« previous next »
Pages: [1] 2 3 4   Go Down

Author Topic: sptd.sys likely a false positive  (Read 31585 times)

0 Members and 1 Guest are viewing this topic.

temp4746

  • Guest
sptd.sys likely a false positive
« on: May 31, 2011, 11:15:27 AM »
Avast! today mysteriously popped up a message saying that sptd.sys is a rootkit and after ignoring it, it popped another one which sayed the heuriestics identified it and then I saw it upload the file to Avast! during an update.

I think this is a false positive, sptd is a driver used by DuplexSecure used by some cd/dvd emulation software like Daemon Tools and Alcohol for a deeper emulation.
Logged

Offline Pondus

  • Probably Bot
  • ****
  • Posts: 37527
  • Not a avast user
Re: sptd.sys likely a false positive
« Reply #1 on: May 31, 2011, 11:27:49 AM »
upload suspicious file(s) to www.virustotal.com and test with 43 malware scanners
when you have the result, copy the url in the address bar and post it here for us to see

alternative
Jotti  http://virusscan.jotti.org/
VirSCAN  http://virscan.org/
Logged

Micky86

  • Guest
Re: sptd.sys likely a false positive
« Reply #2 on: May 31, 2011, 11:54:03 AM »
i have same problem this  :o

See screenshot:
Logged

temp4746

  • Guest
Re: sptd.sys likely a false positive
« Reply #3 on: May 31, 2011, 12:24:17 PM »
Quote from: Pondus on May 31, 2011, 11:27:49 AM
upload suspicious file(s) to www.virustotal.com and test with 43 malware scanners
when you have the result, copy the url in the address bar and post it here for us to see

alternative
Jotti  http://virusscan.jotti.org/
VirSCAN  http://virscan.org/

Here you go: http://www.virustotal.com/file-scan/report.html?id=ccac2cc44f90001da973d2b6e644ff37fa6c31c7a3abd936645382537fa63edd-1306837223

Had to use safe mode as it seems to be protected like a rootkit altough it isn't harmful or just loaded in the background so you can't touch it.
Logged

Offline Pondus

  • Probably Bot
  • ****
  • Posts: 37527
  • Not a avast user
Re: sptd.sys likely a false positive
« Reply #4 on: May 31, 2011, 12:33:11 PM »
jepp, looks like a FP to me



sigcheck:
publisher....: Duplex Secure Ltd.
copyright....: Copyright (C) 2004
product......: SCSI Pass Through Direct
description..: SCSI Pass Through Direct Host
original name: sptd.sys
internal name: SPTD.SYS
file version.: 1.76.0.0 built by: WinDDK
comments.....: n/a
signers......: Duplex Secure Ltd
 VeriSign Class 3 Code Signing 2009-2 CA
 Class 3 Public Primary Certification Authority
signing date.: 12:47 PM 11/23/2010
verified.....: -
« Last Edit: May 31, 2011, 12:34:57 PM by Pondus »
Logged

Offline Asyn

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 76037
    • >>> Avast Forum - Deutschsprachiger Bereich <<<
Re: sptd.sys likely a false positive
« Reply #5 on: May 31, 2011, 12:57:25 PM »
Logged
W8.1 [x64] - Avast Free AV 23.3.8047.BC [UI.757] - Firefox ESR 102.9 [NS/uBO/PB] - Thunderbird 102.9.1
Avast-Tools: Secure Browser 109.0 - Cleanup 23.1 - SecureLine 5.18 - DriverUpdater 23.1 - CCleaner 6.01
Avast Wissenswertes (Downloads, Anleitungen & Infos): https://forum.avast.com/index.php?topic=60523.0

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67194
Re: sptd.sys likely a false positive
« Reply #6 on: May 31, 2011, 01:22:35 PM »
Strange... you've got an alert while virus total shows nothing ???
Logged
The best things in life are free.

Offline Asyn

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 76037
    • >>> Avast Forum - Deutschsprachiger Bereich <<<
Re: sptd.sys likely a false positive
« Reply #7 on: May 31, 2011, 01:26:06 PM »
Quote from: Tech on May 31, 2011, 01:22:35 PM
Strange... you've got an alert while virus total shows nothing ???

Yep, it is strange...
Which VPS are you guys on..??
Try to update manually.
Solved..?
Logged
W8.1 [x64] - Avast Free AV 23.3.8047.BC [UI.757] - Firefox ESR 102.9 [NS/uBO/PB] - Thunderbird 102.9.1
Avast-Tools: Secure Browser 109.0 - Cleanup 23.1 - SecureLine 5.18 - DriverUpdater 23.1 - CCleaner 6.01
Avast Wissenswertes (Downloads, Anleitungen & Infos): https://forum.avast.com/index.php?topic=60523.0

temp4746

  • Guest
Re: sptd.sys likely a false positive
« Reply #8 on: May 31, 2011, 01:29:03 PM »
Quote from: Asyn on May 31, 2011, 01:26:06 PM
Quote from: Tech on May 31, 2011, 01:22:35 PM
Strange... you've got an alert while virus total shows nothing ???

Yep, it is strange...
Which VPS are you guys on..??
Try to update manually.
Solved..?


VPS: 110531-0 latest (ATM)
Manual update doesn't help.

The funny thing is scanning that file manually with Avast! shows it's not a virus it's only some monitor heuristic/rootkit heuristic that seems to not like that file.
Logged

Offline Asyn

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 76037
    • >>> Avast Forum - Deutschsprachiger Bereich <<<
Re: sptd.sys likely a false positive
« Reply #9 on: May 31, 2011, 01:36:30 PM »
Interesting...
You can report a possible FP here: http://www.avast.com/contact-form.php?loadStyles
Logged
W8.1 [x64] - Avast Free AV 23.3.8047.BC [UI.757] - Firefox ESR 102.9 [NS/uBO/PB] - Thunderbird 102.9.1
Avast-Tools: Secure Browser 109.0 - Cleanup 23.1 - SecureLine 5.18 - DriverUpdater 23.1 - CCleaner 6.01
Avast Wissenswertes (Downloads, Anleitungen & Infos): https://forum.avast.com/index.php?topic=60523.0

cadremis

  • Guest
Re: sptd.sys likely a false positive
« Reply #10 on: May 31, 2011, 02:43:36 PM »
It happened to me today, I installed Alchohol 3 days ago and this morning Avast said I had a rootkit and recommended to delete it and recommended a boot scan too, so I did it and nothing was found, but then I came here to see if someone else is having the same problem and I found this thread.

Is it a FP or not?

Logged

vordme34

  • Guest
Re: sptd.sys likely a false positive
« Reply #11 on: May 31, 2011, 02:45:08 PM »
Avast deleted it though I specifically ordered it to ignore it and to just send it to avast labs!! Wasn't able to upload to virustotal (don't know if avast was the reason for that or the file was self-protected). Way to go.. I guess my Alcohol and Daemon tools might not be working now, because this surely is a legitimate file of those programs. There has to be something wrong with the new sigs (mine were updated just a few minutes ago, before avast came up with the pop-up other users have posted).
Logged

cadremis

  • Guest
Re: sptd.sys likely a false positive
« Reply #12 on: May 31, 2011, 02:50:43 PM »
Guys,
What do I do? Avast is giving me pop ups everytime I re-start my computer with the same alert.

Logged

cadremis

  • Guest
Re: sptd.sys likely a false positive
« Reply #13 on: May 31, 2011, 02:54:46 PM »
Now another different pop up with the same alert

Logged

vordme34

  • Guest
Re: sptd.sys likely a false positive
« Reply #14 on: May 31, 2011, 02:55:05 PM »
@cadremis: Don't do anything until they fix their sigs!
I just told it to ignore it and it deleted the damned file. I now have to reinstall daemon tools and/or Alcohol 52..
Logged
Pages: [1] 2 3 4   Go Up
« previous next »