Author Topic: Windows 7 Service pack 1 installed. Virus warning is a FALSE POSITIVE  (Read 59528 times)

0 Members and 1 Guest are viewing this topic.

SamT

  • Guest
Re: Windows 7 Service pack 1 installed a virus?
« Reply #45 on: March 02, 2011, 01:24:22 AM »
Yah I had posted that the program update had fixed the issue. BUT it started to come back about 5 mins after I posted. I unistalled Avast and used Microsoft's free antivirus. Problem solved.

slybo

  • Guest
Re: Windows 7 Service pack 1 installed. Virus warning is a FALSE POSITIVE
« Reply #46 on: March 02, 2011, 01:24:44 AM »
Just wanted to make sure people noticed I did stop getting the alert by putting it in the file shield and program settings exclusions. Also wanted to add under windows explorer there are two files one x86 and the other AMD64.
« Last Edit: March 02, 2011, 01:28:59 AM by slybo »

MrGoogalabonza

  • Guest
Re: Windows 7 Service pack 1 installed a virus?
« Reply #47 on: March 02, 2011, 01:25:03 AM »
Doing this will take several minutes, but seems to restore all of the previous Windows updates which were overwritten by Service Pack 1.

Will take a lot more than minutes for most people, plus it's a huge overkill for something that can be easily fixed by a simple virus definitions update.
I agree, I wouldn't recommend un-installing SP1.

mikeb12

  • Guest
Re: Windows 7 Service pack 1 installed a virus?
« Reply #48 on: March 02, 2011, 01:27:20 AM »
for those of you using avast and wanting the new Win7 sp1, available now through autoupdates:

Until avast gets on the ball and rectifies this issue, then this is a temp solution to get rid of the annoying virus alert messages.

« Last Edit: March 02, 2011, 01:58:28 AM by mikeb12 »

Hermite15

  • Guest
Re: Windows 7 Service pack 1 installed. Virus warning is a FALSE POSITIVE
« Reply #49 on: March 02, 2011, 01:34:52 AM »
Yeah I guess too many files from .net 4 possibly involved are detected as FPs, meaning that you can't easily exclude them from Avast, and you're better off disabling temporally the service.

filc

  • Guest
Re: Windows 7 Service pack 1 installed. Virus warning is a FALSE POSITIVE
« Reply #50 on: March 02, 2011, 01:40:57 AM »
Good call Mikeb!

mikeb12

  • Guest
Re: Windows 7 Service pack 1 installed. Virus warning is a FALSE POSITIVE
« Reply #51 on: March 02, 2011, 01:42:38 AM »
Yeah I guess too many files from .net 4 possibly involved are detected as FPs, meaning that you can't easily exclude them from Avast, and you're better off disabling temporally the service.
I had no idea you were an avid user here, Logos.  Hey old buddy!

Offline justinlee

  • Poster
  • *
  • Posts: 400
Re: Windows 7 Service pack 1 installed. Virus warning is a FALSE POSITIVE
« Reply #52 on: March 02, 2011, 01:48:18 AM »
I have the same problem. I take it this should be added to the exclusions?
Windows 7 Home Premium (64-bit) SP1,
Intel Core i5-2410M @2.30GHz, 6GB RAM
AvastFree Antivirus & ZoneAlarm Free.

stevieo63

  • Guest
Re: Windows 7 Service pack 1 installed. Virus warning is a FALSE POSITIVE
« Reply #53 on: March 02, 2011, 01:55:02 AM »

I received the same multiple pop-up trojan warnings from avast. Windows 7 SP and Avast  were simultaneously downloading when it occurred the first time.  I think i eventually updated my virus definitions 3 times and updated the avast program itself 3 times (the last time it said it was already up-to-date) before the pop-ups stopped.  I also ran my Superantispyware program.
Good luck.  :-\

mikeb12

  • Guest
Re: Windows 7 Service pack 1 installed a virus?
« Reply #54 on: March 02, 2011, 01:58:44 AM »
one more time for those that didn't see it ....
for those of you using avast and wanting the new Win7 sp1, available now through autoupdates:

Until avast gets on the ball and rectifies this issue, then this is a temp solution to get rid of the annoying virus alert messages.



Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 88895
  • No support PMs thanks
Re: Windows 7 Service pack 1 installed a virus?
« Reply #55 on: March 02, 2011, 02:03:12 AM »
Well in this topic there now appears to be three different files being detected, what the OP reported mscorlib.dll and that is further complicated with the fact that there are different versions (file sizes, 1,552KB and 4,444KB) and 5 different file locations on a search on my win7 SP1 netbook system. A scan of those locations doesn't get any alerts.

The other file plopana is mentioning mscorsvw.exe, may well not be covered in this VPS Update, so has anyone sent it off for analysis as an FP. I only have one instance of this file 65KB but not in the windows\assembly folder mne if in the windows\winsxs folder and also comes up clean

Also mscorlib.ni.exe the win32:spyeye-bg one and it seems this file gets created on the fly so it isn't permanent and being detected when created. This one prior to the latest VPS update (below) did alert but subsequently couldn't find the file (I didn't send to chest but blocked).

There has just been another VPS Update, 110302-0

~~~~
Edit: it also happens for .net 2.0 also:
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll [L] Win32:Spyeye-BG [Trj] (0)
« Last Edit: March 02, 2011, 02:11:21 AM by DavidR »
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.2.6105 (build 24.2.8918.824) UI 1.0.799/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Erebus

  • Guest
Re: Windows 7 Service pack 1 installed a virus?
« Reply #56 on: March 02, 2011, 02:05:42 AM »
There has just been another VPS Update, 110302-0


Does that fix the FP issue?

filc

  • Guest
Re: Windows 7 Service pack 1 installed. Virus warning is a FALSE POSITIVE
« Reply #57 on: March 02, 2011, 02:17:37 AM »
David,

Is there anything we can do for you to help facilitate a resolution? I'd be happy to share any information on my system you request.

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 88895
  • No support PMs thanks
Re: Windows 7 Service pack 1 installed. Virus warning is a FALSE POSITIVE
« Reply #58 on: March 02, 2011, 02:20:30 AM »
I haven't had a recurrence, but it would have to be triggered by the use of .net framework and the problem is only on my win7 SP1 netbook, which isn't in regular use.

So I can't really test it, but for a VPS update to come out this early in the day or rather released at 23:31:52 (01/03/2011 when the VPS version is 110302-0 (02/03/2011) it has to be related as it has come out very quick.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.2.6105 (build 24.2.8918.824) UI 1.0.799/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

doktornotor

  • Guest
Re: Windows 7 Service pack 1 installed a virus?
« Reply #59 on: March 02, 2011, 02:21:58 AM »
The other file plopana is mentioning mscorsvw.exe, may well not be covered in this VPS Update, so has anyone sent it off for analysis as an FP. I only have one instance of this file 65KB but not in the windows\assembly folder mne if in the windows\winsxs folder and also comes up clean

I don't think anyone reported mscorsvw.exe (the infamous .NET Runtime Optimization Service) binary to trigger a false positive. People were just reporting that it's eating their CPU for lunch. Yeah, it completely sucks, been like that for ages.