Author Topic: Windows 7 Service pack 1 installed. Virus warning is a FALSE POSITIVE  (Read 51773 times)

0 Members and 1 Guest are viewing this topic.

Offline wltj

  • Newbie
  • *
  • Posts: 3
Re: Windows 7 Service pack 1 installed a virus?
« Reply #30 on: March 02, 2011, 12:27:14 AM »
NoordZee update your avast program and definitions and see if its still happening.

After updating program and definitions I rescanned c:/windows/Microsoft.NET folder and no threats were found. Thinking the update might have cleared the false positive I extracted mscorlib.dll from the virus chest back into c:/windows/Microsoft.NET and rescan and the same threat was detected. I updated program and virus definitions again and did a reboot thorough scan, which returned:



virustotal.com says its a FP. Is everyone sure avast stopped reporting this as a threat for them or is it just bc its in the Chest? I had like 32 copies of it in mine.

Offline plopana

  • Newbie
  • *
  • Posts: 1
Re: Windows 7 Service pack 1 installed a virus?
« Reply #31 on: March 02, 2011, 12:32:54 AM »
Same problem heare!!!:):)

Object:  C:\Windows\assembly\Native_v2050727...\mscorsw
Infection/; Win32.spyyey_BG[trj]

Aby ideas?????

Offline logos

  • Avast Überevangelist
  • Serious Graphoman
  • *****
  • Posts: 9441
Re: Windows 7 Service pack 1 installed a virus?
« Reply #32 on: March 02, 2011, 12:33:00 AM »
lucky me I haven't re-installed Avast yet. For unrelated reasons here I re-installed Windows yesterday and mscorsvw.exe ran at a 50% CPU load during half and hour, three times (see screen shot). First time was after the install of "MS .net framework 4 client profile" through Windows update, second time through a security update for it, and finally a new update of the same stuff included in SP1 >>> = 01:30h of CPU @ 50%.

 I ranted already about that on MS forum when the program was released. Just been told at the time that they were aware of that and it was wanted this way. Well as seen in task manager it's an optimization phase ;D

 Sorry for the off topic but it's still about the same file ;)
w7 - ais7

Offline wltj

  • Newbie
  • *
  • Posts: 3
Re: Windows 7 Service pack 1 installed a virus?
« Reply #33 on: March 02, 2011, 12:34:37 AM »
lucky me I haven't re-installed Avast yet. For unrelated reasons here I re-installed Windows yesterday and mscorsvw.exe ran at a 50% CPU load during half and hour, three times (see screen shot). First time was after the install of "MS .net framework 4 client profile" through Windows update, second time through a security update for it, and finally a new update of the same stuff included in SP1 >>> = 01:30h of CPU @ 50%.

 I ranted already about that on MS forum when the program was released. Just been told at the time that they were aware of that and it was wanted this way. Well as seen in task manager it's an optimization phase ;D

 Sorry for the off topic but it's still about the same file ;)

Do you have a link to that thread on the ms forum?

Offline NoordZee

  • Jr. Member
  • **
  • Posts: 20
Re: Windows 7 Service pack 1 installed a virus?
« Reply #34 on: March 02, 2011, 12:35:20 AM »
filc, thank you.  I am completely up to date but still went through the motions.  When my computer restarted, the same message came up again.  I believe that the only way we all can be sure that this particular file is not picked up as a Trojan is for Avast technicians to incorporate a 'cure' in the next update.  As a matter of further interest, when I tried to restore the two files that reside in the Virus Chest, a message came up that the file in question is already in existence and would I like to replace it or overwrite it.  Hm....!

Offline logos

  • Avast Überevangelist
  • Serious Graphoman
  • *****
  • Posts: 9441
Re: Windows 7 Service pack 1 installed a virus?
« Reply #35 on: March 02, 2011, 12:37:24 AM »
lucky me I haven't re-installed Avast yet. For unrelated reasons here I re-installed Windows yesterday and mscorsvw.exe ran at a 50% CPU load during half and hour, three times (see screen shot). First time was after the install of "MS .net framework 4 client profile" through Windows update, second time through a security update for it, and finally a new update of the same stuff included in SP1 >>> = 01:30h of CPU @ 50%.

 I ranted already about that on MS forum when the program was released. Just been told at the time that they were aware of that and it was wanted this way. Well as seen in task manager it's an optimization phase ;D

 Sorry for the off topic but it's still about the same file ;)

Do you have a link to that thread on the ms forum?

http://social.technet.microsoft.com/Forums/en-US/w7itproui/thread/90f044b6-e48f-4d05-898d-bc2ea56f2837

(was related to .net 3.5 at the time)
w7 - ais7

doktornotor

  • Guest
Re: Windows 7 Service pack 1 installed a virus?
« Reply #36 on: March 02, 2011, 12:40:15 AM »
May I ask why moving the file to chest fails and it's hard deleted instead? Not exactly happy with the whole thing getting recompiled over and over again - which drains CPU like hell because of broken M$ .Net code. (For those who wonder - the CPU usage ain't any fault of Avast, the "optimization" utility is just that shitty.)  >:(

And no, 110301-2 virus definitions don't fix it, in fact this version caused the issue here.
« Last Edit: March 02, 2011, 12:42:33 AM by doktornotor »

Offline maxle

  • Jr. Member
  • **
  • Posts: 20
Re: Windows 7 Service pack 1 installed a virus?
« Reply #37 on: March 02, 2011, 12:43:26 AM »
And no, 110301-2 virus definitions don't fix it, in fact this version caused the issue here.
[/quote]
Doktornotor, I agree with you.

Offline logos

  • Avast Überevangelist
  • Serious Graphoman
  • *****
  • Posts: 9441
Re: Windows 7 Service pack 1 installed a virus?
« Reply #38 on: March 02, 2011, 12:45:13 AM »
I wouldn't mind if the OP of this thread corrected the title, making it clear that it's obviously an FP.
w7 - ais7

Offline MrGoogalabonza

  • Newbie
  • *
  • Posts: 2
Re: Windows 7 Service pack 1 installed a virus?
« Reply #39 on: March 02, 2011, 01:15:03 AM »
Anyone who is still suffering from this problem can get temporary relief by uninstalling Service Pack 1.  That was the only thing I could do to stop the constant pop ups.  You can do this by going into the Control Panel, Programs and Features, click on View Installed Updates, and scroll down to the Microsoft Windows section.  Right Click on Service Pack 1 and select Uninstall.  Doing this will take several minutes, but seems to restore all of the previous Windows updates which were overwritten by Service Pack 1.

Offline filc

  • Newbie
  • *
  • Posts: 9
Re: Windows 7 Service pack 1 installed a virus?
« Reply #40 on: March 02, 2011, 01:18:13 AM »
I wouldn't mind if the OP of this thread corrected the title, making it clear that it's obviously an FP.
Updated to, Windows 7 Service pack 1 installed. Virus warning is a FALSE POSITIVE


doktornotor

  • Guest
Re: Windows 7 Service pack 1 installed a virus?
« Reply #41 on: March 02, 2011, 01:19:30 AM »
Doing this will take several minutes, but seems to restore all of the previous Windows updates which were overwritten by Service Pack 1.

Will take a lot more than minutes for most people, plus it's a huge overkill for something that can be easily fixed by a simple virus definitions update.

Offline filc

  • Newbie
  • *
  • Posts: 9
Re: Windows 7 Service pack 1 installed a virus?
« Reply #42 on: March 02, 2011, 01:20:52 AM »
Doing this will take several minutes, but seems to restore all of the previous Windows updates which were overwritten by Service Pack 1.

Will take a lot more than minutes for most people, plus it's a huge overkill for something that can be easily fixed by a simple virus definitions update.
I agree, I wouldn't recommend un-installing SP1.

Offline slybo

  • Sr. Member
  • ****
  • Posts: 327
Re: Windows 7 Service pack 1 installed a virus?
« Reply #43 on: March 02, 2011, 01:21:56 AM »
I am also having the same problem and had updates to 110301-2. The file that shows in the chest is C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a and listed as Win32:Spyeye-BG [Trj]. I extracted it to a folder to send to Virus Total and it shows in that folder as mscorlib.ni.dll. It picked it up a second time so to get it to stop I put it in the exclusions of the file shield and the main program settings  under exclusions. When I look under windows explorer I find the file under C:Windows\assembly\mscorlib, not the way it is listed in the chest. Also Virus Total only showed one hit out of 42. Just wanted to add all this in case it helps. sly

Offline logos

  • Avast Überevangelist
  • Serious Graphoman
  • *****
  • Posts: 9441
Re: Windows 7 Service pack 1 installed a virus?
« Reply #44 on: March 02, 2011, 01:22:28 AM »
I wouldn't mind if the OP of this thread corrected the title, making it clear that it's obviously an FP.
Updated to, Windows 7 Service pack 1 installed. Virus warning is a FALSE POSITIVE



nice thx ;)
w7 - ais7