Avast WEBforum

Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: wile_e on August 01, 2010, 07:45:47 PM

Title: PlayOn rootkit?
Post by: wile_e on August 01, 2010, 07:45:47 PM

I just finished installing the new version of PlayOn software on my Win7 PC. During installation, Avast found hidden rootkit. It doesn't show filename. It just says "C:\Program Files", Rootkit: hidden service.

Is this a false positive with PlayOn? Or was Avast doing a real-time background scan and found something else?

Title: Re: PlayOn rootkit?
Post by: Adam Riley on August 02, 2010, 10:10:12 AM

Hi wile_e

I would suggest that you run a full scan to see if anything is found on your system now; if you think that something could be a false positive you can check it at jotti: http://virusscan.jotti.org/en-gb

Best,
Adam

Title: Re: PlayOn rootkit?
Post by: DavidR on August 02, 2010, 04:47:59 PM

I'm not a fan of Jotti as a) I believe it uses the unix/linux version of avast and b) it has far less scanners than VirusTotals 41 of them.

You could also check the offending/suspect file at: VirusTotal - Multi engine on-line virus scanner (http://www.virustotal.com/) and report the findings here the URL in the Address bar of the VT results page. You can't do this with the file securely in the chest, you need to extract it to a temporary (not original) location first, see below.

Create a folder called Suspect in the C:\ drive. Now exclude that folder in the File System Shield, Expert Settings, Exclusions, Add, type (or copy and paste) C:\Suspect\*
That will stop the File System Shield scanning any file you put in that folder.

Title: Re: PlayOn rootkit?
Post by: Asyn on August 02, 2010, 07:39:16 PM

Quote from: DavidR on August 02, 2010, 04:47:59 PM

I believe it uses the unix/linux version of avast

That's right..!!
Here's another alternative: http://www.virscan.org/
asyn