html:script-inf [susp] - Detected on boot time scan only

[Mario147]

Hi everyone, Im kind of surprised by this, but when I run full system scan, then Avast find no threats. But as soon, as I run boot up scan [Only Disc C it seems], then Avast often find 10 - 40 "html:script-inf [susp]" files, mostly ending with gzip filename.

Any ideas how to get rid of them for good? Are they dangerous? Why they are detected only with boot up scan?

[DavidR]

There really isn't much to work with, e.g. File name and Location ?

What made you consider doing a boot-time scan  ?

Files flagged as [susp], suspicious and not necessarily malicious.

Avast Antivirus is an 'on-access antivirus scanner' e.g. if a file is active then the file system shield will scan it before it is allowed to run.  If it is a web site or an email then the Web or Mail Shield/s would scan that activity.

On-demand scans, of which the Boot-Time is one scans all files in the locations you have chosen.  These files for the most part are dormant (not presenting an immediate risk), as I said if they became active then the active On-access scanners would intercept and scan.

[Mario147]

I used a website called kukaj.to to watch movies and series for a long time without any issues at all, but recently avast went berserk mode on the site. Owners even mentioned that they are aware of the issue and said that Avast is just hypersensitive, so they suggested disabling web shield. Well, I foolishly did so and then my conscience went hard on me, so I did all the possible tests with those weird results. I believe that all of the file locations are cache of firefox browser. Sadly I dont saw any more details, just the name of threat and location.

Weirdly enough I didnt visit the site since and I have my web shield on too, but the mentioned threat appeared again.

[DavidR]

A screenshot of the avast alert with the details option selected might help.

2 others considering this suspect - https://www.virustotal.com/gui/url/39f6298b00b590fd50d7fd15688af7eebe9999605ac73f20eb5daeef54aa5595?nocache=1
This considers the site insecure - https://en.internet.nl/site/kukaj.to/2732172/#
This considers the site of a Medium Security Risk - https://sitecheck.sucuri.net/results/kukaj.to - with hardening improvement suggestions.

There is no way I would disable the Web Shield on the say so of the site, this is your first line of defence.  Given what other site analysis reports are giving security issues/improvements suggested.

Clear the firefox browser cache and cookies would be a good start.

[mchain]

Default setting of Avast boot-time scan is to scan Drive C: only.