Avast just found Win32:VBCrypt-CSL [Trj] during a full scan in NTUSER.DAT. I then ran a boot time scan that came back clean. I re-ran the full scan and it once again found the trojan. However Avast cannot repair this file since it is in use - I believe it is part of the windows registry. MalwareBytes Anti-Malware did not find this in a scan.
1) Why would the boot scan not find it and the standard scan find it?
2) How do I know if this is a false positive?
3) How do I go about backuping up and cleaning this file?
I attached the report from the scans.
Thanks