Windows 7 Service pack 1 installed. Virus warning is a FALSE POSITIVE

[wltj]

NoordZee update your avast program and definitions and see if its still happening.

After updating program and definitions I rescanned c:/windows/Microsoft.NET folder and no threats were found. Thinking the update might have cleared the false positive I extracted mscorlib.dll from the virus chest back into c:/windows/Microsoft.NET and rescan and the same threat was detected. I updated program and virus definitions again and did a reboot thorough scan, which returned:



virustotal.com says its a FP. Is everyone sure avast stopped reporting this as a threat for them or is it just bc its in the Chest? I had like 32 copies of it in mine.

[plopana]

Same problem heare!!!:)

Object:  C:\Windows\assembly\Native_v2050727...\mscorsw
Infection/; Win32.spyyey_BG[trj]

Aby ideas??

[Hermite15]

lucky me I haven't re-installed Avast yet. For unrelated reasons here I re-installed Windows yesterday and mscorsvw.exe ran at a 50% CPU load during half and hour, three times (see screen shot). First time was after the install of "MS .net framework 4 client profile" through Windows update, second time through a security update for it, and finally a new update of the same stuff included in SP1 >>> = 01:30h of CPU @ 50%.

 I ranted already about that on MS forum when the program was released. Just been told at the time that they were aware of that and it was wanted this way. Well as seen in task manager it's an optimization phase

 Sorry for the off topic but it's still about the same file

[wltj]

lucky me I haven't re-installed Avast yet. For unrelated reasons here I re-installed Windows yesterday and mscorsvw.exe ran at a 50% CPU load during half and hour, three times (see screen shot). First time was after the install of "MS .net framework 4 client profile" through Windows update, second time through a security update for it, and finally a new update of the same stuff included in SP1 >>> = 01:30h of CPU @ 50%.

 I ranted already about that on MS forum when the program was released. Just been told at the time that they were aware of that and it was wanted this way. Well as seen in task manager it's an optimization phase

 Sorry for the off topic but it's still about the same file

Do you have a link to that thread on the ms forum?

[NoordZee]

filc, thank you.  I am completely up to date but still went through the motions.  When my computer restarted, the same message came up again.  I believe that the only way we all can be sure that this particular file is not picked up as a Trojan is for Avast technicians to incorporate a 'cure' in the next update.  As a matter of further interest, when I tried to restore the two files that reside in the Virus Chest, a message came up that the file in question is already in existence and would I like to replace it or overwrite it.  Hm....!

[Hermite15]

lucky me I haven't re-installed Avast yet. For unrelated reasons here I re-installed Windows yesterday and mscorsvw.exe ran at a 50% CPU load during half and hour, three times (see screen shot). First time was after the install of "MS .net framework 4 client profile" through Windows update, second time through a security update for it, and finally a new update of the same stuff included in SP1 >>> = 01:30h of CPU @ 50%.

 I ranted already about that on MS forum when the program was released. Just been told at the time that they were aware of that and it was wanted this way. Well as seen in task manager it's an optimization phase

 Sorry for the off topic but it's still about the same file

Do you have a link to that thread on the ms forum?

http://social.technet.microsoft.com/Forums/en-US/w7itproui/thread/90f044b6-e48f-4d05-898d-bc2ea56f2837

(was related to .net 3.5 at the time)

[doktornotor]

May I ask why moving the file to chest fails and it's hard deleted instead? Not exactly happy with the whole thing getting recompiled over and over again - which drains CPU like hell because of broken M$ .Net code. (For those who wonder - the CPU usage ain't any fault of Avast, the "optimization" utility is just that shitty.)  

And no, 110301-2 virus definitions don't fix it, in fact this version caused the issue here.

[maxle]

And no, 110301-2 virus definitions don't fix it, in fact this version caused the issue here.
[/quote]
Doktornotor, I agree with you.

[Hermite15]

I wouldn't mind if the OP of this thread corrected the title, making it clear that it's obviously an FP.

[MrGoogalabonza]

Anyone who is still suffering from this problem can get temporary relief by uninstalling Service Pack 1.  That was the only thing I could do to stop the constant pop ups.  You can do this by going into the Control Panel, Programs and Features, click on View Installed Updates, and scroll down to the Microsoft Windows section.  Right Click on Service Pack 1 and select Uninstall.  Doing this will take several minutes, but seems to restore all of the previous Windows updates which were overwritten by Service Pack 1.

[filc]

I wouldn't mind if the OP of this thread corrected the title, making it clear that it's obviously an FP.

Updated to, Windows 7 Service pack 1 installed. Virus warning is a FALSE POSITIVE

[doktornotor]

Doing this will take several minutes, but seems to restore all of the previous Windows updates which were overwritten by Service Pack 1.

Will take a lot more than minutes for most people, plus it's a huge overkill for something that can be easily fixed by a simple virus definitions update.

[filc]

Doing this will take several minutes, but seems to restore all of the previous Windows updates which were overwritten by Service Pack 1.

Will take a lot more than minutes for most people, plus it's a huge overkill for something that can be easily fixed by a simple virus definitions update.

I agree, I wouldn't recommend un-installing SP1.

[slybo]

I am also having the same problem and had updates to 110301-2. The file that shows in the chest is C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a and listed as Win32:Spyeye-BG [Trj]. I extracted it to a folder to send to Virus Total and it shows in that folder as mscorlib.ni.dll. It picked it up a second time so to get it to stop I put it in the exclusions of the file shield and the main program settings  under exclusions. When I look under windows explorer I find the file under C:Windows\assembly\mscorlib, not the way it is listed in the chest. Also Virus Total only showed one hit out of 42. Just wanted to add all this in case it helps. sly

[Hermite15]

I wouldn't mind if the OP of this thread corrected the title, making it clear that it's obviously an FP.

Updated to, Windows 7 Service pack 1 installed. Virus warning is a FALSE POSITIVE

nice thx