Avast stops scan when malware found

Discussion in 'other anti-virus software' started by EdP, Aug 23, 2008.

Thread Status:
Not open for further replies.
  1. EdP

    EdP Registered Member

    Joined:
    Mar 18, 2004
    Posts:
    83
    Using Avast 4.8 on Win XP Home SP2

    I tried to find a switch setting that would prevent Avast from stopping a scan and await user input when it finds some malware, but I couldn't.

    I invoked a full scan and left the PC figuring it would take over four hours. When I returned four hours later, it was sitting there informing me that it had found Win32:Agent-AXG Trojan in the dBpowerAMP-codec-ogg executable. The suggestion was to put it in the Chest. So why not put it there, go on with the scan, and inform me when it was over?

    If there is a way to do this, please let me know what it is.
    Thanks
    EdP
     
  2. hex_614

    hex_614 Registered Member

    Joined:
    Jul 17, 2008
    Posts:
    155
    Location:
    Manila, Philippines
    i also experience what you exp. that's my problem with avast i cant figure out how to auto quarantine the infection it found. avast needs baby sitting. you can try avira or avg, they auto quarantine the detected infection
     
  3. lodore

    lodore Registered Member

    Joined:
    Jun 22, 2006
    Posts:
    9,006
    if you want avast to prompt you at the end of the scan for actions you need to buy the pro version.
    if not you will just have to live with it.
     
  4. Firebytes

    Firebytes Registered Member

    Joined:
    May 29, 2007
    Posts:
    903
    A work-around from members of the Avast forum (have not tried it myself) to get the free version of Avast to keep scanning after an infection is found and automatically place the files found in the chest, etc:

    Start a scan with avast and see where the scan starts on your computer, stop the scan and place a dummy infection in the area where the scan starts (use the eicar test file for example) and then start a new scan. When Avast finds the dummy infection and you get the pop-up from Avast, tell it to send the file to the chest and to remember your answer. Now any other infections found after that should follow with the answer you gave for that first file. It should complete the scan and automatically handle all other files without your intervention.

    The other option as already stated... buy the pro version of Avast.
     
  5. deanmartin

    deanmartin Registered Member

    Joined:
    Sep 6, 2007
    Posts:
    231
    Location:
    USA/KY
    You could use its boot-time scanner,with its options and leave it unattended. when its done your pc restarts automatically. heres the info,

    Click on the Menu button. (after you start avast)
    Choose Schedule Boot Time Scan.
    Doing so displays a dialog allowing you to schedule virus scanning.
    Check Archives, if you want scan all the archives.
    Specify whether all the disks or just a specific folder should be scanned.
    Select Advanced options for scheduling details.
    Select how to automatically process infected files.
    Choose how to automatically process infected system files.
    Click the Schedule button to confirm the settings.

    Hope this is of help.
     
    Last edited: Aug 23, 2008
  6. EdP

    EdP Registered Member

    Joined:
    Mar 18, 2004
    Posts:
    83
    Thanks for all the responses and the solutions - Avast is very new to me, so it's appreciated.

    This leads to another question ....
    Avast moved the offending file to the Chest, but it never indicated that it cleaned up what the offending file did. How do I know if it removed the effects of the file's execution so I can determine what, if any, further actions to take?

    There's nothing in the logs to indicate anything other than a Warning that the signature was found in the file which I referenced in my first post.

    Thanks
    EdP
     
  7. gery

    gery Registered Member

    Joined:
    Mar 8, 2008
    Posts:
    1,785
    rhat is true and the downside of the free version
     
  8. Kerodo

    Kerodo Registered Member

    Joined:
    Oct 5, 2004
    Posts:
    7,780
    That's the risk you take with the clean up after the fact approach, as opposed to catching it before it executes... I personally never trust ANY software to clean up a virus or malware. I always restore an image to be sure.

    Although I can't say for sure, my guess is that it didn't do any further cleanup other than to remove the offending file. Some AVs do, and some don't. You might ask at the Avast forum for clarification if nobody here knows for sure..
     
  9. EdP

    EdP Registered Member

    Joined:
    Mar 18, 2004
    Posts:
    83
    This may be only peripherally relevant to my original post, but I thought it might be useful to report.

    I'm using Avast on what will soon become my secondary PC; my new PC has NOD32. While I haven't completed setting up the new PC, several days ago I copied the bulk of my files to it which included the file containing the Trojan that Avast found.

    I connected the new PC to the 'net for the first time, updated NOD32, and did a thorough scan of both drives and all partitions. No malware.

    I'm far from an expert on AV apps, but based on what I've read about them, I prefer to believe Avast reported a false positive rather than believe NOD32 missed a Win32:Agent Trojan.

    But I've been wrong before. ;)

    Thanks again for all the responses.
    EdP
     
  10. Tarq57

    Tarq57 Registered Member

    Joined:
    Oct 7, 2006
    Posts:
    966
    Location:
    Wellington NZ
    EdP, why not upload the file concerned to VirusTotal to get a better idea of whether it's a FP.
    Win 32: Agent Trojan is a fairly generic sort of name. Might be a FP. Or it might be for real. They all miss one from time to time. Maybe even NOD.
    I use Avast, and get the occasional FP. Not often enough to be even close to a nuisance.
     
  11. EdP

    EdP Registered Member

    Joined:
    Mar 18, 2004
    Posts:
    83
    Thanks, Tarq ...

    Shall do - I wasn't aware of VirusTotal

    EdP
     
  12. EdP

    EdP Registered Member

    Joined:
    Mar 18, 2004
    Posts:
    83
    ooops ... premature transmission

    Of the 32 AV apps, only Avast and Ikarus reported that the subject file has the Win32:Agent-AXG virus.

    EdP
     
  13. Tarq57

    Tarq57 Registered Member

    Joined:
    Oct 7, 2006
    Posts:
    966
    Location:
    Wellington NZ
    Gotta watch out for those premature t... never mind.
    A search on this forum indicates that the Ikarus engine seems to be good, but also tends to have above average FP's. A report from av-comparatives.org confirms this.
    Might be wise to report this to Avast.
     
  14. hex_614

    hex_614 Registered Member

    Joined:
    Jul 17, 2008
    Posts:
    155
    Location:
    Manila, Philippines
    yes avast did has lots of false positive. that's proven for the past 2 months
     
Loading...
Thread Status:
Not open for further replies.