A Rootkit was found! on Lenovo T60

[okovongo]

avast started reporting a rootkit a couple of weeks ago with "Delete now" and "Ignore" option. I have selected the "Delete now" option every time I get this message but it keeps coming back. I have also restored my hard drive from a previous backup from a couple of months ago when I did not get this message. The file name it thinks is suspicious is

"C:\Program Files\Lenovo\Rescue and Recovery\WAM.sys"

avast version 4.8 Home Edition Build 4.8.1169 is running on my machine.

Is this an actual virus or can I ignore it? Any help much appreciated. Peter

[oldman]

Everthing I read WAM.sys is legit. Part of a recovery program.

[okovongo]

thanks for the quick reply. just to confirm that what i read from your reply is that avast is incorrectly reporting this file as a rootkit and i can ignore it with the "Do not tell me about this rootkit in the future" checkbox checked?

[oldman]

Yes, I believe so. You could also try submitting the file to virustotal. I say try as it may not upload.

virustotal.com