Three FPs that keep popping up every time I do a boot scan

Viruses and worms
1

Hi, I use Windows 7 and the latest version of Avast Free 8, which is 8.0.1497.

The following three FPs keep getting detected every time I do a boot scan with heuristics set at normal:

C:\Users\Owner\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch

C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch

C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch

All three have a severity of Low and Status of PUP:Win32:Solimba-D[PUP]

It would be cool if the boot scan stopped picking those up, and thanks in advance for any action or replies!

P.S. I just submitted them to the Avast! virus lab as FPs.

2

Thank you for submitting them. The people from avast will have a look at them and when/if needed take action.
For your information, the latest version is 2014-RC3.

3

Is this answering some of your questions: http://stackoverflow.com/questions/533824/what-does-the-file-security-config-cch-do-with-the-clr
and for both flagged: http://www.itninja.com/question/enterprisesec-config-cch-and-security-config-cch (article poster = ikke)
as a pup detection is possibly unwanted you can also exclude these files, it is flagged as possible adware.
See: https://www.virustotal.com/nl/file/a682213c4051ca9850fcde9411ecaff109efbaa3f7ba8a56871b6d7670b86791/analysis/
Publisher and signer: Publisher Solimba Aplicaciones S.L. Are these virtual piano files???

polonus

4

Hi polonus, from what I gather, some downloader might have modified the files, which made Avast decide that said files are not completely kosher anymore.

Furthermore, those files will automatically be recreated next time a program uses .NET or CLR, so just tell Avast to delete them (not quarantine) and everything will be fine down the road. Did I come to the right conclusion?

Edit 10-17-13:

To update my impression, the CLR file is recreated, but the developers seem uncomfortable with deleting the .NET files.

5

Okay, here’s what finally happened: I got tired of having to ‘Ignore’ those every time I did a boot scan, so I went right ahead and selected ‘Fix’, resulting in them being deleted. The problem is, Microsoft Office Word Starter was then unable to load Word documents with a double click, accusing me of needing to register the full version.

In response to that, I went to Control Panel → Programs → Programs and features, right-clicked on the Microsoft.NET Framework 4.5 and selected ‘repair’, and since then everything has been peachy!

Prior to that I had uninstalled .NET and reinstalled it, but to no avail.

6
PUP:Win32:Solimba-D[[b]PUP[/b]]
PUP = not virus / Possible Unwanted Program

http://malwaretips.com/blogs/pup-optional-solimba-virus/