Windows 7 Service pack 1 installed. Virus warning is a FALSE POSITIVE

[SamT]

Yah I had posted that the program update had fixed the issue. BUT it started to come back about 5 mins after I posted. I unistalled Avast and used Microsoft's free antivirus. Problem solved.

[slybo]

Just wanted to make sure people noticed I did stop getting the alert by putting it in the file shield and program settings exclusions. Also wanted to add under windows explorer there are two files one x86 and the other AMD64.

[MrGoogalabonza]

Doing this will take several minutes, but seems to restore all of the previous Windows updates which were overwritten by Service Pack 1.

Will take a lot more than minutes for most people, plus it's a huge overkill for something that can be easily fixed by a simple virus definitions update.

I agree, I wouldn't recommend un-installing SP1.

[mikeb12]

for those of you using avast and wanting the new Win7 sp1, available now through autoupdates:

Until avast gets on the ball and rectifies this issue, then this is a temp solution to get rid of the annoying virus alert messages.

[Hermite15]

Yeah I guess too many files from .net 4 possibly involved are detected as FPs, meaning that you can't easily exclude them from Avast, and you're better off disabling temporally the service.

[filc]

Good call Mikeb!

[mikeb12]

Yeah I guess too many files from .net 4 possibly involved are detected as FPs, meaning that you can't easily exclude them from Avast, and you're better off disabling temporally the service.

I had no idea you were an avid user here, Logos.  Hey old buddy!

[justinlee]

I have the same problem. I take it this should be added to the exclusions?

[stevieo63]

I received the same multiple pop-up trojan warnings from avast. Windows 7 SP and Avast  were simultaneously downloading when it occurred the first time.  I think i eventually updated my virus definitions 3 times and updated the avast program itself 3 times (the last time it said it was already up-to-date) before the pop-ups stopped.  I also ran my Superantispyware program.
Good luck. 

[mikeb12]

one more time for those that didn't see it ....

for those of you using avast and wanting the new Win7 sp1, available now through autoupdates:

Until avast gets on the ball and rectifies this issue, then this is a temp solution to get rid of the annoying virus alert messages.

[DavidR]

Well in this topic there now appears to be three different files being detected, what the OP reported mscorlib.dll and that is further complicated with the fact that there are different versions (file sizes, 1,552KB and 4,444KB) and 5 different file locations on a search on my win7 SP1 netbook system. A scan of those locations doesn't get any alerts.

The other file plopana is mentioning mscorsvw.exe, may well not be covered in this VPS Update, so has anyone sent it off for analysis as an FP. I only have one instance of this file 65KB but not in the windows\assembly folder mne if in the windows\winsxs folder and also comes up clean

Also mscorlib.ni.exe the win32:spyeye-bg one and it seems this file gets created on the fly so it isn't permanent and being detected when created. This one prior to the latest VPS update (below) did alert but subsequently couldn't find the file (I didn't send to chest but blocked).

There has just been another VPS Update, 110302-0

~~~~
Edit: it also happens for .net 2.0 also:
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll [L] Win32:Spyeye-BG [Trj] (0)

[Erebus]

There has just been another VPS Update, 110302-0

Does that fix the FP issue?

[filc]

David,

Is there anything we can do for you to help facilitate a resolution? I'd be happy to share any information on my system you request.

[DavidR]

I haven't had a recurrence, but it would have to be triggered by the use of .net framework and the problem is only on my win7 SP1 netbook, which isn't in regular use.

So I can't really test it, but for a VPS update to come out this early in the day or rather released at 23:31:52 (01/03/2011 when the VPS version is 110302-0 (02/03/2011) it has to be related as it has come out very quick.

[doktornotor]

The other file plopana is mentioning mscorsvw.exe, may well not be covered in this VPS Update, so has anyone sent it off for analysis as an FP. I only have one instance of this file 65KB but not in the windows\assembly folder mne if in the windows\winsxs folder and also comes up clean

I don't think anyone reported mscorsvw.exe (the infamous .NET Runtime Optimization Service) binary to trigger a false positive. People were just reporting that it's eating their CPU for lunch. Yeah, it completely sucks, been like that for ages.