Avast found 2 rootkits (unsure of whether they've been removed)

Viruses and worms
1

Forgive me if I seem a little naive on this, I’m not techy when it comes to viruses and malware. Basically, yesterday night, soon after logging into my laptop, Avast alerted me of two or three rootkits and prompted me to restart to remove them. I restarted, and it initiated a scan with a black screen and white text. I then remembered that I didn’t have much power left in my laptop so I bypassed the scan with ‘esc’ and shut down my laptop and went to bed (I was tired at the time).

Anyway I logged on today, and did a scan with avast, it detected nothing though. Then I went to quarantine and noticed the following item.

Name: cachesrvr.exe
Original Location: C:/Program Files/Hewlett-Packard/Simpl…
Transfer Time: (here it said yesterday)
Virus: Win64:Rootkit-gen [Rtk]

So that must of got put there recently, then I went to scan history and noticed that it said 3 infected items were found in a quick scan dated yesterday. Although when I clicked ‘view details’ only two items showed so I’m guessing the item in quarantine was one that was removed? Anyway, the following two items show in the scan results now.

File Name: C:/Program Files/Hewlett-Packard/…/cachesrvr.exe
Severity: High
Status: Threat: Rootkit: hidden file

File Name: SVC: Cachedrv server > C:/…/cachesrvr.exe
Severity: High
Status: Threat:Win64:Rootkit-gen [Rtk]

After seeing these, I selected actions for each of them then applied. First I selected ‘Fix Automatically’ for each of them, then after restarting, I saw they were still there. Then I tried ‘Move to Chest’ but after it restarting, they were still there. Then came ‘Delete’ and they were still even there after that, and neither of these two rootkits have been added to my quarantine yet. They just remain in the scan results for the quick scan from yesterday.

So I don’t know what to do now, I’d very much appreciate some help.

2
File Name: C:/Program Files/[b]Hewlett-Packard[/b]/.../[b]cachesrvr.exe[/b]
Seems to be False Positive as it is a file that belongs to HP

Upload and test the file here www.virustotal.com if tested before click rescan. Post link to scan result here

3

Hello, thank you for the reply.

I went to that site and attempted to find the file to upload. I looked in the exact location that the avast results said it’d be, only to find that the file wasn’t in fact there. Could it be that the ‘delete’ action I took last time actually did remove it? Because I initially thought that if the file was deleted, then it would no longer appear in the last scan results with different option on what you can do with it. Is this true?

But so I can’t seem to find that one, what about the other file, does that seem like it could pose a threat?

4

try this

How to see hidden files in Windows. http://www.bleepingcomputer.com/tutorials/how-to-see-hidden-files-in-windows/

5

After changing the settings to show all hidden files by following the instructions, I went to attempt to find the file again but it is still not there. The closest file name I can find is Cachedrv.dll, but there’s no still no sign of cachesrvr.exe