Author Topic: 2 Rootkits/hidden files + Win32:BHO-AMO [PUP]; are they dangerous??  (Read 3744 times)

0 Members and 1 Guest are viewing this topic.

LadyA

  • Guest
Been using Avast for a few years and this is the first time anything has ever shown up in a scan for me. I'm pretty computer literate, except when it comes to viruses and what is and isn't one (and how to handle them). I'm safe on the computer and don't click or download things willy-nilly.

To start at the beginning, I did a routine full scan and it returned two things that were labeled as HIGH threats/rootkits. I can't figure out where the actual full text scan logs are in this new version of Avast, otherwise I would share it here. All I can seem to find is the 'detailed report' and I've taken a screen shot of that:


So after I saw that, even though the names of the files didn't seem that suspicious to me (though I have no idea what they do), I selected 'fix automatically.' The computer then had to restart. Upon restart, I did another 'full scan' and it found the exact same two things. Not really knowing what to do, I chose 'repair' this time (even though I know that should've been part of 'fix automatically'), and then a window popped up and recommended that I do a 'boot-time scan.'

So I did a 'boot-time scan' and it returned one LOW risk PUP called Win32:BHO-AMO. When I google that, it looks like it is actually a trojan or something?? But the scan labels it 'low risk?' Here's a screen shot of that boot-time scan result:


So now, I'm looking for advice on what to do. Are any of these three things actually viruses or dangerous in any way? Or are they false positives or something? I have very little experience with this.

The Win32 PUP is currently in the virus chest... and I think the other two things (labeled as rootkits) must still be on my computer at this point?

Sorry for the lengthy post, I just wanted to be thorough.

Offline Pondus

  • Probably Bot
  • ****
  • Posts: 37698
Re: 2 Rootkits/hidden files + Win32:BHO-AMO [PUP]; are they dangerous??
« Reply #1 on: January 12, 2014, 03:17:37 AM »
The first two are in avast sandbox/safesone.... Reset it and they should Be gone

PUP = not virus / possible unwanted program
usually some browser crap you get when downloading freeware

LadyA

  • Guest
Re: 2 Rootkits/hidden files + Win32:BHO-AMO [PUP]; are they dangerous??
« Reply #2 on: January 12, 2014, 03:26:57 AM »
Thanks for the reply, Pondus! I figured out how to reset the SafeZone and did that. I'll run another scan and see if they've disappeared now.
But do you know anything about them, or why they came up as high risk threats?  Just so I know if it's something I can avoid in the future or if anything has been compromised? 'Rootkit' sounds sort of serious?

And should I just select 'delete' on that PUP then? (edit: actually, ya, I just deleted it... don't think I even still needed the original file or program it came from anyways)

Thanks again for the help!
« Last Edit: January 12, 2014, 03:31:28 AM by LadyA »

LadyA

  • Guest
Re: 2 Rootkits/hidden files + Win32:BHO-AMO [PUP]; are they dangerous??
« Reply #3 on: January 12, 2014, 06:42:39 AM »
After another full scan after resetting the SafeZone, it came back as no threats founds. Thanks again for the tip!

Still wondering what those 'rootkits' were to start with, or where they came from/why they were labeled as high risk? Just because they're not there anymore isn't quite as comforting as I thought it would be. Hope to find out more if anyone knows. Curious if they were actually viruses that have been on my computer since the last time I ran a scan.  I just recently started using the SafeZone browser for banking... and those viruses were actually stored there or something?  Sorry to be the annoying noob but if anyone can explain things to me, I'd be grateful. :)

Offline Pondus

  • Probably Bot
  • ****
  • Posts: 37698
Re: 2 Rootkits/hidden files + Win32:BHO-AMO [PUP]; are they dangerous??
« Reply #4 on: January 12, 2014, 12:55:31 PM »
If they where real threats or just False Positives i dont know ....anyway they where not in your computer but isolated in the sandbox

http://www.avast.com/faq.php?article=AVKB44#idt_16
http://www.avast.com/faq.php?article=AVKB17#artTitle