Avast [Confirmed!] F/P 'rootkit' on sfloppy.sys

Question

I just had avast [definitions 111206-0] alert me to an alleged rootkit (hidden file) in c:\windows\system32\drivers\sfloppy.sys   [this file is Microsoft's SCSI Floppy Driver] given the choices of remove ('recommended') and ignore, I've opted to ignore [and furthermore, to bypass a bootup scan], so that I could investigate the matter further. the file is identical in content to a copy located in  c:\windows\system32\dllcache the file appears 'clean', per virus total http://www.virustotal.com/file-scan/report.html?id=ceec0067514555d5ca489f50e3d7562fca8db8e952c3c878604c9277fc77959f-1323172857 it's noted on that page that 3 other 'anonymous' avast users have also reported this file as being detected as a rootkit today. there is also a thread about this in the avast forum http://forum.avast.com/index.php?topic=89963.0 I would suggest avast users take note of this thread, and proceed accordingly, until we get an official verdict from avast. EDIT:   1) Initial reports seem to indicate that this issue is ocurring on XP systems [but not Win7].  2) be advised that avast runs its rootkit scan approximate 8 minutes AFTER the system boots up, so that's when the alert suddenly pops up.

iroc9555 · Answer

Confirmed as F/P by Milos. Avast Team. Fix with update VPS 111206-2 or late. http://forum.avast.com/index.php?topic=89963.msg716205#msg716205 Regards

GreatNorthWeb · Answer

Ditto for me, so I make it #5 today?  At this point I am treating this as a False Positive based upon my intuition after reading this Avast thread: http://forum.avast.com/index.php?topic=89968.0

jmamike · Answer

Confirmed as F/P by Milos. Avast Team. Fix with update VPS 111206-2 or late. http://forum.avast.com/index.php?topic=89963.msg716205#msg716205 Regards  avast has change the virus defination database.

iroc9555 · Answer

Jmamike welcome to DeLL Forum.

Old post almost one month.

avast has change the virus defination database.

What do you mean ? Avast! fixed it December 6, 2011 with VPS 111206-2. Sfloppy.sys is no longer detected as a rootkit. Nothing new has been reported in Avast! Forum.

Bugbatter · Answer

It appears that posts with outdated information need to be locked.

jmamike · Answer

sfloppy.sys rootkit problem had been reported as avast false positives. This problem had been fixed by avast.

iroc9555 · Answer

sfloppy.sys rootkit problem had been reported as avast false positives. This problem had been fixed by avast.

Jmamike that was reported and the title of post was change to ( Confirmed ) by Ky331 a month ago. Also your link is blocked by my security programs.

" spywareremovalhelp.org "

Is reported red by WOT: http://www.mywot.com/en/scorecard/spywareremovalhelp.org

I advise other forum members not to click this link since it is not clear why WOT has it as dangerous.

Virus & Spyware

Was this post helpful?