AVG Scan question

[nanna]

hey guys,

Lately, whenever I run an AVG Free virus scan, I get a few weird "changes." I'm wondering if these are things that I should be worried about.

AVG says that these are not viruses (They are all normal windows processes, except for the boot sector), but lists them as "change" which makes me think that there might be something wrong. Anyone out there know what this means, or have you experienced something similar? Let me know.

Just in case you need it, I'm running windows XP SP2, spybot scans every week, Ad-aware SE personal scans every week, spywareblaster, avg free (obviously), but my school gives symantic for free (with $XX,XXX tuition).

Thanks in advance.

-Nanna

[nellie2]

We would have to know what these changes were to give you a proper answer.. malware can/will make certain changes to your system, depending on the infection... but then so can installing a legitimate new program or loading some new drivers etc. AVG is just letting you know that these changes have been made but you need to decide whether they are expected or explainable or not.

[nanna]

How would I find out whether these are good changes or bad changes? AVG seems to give me no more information than "changed."

[nellie2]

Don't you just hate it when they do that!!

If your computer is running ok and you aren't having any problems then I wouldn't worry about it.

If you enable Spybots Teatimer then you can monitor and stop any potential malicious changes see here Winpatrol is also a good program to have running on your PC

[cozofdeath]

I know that when a program changes, even by one byte, it offset the crc which causes virus scanners and things of that nature to give a warning or notification. Like say your a programmer and you change a string saying "HELLO" to "HeLLO" and recompile the program it will seem like a totally different program to the virus scanner. If your updating or expecting a change like this its ok but it really helps to know what files/services are being changed. If there only changing when a scan is ran I would assume a virus but theres a slim chance it could be something else. Many viruses will change there chosen executable only to change it when a scan is run or reconfigure a service to avoid detection. If you only have AVG I would suggest a using another malware scanner with a rootkit scanner. Many people don't know or care that dozens of rootkits are released/found everyday and they are becoming a popular thing among infections. I'm guessing there is going to be another explosion since news hit there are at least 3 more ways to successfully hide them unknowingly to any RK scanner. But this is just my opinion, many of the experienced malware hunters on here have dealt more with this kind of stuff and can probably help more.

[Alan2273]

It is normal that AVG shows that files, the MBR or Boot record to have changed. These are done during normal maintainance, when you or windows updates files or have had to correct errors on the drive. The only time that you should worry is if they also show as infected.

To get AVG to quit showing them as changed, open the AVG Test Center, click the F3 key on your keyboard and tell it to accept the changes. If it still shows something as changed after this.. delete the file named AVG7QT.DAT in C:\ and AVG will rebuild it the next time it is run.

[nanna]

cozofdeath: Thanks for the reply. What program would you recommend in addition to what I have going now?

Currently: AVG, Spybot (I use it at least 4 times a week to "check for problems"), Ad-Aware SE personal (twice a week), and spywareblaster.

Alan2273: Thanks to you too. Your response together with cozofdeath's were exactly the confirmation I needed. Also, thank you for telling me how to get them to stop showing up on my scans. They were annoying.