FAQ

Please try to update your AVG Anti-Virus system and run the AVG Complete Test again. If the file is not detected and you are still in doubt, please put the file into password protected archive (using WinZip, WinRar, PowerArchiver etc.), and send this archive to our e-mail address virus@avg.com. In the body of the message, please describe why are you sending the file and include the password for the archive.

A Trojan Horse is a malicious application, which can not spread itself. Original Trojan Horses were programs which acted as a useful utility. Although, in fact, their start used to cause damage to disc content (or part of it).

At the present time the most spreading Trojan Horses are BackDoor Trojans. They enable remote access to infected computers and PSW (Password Stealers) - they are trying to gather as much private information from the infected computer as possible and to send the info through the Internet.

To remove the Trojan Horse, it is enough to delete the detected file.

Most of today's viruses (Trojan horses, I-Worms, Worms, etc) create their own files which contain nothing but a body of the virus. In such cases the only way to remove the infection is to delete the infected file. When you moved the file to the AVG Virus Vault it was deleted from its original location, coded, and then saved in a non-executable file in a hidden folder. Your PC is no longer infected then.
If you are not missing any data file and your applications are running, then you can delete these vaulted files from the AVG Virus Vault program.

You can do it selectively from AVG Virus Vault program -> select files -> delete. Or you can delete all AVG Virus Vault contents in one go: - Open the AVG Control Center program -> right click on "AVG Virus Vault" tab -> choose "Empty vault".

Note that files removed from your e-mails are also moved to the AVG Virus Vault. If you do not have a content filter set, then these files are infected and can be removed, as shown above. If you have set a content filter, then you should decide what to do with the vaulted files.
If you want, you can set automatic actions in the AVG Virus Vault. Please open the AVG Virus Vault program -> "Service" menu -> "Program setting". Here you can set any required automatic actions.

Windows Safe Mode is a way to boot up the Windows operating system in order to let you troubleshoot or run administrative and diagnostic tasks. When it is booted into Safe Mode the operating system only loads the minimum software that is required for the operating system to work. Only basic video drivers are loaded so your programs may look different than normal.

Operation:

• Restart your computer.
• Immediately after "Starting Windows..." information is displayed, press the F8 key on your keyboard.
• Select the Safe Mode option from the menu using the arrow keys.
• Then press Enter on your keyboard to boot into Safe Mode.
  

VCLEANER.EXE can be used for removing some specific viruses and their variants. Full list of infections the VCleaner can heal is available in the download section.

Use:

Download the vcleaner.exe and run it on the infected computer.
Note: Some viruses can stop the action during the removing process. In this case rename the vcleaner.exe to some different exe file (e.g. something.exe). Restart your computer in Safe mode (recommended) and run the remover on the infected computer.
Other removal tools are available on web page Downloads-Utilities.

AVG gives the following message: Warning: hidden extension . exe

Some viruses hide themselves by doubling their file extension. For example, the VBS/Iloveyou virus attaches a file, ILOVEYOU.TXT.VBS, to e-mails. The default Windows setting is to hide known extensions, so the file looks like ILOVEYOU.TXT. When you open it you do not open a .TXT text file but instead execute a .VBS script file.

Because of the increased use of this technique we have added detection of the double file extension into AVG. Of course there are cases of valid, harmless double extensions, e.g. uninstall.rar.bat, which is part of some installations of the RAR compression utility.

• Please check the Virus Encyclopedia web page and search for the exact name of virus mentioned in the test result.
• If you are not successful, please contact the technical support and also send us an export of the latest test result:
  

Please run AVG program (basic or advanced interface) and choose Test Results from Results menu (you can also use F6 key to get the same). Now you can see the list of finished tests, double click the latest one (by date) and you will get the full list of detected viruses (if there were any), including the path, the name and status of infected object. When it is opened, go back to main AVG program screen -> Program menu -> Export... item (or you can user Ctrl+S shortcut to get Save as... option). Please send us this file for further analysis.

Files placed in the System volume information folder are source files for the system restore function that is available in Windows XP operating system. Files that were healed were moved in their original INFECTED state into this folder and it is necessary to DELETE them by following these steps:

• Close all open programs. Then right-click My Computer on the Windows desktop
• Click on Properties
• Click on the System Restore tab
• Check Turn off System Restore on all drives
• Restart the system
• Go through the first four steps again and uncheck the item mentioned in step 4.

Strange behavior of Internet Explorer on your PC (automatic pop-up of web pages with suspicious or commercial content) or automatic redirection of your home page to another one (again with some problematic or suspicious content) may not be caused by the presence of a virus but another malware also known as ADWARE or SPYWARE.

These kinds of malware can not be clasified as viruses, which is the reason why they are not detected by anti-virus programs.
In case you do not have AVG Anti-Malware or AVG Internet Security edition (both of which contain the Anti-Spyware component), we recommend you to use standalone AVG Anti-Spyware 7.5 which is designed to detect and remove this type of malware.
You can download it here: http://www.avg.com/doc/programs.

The first and most important information is the EXACT NAME of a VIRUS (as reported by AVG) and the path to the infected file(s). Information about the most dangerous viruses you can find in the Virus Encyclopaedia.