Delete Quarantine Folder?

Couldn't have said it better.

 

And similar advice about multiple realtime scanners is also mentioned on the Avira Forums, where it appears you were also seeking assistance for this issue.

 

I really think it's in your best interest to use only Norton.

 

Best Wishes.

Message Edited by Phil_D on 05-26-2009 09:19 PM

Hi -

 

Here is some information about that:

 


ADSPY/Gdown is a trojan that monitors internet activities on infected computers and display advertisements based on the gathered data. ADSPY/GDOWN can also redirect web browsers and the homepage on the compromised computer.

 

Damage level: LOW

 

Adware: Gdown

 

Systems affected: Windows.


 

Just in case.

 

:smileysurprised:

Message Edited by Compumind on 05-26-2009 09:12 PM

CommMajor101 -

 

The SOLUTION to your problem is to exclude Norton's Quarantine folder from Avira's scan and vise versa.  The files are locked away and can do no harm at the present.  This will allow the scanner to finish, clean your system (if possible) and not botch up anything.  Be careful that Avira does not want to delete or fix anything of Norton's and you will be fine.


Compumind wrote:
...

ADSPY/Gdown is a trojan that monitors internet activities on infected computers and display advertisements based on the gathered data. ADSPY/GDOWN can also redirect web browsers and the homepage on the compromised computer.

 

...

 

So is any of this happening on your computer?  If not, then it seems likely that this is either a false positive or else it has been identified and contained by Norton under a different name.  This type of infection does NOT sit dormant.  You either have it (and see it, except for the very short time it takes to propogate itself) or you don't.

Hi -

 

Regarding dbrisendine's post -

 

I understand what you are saying, but what about the software internals (of both programs) conflicting?

 

It's worth a test, though!

 

:smileyhappy:

Message Edited by Compumind on 05-26-2009 09:24 PM

Years and years ago, I actually had McAfee and Norton on the same computer, back before they checked for each other's presence (now, each refuses to install when the other is onboard, and more power to them).  That was a marriage made in Hades!  I had more problems than I ever dreamed of and even uninstalling was a nightmare, because the uninstalling of one product simulated the behavior of malware to the other product.  By the time I was done, there was such corruption on my computer that I couldn't get the remaining program to work right again, and I mean ever, or at least until I reformatted and reimaged my computer.

 

Now I have an image for you, comp.

 

Pretend you are a business hiring a security firm to patrol your premises and keep out intruders.  The firm runs its own random sweeps as well as scheduled ones and has set up an identification program for its guards.  Now your vice-president suggests that you back them up with another security firm.  Heck, two is twice as good as one.  The firm he suggests also has their own random sweeps and scheduled ones, and their own unique identification program.  Each firm will behave independently and unaware of the other because each is using proprietary techniques.

 

How long do you think it will take before some innocent guard gets killed?

Ok, I am understanding what you guys are saying about the tug of war these two programs are doing.  I’m afraid that if I uninstall Avira that the virus I do have on my computer will go undetected (since Avira is the only program detecting it). If it’s not being detected my other programs, should I even worry about it that much?


CommMajor101 wrote:
Ok, I am understanding what you guys are saying about the tug of war these two programs are doing.  I'm afraid that if I uninstall Avira that the virus I do have on my computer will go undetected (since Avira is the only program detecting it). If it's not being detected my other programs, should I even worry about it that much?

How long has it been detected on your computer?  Hours, days, weeks?

 

Seriously, if it has been on your computer for more than a couple of reboots (these malware do a lot of their damage with each new reboot) and you haven't experienced its pop-up ads, then I really think it is either not really there (false positive by Avira) or in quarantine already by Norton.

 

Avira should have told you what file it sees as the culprit.  Have you found the file and had it checked by Norton?  If you can't find it, then it is almost certainly hidden in quarantine.

You have not said where this virus is yet.  I would do as I suggested so the scan can finish and located the file(s) in question with the virus.  If this is Norton’ definitions files then remove Avira, if not then clean the virus out and leave them alone. 

Hi CommMajor101 -

 

Why don't you just uninstall Avira in Safe Mode, reboot and then run a Full System Scan in NIS 2009, while disconnected from the internet and back in Safe Mode again?

 

Let's start at the most basic level and see what happens.

 

:smileyindifferent:

Please disable system restore should you choose to go this route.


Compumind wrote:

Hi CommMajor101 -

 

Why don't you just uninstall Avira in Safe Mode, reboot and then run a Full System Scan in NIS 2009, while disconnected from the internet and back in Safe Mode again?

 

Let's start at the most basic level and see what happens.

 

:smileyindifferent:


Why?

 

Comm has had no problem running a scan with NIS.  It's Avira that locks up.

 

Assuming Comm was really infected with that worm (which I think he isn't), then it isn't his connection to the internet that will be a problem so much as each reboot.  I don't know this worm in particular, but the general class of this kind of infection has the property to embed itself deeper and deeper into the system with each reboot, using reboots the same a lot of installations do: to copy files at boot up into places it couldn't copy them after boot up.

 

I think the suggestion made by Delph is more important.  If there is an infection, find the root cause now, and see if it can be removed before a reboot allows it to settle in any deeper.

Message Edited by mijcar on 05-26-2009 07:49 PM

lol - ok, let me see if I can answer everyone's questions:

1) mijcar - this has been detected on my computer for about 2 weeks now; I've been too afraid to use the internet so I don't know if I am getting pop ups; the file being detected changes but the original file source is the same - it's in C:\WINDOWS\Temp - but the full file name changes. I don't know what you mean by have I had it checked by Norton. I've done scans and Norton doesn't detect it.

2) dbrisendine - How do I exclude Norton's quarantine folder from Avira? 

3) Compumind - I do not have NIS 2009 - only whatever version came with my like 5 year old Dell (I recently did a system restore, so that's the version of Norton that I have).

 

Ok, so I removed Avira from my computer and I'm going to run a full Norton scan, although, I have in the past and it hasn't detected anything. But I'll let cha know what the results are from the Norton scan.

 

Thanks again for all the posts, this is the best response I've ever gotten in a website help forum before! 

Hit liveupdate first and get the latest definitions, disable system restore and disconnect from the internet. 

Hi CommMajor101 -

 

You said:

 


Compumind - I do not have NIS 2009 - only whatever version came with my like 5 year old Dell (I recently did a system restore, so that's the version of Norton that I have).


 

Wait! Could you *please* tell us what Norton product you have and the version?

 

TIA

 

:smileysurprised:

Message Edited by Compumind on 05-26-2009 10:05 PM

Ok, well immediate update - my subscription has expired - lol. Guess I can just remove Norton then. What will happen to the Quarantine folder after I uninstall Norton?

Gone.


CommMajor101 wrote:

lol - ok, let me see if I can answer everyone's questions:

1) mijcar - this has been detected on my computer for about 2 weeks now; I've been too afraid to use the internet so I don't know if I am getting pop ups; the file being detected changes but the original file source is the same - it's in C:\WINDOWS\Temp - but the full file name changes. I don't know what you mean by have I had it checked by Norton. I've done scans and Norton doesn't detect it.

2) dbrisendine - How do I exclude Norton's quarantine folder from Avira? 

3) Compumind - I do not have NIS 2009 - only whatever version came with my like 5 year old Dell (I recently did a system restore, so that's the version of Norton that I have).

 

Ok, so I removed Avira from my computer and I'm going to run a full Norton scan, although, I have in the past and it hasn't detected anything. But I'll let cha know what the results are from the Norton scan.

 

Thanks again for all the posts, this is the best response I've ever gotten in a website help forum before! 


First, a big OMG!

 

Your Norton is so out-of-date.  It's search engine doesn't even compare to the current one (which is faster, less intrusive, and more  comprehensive in its scanning).  This week you can get NIS 2009 (three user version) for free from Office Depot, so I suggest you check it out asap. In the meantime to stay protected, download the free trial version of NIS 2009 from the Symantec site.  Once you "buy" your product from Office Depot, you can use the activation key it comes with to convert your trial version to the full version.

 

Please don't delay.  All our assistance was predicated on your having an up-to-date product.  It is standard practice for one of us to ask about your product version, but somehow this slipped by us this time.

 

Okay.  To scan a particular file using Norton, right-click on the file and you will see the option to have it scanned by Norton.  There you go.

 

Two weeks is a long time.  If you've rebooted even three times over that period of time and you don't have any symptoms of infection, then you are probably clean.

 

The pop-ups we refer to are not from the internet.  They are from malware living on your computer.  They generally have some message about how your computer is infected and try to lead you to a dummy AV program.  If you click on the popup links, you are actually giving it permission to infect you.

 

All this is unmissable and if you'd been experiencing something like this, your posts here would have been substantially different.  :smileyvery-happy:

 

Good luck

Hi CommMajor101 -

 

Don't leave yourself unprotected while connected to the Internet!

 

Uninstall whatever version of Norton product that you have and do the free NIS 2009 Trial, ASAP.

 

The quarantine folders *should be deleted*  - we need to check.

 

You are probably already infected.

 

Do you have another computer to test with?

 

:smileysurprised:

Message Edited by Compumind on 05-26-2009 10:16 PM

Compumind wrote:
...You are probably already infected

Are you basing this on anything you have read in this thread?

 

I am very concerned about the use of FEAR when we communicate with the people who come asking for help.

 

Most people know very little about their computers and even less about malware.

 

They are already fearful and do not need to have that fear stirred up.  Calmness and good instructions will be a lot more useful to them and bring a lot more people to us in the long run.