspersky.com.


If an exe file is classed as corrupted i would advise you to send a copy also to newvirus@kaspersky.com in case it may be a false positive.
Hope this helps?

Regards

Lisa
KL UK