Jump to content
Posted 12 January 2008 - 05:18 PM
Posted 12 January 2008 - 06:58 PM
Edited by boopme, 12 January 2008 - 07:34 PM.
Posted 13 January 2008 - 06:14 PM
Posted 13 January 2008 - 06:59 PM
Posted 13 January 2008 - 07:34 PM
Posted 14 January 2008 - 07:18 AM
Posted 14 January 2008 - 09:52 AM
Posted 14 January 2008 - 02:05 PM
Edited by newbie666, 14 January 2008 - 02:10 PM.
Posted 14 January 2008 - 02:52 PM
Posted 14 January 2008 - 03:04 PM
Reported changes in system files such as kernel32.dll, wsock32.dll, user32.dll, shell32.dll and ntosknrl.exe are normal for AVG.
i have noticed that on the front screen of AVG under file its says Ntoskrnl. Under result/ infection it says change. Under path it says c:\windows\system32\Ntoskrnl.exe
kernel32.dll, wsock32.dll, user32.dll, shell32.dll and ntosknrl.exe have "changed"
There are many valid reasons for those files to show changed, a Windows update, file system check that replaced them if corrupted, and others. As long as AVG doesn't say they are infected it is ok. If it continues to show changed, delete the following file(s) in the C:\ directory and AVG will create a new one(s)...AVG7DB_F.DAT, AVG7QT.DAT
Changed File Alerts
It is normal that AVG shows that files, the MBR or Boot record to have changed. These are done during normal maintainance, when you or windows updates files or have had to correct errors on the drive. The only time that you should worry is if they also show as infected.
To get AVG to quit showing them as changed, open the AVG Test Center, click the F3 key on your keyboard and tell it to accept the changes. If it still shows something as changed after this.. delete the file named AVG7QT.DAT in the %ALLUSERSPROFILE%\Application Data\avg7\ folder and AVG will rebuild it the next time it is run.
The %ALLUSERSPROFILE% is different for each version of Windows. The following are the typical locations for XP and Win9x
XP - C:\Documents and Settings\All Users\Application Data\avg7
Win9x -C:\Windows\All Users\Application Data\avg7
Another method suggested by DEStucki to remove the MBR changed alert if the above method didn't help...
Go to the System Area Test settings
Select the "Remove MBR" button to remove the MBR from the list of items in the System Area test list
Click on OK so that the list has been up dated
Now go back into the System Area Test settings and push the "Default" button to put the MBR back in the list.
0 members, 0 guests, 0 anonymous users