Virus alert with AVG and HTMLPAD

Richard · Post by **Richard** » Thu Jun 01, 2006 9:47 am

The HTMLPad Icon is associated with a file A0074393.exe that is seen by my version of AVG to contain the WIN32.Tufik.A virus.. I believe this is a Sophos Variant. Bit Defender does not seem to see it.
This is in my System Volume Info\restore directory and even as admin, I can not get into it.. WinZip can not zip it even if I chose to Restore it to a desktop directory

Can you explain what it might be?? I am obviously a little concerned about the possibility of a virus from software I am thinking of paying for..

Another point about the Browser Preview Toolbar error mentioned elsewhere..
I get the same error, asking for the Mozilla Active X control whether I click on Firefox OR IE. However, I can run both from the Menu bar.. Odd??

Post by **chrisjlocke** » Thu Jun 01, 2006 10:43 am

You won't be able to get into the System Volume Information directory, as its purely a system directory. You can clear the restore points which live in here by turning off System Restore, and turning it back on again.

The trial of the software is 'clean' (I've Sophos this end) and its installed fine - I presume its the trial you've downloaded and not the registered version?

I doubt the trial would be infected, otherwise other people would have noticed by now too.

Richard · Post by **Richard** » Sun Jun 04, 2006 12:12 pm

Thanks for reply..
Trial version.
AVG allows the user to Restore a suspect file to a directory of choice in order to process it further. It is this file that WinZip can not process, read or meaningfuly do anything to..

Why would the Restore file look like a virus??
How would it get in there, seemingly from the official site download?

Any thought on the Menu versus Preview bar difference?

Post by **Karlis** » Sun Jun 04, 2006 2:13 pm

This is surely a problem in the Antivirus software, because HTMLPad surely does not interfere with other programs in any way and we have very high anti-virus protection levels set on our systems.

P.S. What is the preview bar? Do you mean preview toolbar?

Richard · Post by **Richard** » Wed Jun 07, 2006 2:29 pm

Unfortunately I can't upload the file to AVG cos Winzip won't read/zip it..
So I have rescanned after deleting and it has gone.. However there was a file as indicated.

Next Point.. Yes, I mean the Preview Toolbar (just above the working space window).
I have the latest Firefox and can't understand why I now have to download and fiddle with an Active X control in order to use WeBuilder..
& If it does not work from the Preview Bar, why does it work from Tools/Preview In.. This would seem to suggest the same function??

Richard

Post by **chrisjlocke** » Wed Jun 07, 2006 2:36 pm

Richard wrote:I have the latest Firefox and can't understand why I now have to download and fiddle with an Active X control in order to use WeBuilder..

Because the ActiveX control is a 'wrapper' around the Firefox 'engine' so it can be used in other applications, like WeBuilder. If you were designing a VB program for example, and wanted to incorporate IE, you would still need an ActiveX control, but your system already has this control installed - the Firefox control doesn't get installed by default (as 80% of people won't need it). Hope that makes sense.

If it does not work from the Preview Bar, why does it work from Tools/Preview In.. This would seem to suggest the same function??

They work differently though - the preview bar allows you to view a page from within WeBuilder. The 'Preview In' just fires up a Firefox browser, so you're not viewing it from within WeBuilder. Again, hope that makes sense.

Richard · Post by **Richard** » Mon Jul 03, 2006 6:04 am

Thanks for that Chris..
Have been away from the machine for a while and so missed your kind response..
Well, next thing then..
I have down loaded the mozilla activeX, which is in a .exe form so what do I do now??
I can't "load" it cos it has to be in .dll format according to the HELP file which assumes it is "installed"
Daft question maybe.. But how do I install it??
Have tried clicking on it a few times, "Running" it under a CMD window and it just sits there like a sort of software lemon..

I've sucked it...
and I'm stuck...

help..

Post by **chrisjlocke** » Mon Jul 03, 2006 8:33 am

If you download this install, it is indeed an .exe:
http://download.blumentals.net/tools/Mo ... ol1712.exe

However, when you run it, it should start an installer, like this:

(Click thumbnail for larger pic)

Once that is run, it should all work.

Post by **Karlis** » Mon Jul 03, 2006 2:59 pm

Yes, Chris is right, simply run the setup.

Richard · Post by **Richard** » Mon Jul 03, 2006 4:45 pm

Thanks for that...
Obviously I know about running exes but this one won't..
I have now tried to download it three times. Twice with Windows default Download Dialog and once with FreshDownloader.
The windows dialog closes telling me that there is an error copying the file Access is denied and to make sure that the disk isn't full.
Well, I am the only user and admin of my machine and the disk is not full.
FreshDownload does a little better but does not complete the assembly of the file. It is not represented, in the download directory, by the complete icon and I get Windows can not access the File or Drive ... etc.
When I downloaded the WebBuilder that I bought earlier today I had no problem with FreshDownload (usually very fast and effective) but it did fall over with the GifAnimator Freebie...

There is obviously some bizzare compatibility problem here between your site and my computer.. Perhaps that accounts for the earlier reported "pseudo virus" (that I have just ignored, after your assurance

)

So what now???
Over to you...

Richard

Post by **chrisjlocke** » Mon Jul 03, 2006 4:57 pm

Are any of your disks running low on space? It may be trying to store the file in a temp folder which may be full. Not necessary a full disk, but a full folder. If you've squillions of temp files, that can cause problems.

Failing that, try downloading from SendSpace.
http://www.sendspace.com/file/z3bw9d

Richard · Post by **Richard** » Tue Jul 04, 2006 9:02 am

Hello again..
Problem completely solved....Almost..
After wasting a huge amount of sleep and many cups of coffee, I can tell you that the problem lies somewhere between your site and AVG antivirus. It was the failure to assemble the download packets that gave me the clue..
I am using the Free version and it is seeing those "virus" signatures again.
This was what appeared to be happening the first time with HTML pad but this time it seems to be in Mozillacontrol.exe..
However, uninstalling AVG allows me to download/copy from another machine download and RUN....

I will send you the file fragments that I have isolated that you may look at them for you own info.
Am also sending them to AVG to check out their Search techniques..

Thanks for efforts to help..

Richard · Post by **Richard** » Tue Jul 04, 2006 2:24 pm

Hello Karlis.. Have just sent this email to you,,
Following the discussion on the board, I was going to attach the files that seemed to be causing the problem..
I have just scanned them again and they look CLEAN.. (Hooray but WTF???) But I did do a fresh install and run an unattended Virus scan so they may have been cleaned.. Have downloaded again and it is also clean... this is very odd.. But at least it clearly shows that there is a problem in the antivirus programme..
Copy posted to the board so that others can see the good outcome.

Thanks Again
(A very neat programme and the control works well after all that too...

)
Regards

Richard

Post by **Karlis** » Wed Jul 05, 2006 10:59 pm

maybe faulty antivirus

Blumentals Software Community

Virus alert with AVG and HTMLPAD

Virus alert with AVG and HTMLPAD

Further..

Re: Further..

Ongoing problem...

FIXED.....