Beta 9.0.2005 and mbamswissarmy.sys

Viruses and worms
1

I tried Microsoft updates this morning and some people including me are having problems with them hanging at 32%, it failed and windows had to recover. So I decided to use my macrium reflect and go back to Sunday. I had to redo some things. I did Avast Beta 9.0.2004 to 9.0.2005. Then I updated my Malwarebytes Antimalware deffs, I have the latest program 1.75.1300, When I did I got Avast finding the rootkit mbamswissarmy.sys. I remembered reading about this being false positive so selected ignore and after looking through the forum this appears to be a false positive. The only thing I could find afterwards in Avast was in C:\ProgramData\Avast Software\Avast\Log\Event Log here is what it had

10/9/2013 6:08:20 AM AAVM - scanning error: x_AavmCheckFileDirectEx: avfilesScanReal of SVC: MBAMSwissArmy > C:\Windows\system32\drivers\mbamswissarmy.sys failed, C000003B.
10/9/2013 6:08:20 AM AAVM - scanning warning: x_AavmCheckFileDirectEx: SVC: MBAMSwissArmy > C:\Windows\system32\drivers\mbamswissarmy.sys (*RAW:SVC: MBAMSwissArmy > C:\Windows\system32\drivers\mbamswissarmy.sys) returning error, C000003B.
10/9/2013 6:09:27 AM Internal error has occurred in module basSubmitFile failed! , function 0000007B.

I just have some questions. Do I have anything to worry about? Is this the only place to find information in Avast after a rootkit? Since I hit ignore, if I do a scan will it still be there because I looked under C:\windows\system32\drivers and do not find the file mbamswissarmy.sys, why not? Any information will be good, I feel there is nothing to worry about but want to check here. Thanks

2

I ran the Malwarebytes Rootkit program and it found nothing, if this helps, just downloaded and updated to be sure it was the latest. sly

3

OK, I think I found my answer. Did a search of Malwarebytes forum and found that this is a file only created while doing a scan with MBAM. I was only updating so for some reason it got created. I only use the free MBAM so it is not always running and I disable Avast when doing a scan. I always update MBAM with Avast enabled. Not sure why this time got a hit unless it is because of using the Avast new beta. So I am sure I do not have a problem unless somebody here know something I do not. Also started a scan so file would be created, made a copy of file to my documents and uploaded to Virus Total and got 0 hits. Thanks sly