Avast - Probable F/P "rootkit" on sfloppy.sys

Started by ky331, December 06, 2011, 12:58:37 PM

Previous topic - Next topic

0 Members and 1 Guest are viewing this topic.

ky331

I just had avast [definitions 111206-0] alert me to an alleged rootkit (hidden file) in c:\windows\system32\drivers\sfloppy.sys   [this file is Microsoft's SCSI Floppy Driver]

given the choices of remove ("recommended") and ignore, I've opted to ignore [and furthermore, to bypass a bootup scan], so that I could investigate the matter further.

the file is identical in content to a copy located in  c:\windows\system32\dllcache

the file appears "clean", per virus total http://www.virustotal.com/file-scan/report.html?id=ceec0067514555d5ca489f50e3d7562fca8db8e952c3c878604c9277fc77959f-1323172857

it's noted on that page that 3 other "anonymous" avast users have also reported this file as being detected as a rootkit today.

there is also a thread about this in the avast forum http://forum.avast.com/index.php?topic=89963.0

I would suggest avast users take note of this thread, and proceed accordingly, until we get an official verdict from avast.

EDIT:   1) Initial reports seem to indicate that this issue is ocurring on XP systems [but not Win7].

2) be advised that avast runs its rootkit scan approximate 8 minutes AFTER the system boots up, so that's when the alert suddenly pops up.

ky331

Avast has confirmed the F/P.

The word is that the problem has been fixed with the release of VPS 111206-2 [but I am not at my avast system now to personally confirm].