osloader.exe , virus or false positive ?

Viruses and worms
1

Hi guys,
My ADMN update, my all Avast Managed Client and all XP SP3 warn me about osloader.exe as “Win32:Rootkit-gen [Rtk]”

avast! [MATNEONAT2] : Fichier “C:\WINDOWS\I386\OSLOADER.EX_\osloader.exe” est infecté par “Win32:Rootkit-gen [Rtk]” virus.
avast! [MATCPT7]: File “C:\System Volume Information_restore{710D4334-C5EB-486B-A158-108DCE57CE71}\RP317\A0045243.exe\i386\osloader.ex_\osloader.exe”
avast! [MATCPT6] : Fichier “C:\Documents and Settings\Administrateur\Bureau\WindowsXP-KB936929-SP3-x86-FRA.exe\i386\osloader.ex_osloader.exe” was infected by “Win32:Rootkit-gen [Rtk]” virus.

VPS is 081209-1, 09/12/2008

so, virus or false positive ?

2

On virustotal, osloader.exe give this result

hnLab-V3 2008.12.10.2 2008.12.10 -
AntiVir 7.9.0.43 2008.12.10 -
Authentium 5.1.0.4 2008.12.10 -
Avast 4.8.1281.0 2008.12.10 Win32:Rootkit-gen
AVG 8.0.0.199 2008.12.10 -
BitDefender 7.2 2008.12.10 -
CAT-QuickHeal 10.00 2008.12.10 -
ClamAV 0.94.1 2008.12.10 -
Comodo 718 2008.12.10 -
DrWeb 4.44.0.09170 2008.12.10 -
eSafe 7.0.17.0 2008.12.09 -
eTrust-Vet 31.6.6253 2008.12.10 -
Ewido 4.0 2008.12.10 -
F-Prot 4.4.4.56 2008.12.10 -
F-Secure 8.0.14332.0 2008.12.10 -
Fortinet 3.117.0.0 2008.12.10 -
GData 19 2008.12.10 Win32:Rootkit-gen
Ikarus T3.1.1.45.0 2008.12.10 -
K7AntiVirus 7.10.549 2008.12.09 -
Kaspersky 7.0.0.125 2008.12.10 -
McAfee 5459 2008.12.09 -
McAfee+Artemis 5459 2008.12.09 -
Microsoft 1.4205 2008.12.10 -
NOD32 3681 2008.12.10 -
Norman 5.80.02 2008.12.09 -
Panda 9.0.0.4 2008.12.09 -
PCTools 4.4.2.0 2008.12.10 -
Prevx1 V2 2008.12.10 -
Rising 21.07.22.00 2008.12.10 -
SecureWeb-Gateway 6.7.6 2008.12.10 -
Sophos 4.36.0 2008.12.10 -
Sunbelt 3.2.1801.2 2008.12.10 -
Symantec 10 2008.12.10 -
TheHacker 6.3.1.2.182 2008.12.10 -
TrendMicro 8.700.0.1004 2008.12.10 -
VBA32 3.12.8.10 2008.12.09 -
ViRobot 2008.12.10.1511 2008.12.10 -
VirusBuster 4.5.11.0 2008.12.09 -
Information additionnelle
File size: 232448 bytes
MD5…: fa0880985fece30bce40fa7fae38229f
SHA1…: 00046a9a19d7a237d8a1b9c2fbe6d44266d4d398
SHA256: 38a1e39663050f0cdd58dcccb37bdec92d211b09704b0c0145b119f812878ee8
SHA512: d72f0ddf489ad2d95a0378d12a5b5c8faf83635572d9248aaed63af202da0ca2
36fffb60e64a7f506d17b70f1c017e0da5f484af4748420a27e966a36f438d3f
ssdeep: 6144:EruzuGg2fWvILrp4mSeMDRX5xnraZmU3DG5gUBlQd52EJO1AJeG0vm9an:I
N3Krp+NX5VraZmU3DG5gUBlQd52EJOB
PEiD…: -
TrID…: File type identification
Win32 Executable Generic (68.0%)
Generic Win/DOS Executable (15.9%)
DOS Executable Generic (15.9%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)

3

File osloader.exe (version 5.1.2600.5512) is falsely detected. Detection will be fixed in next VPS update. If you have this file in another version please send it in password protected archive to virus@avast.com