pivot.sys from PortraitDisplays as a false positive

Avast Free Antivirus / Premium Security
1

I’m running Avast 8.0.1497 on XP-SP3 machine with a Samsung display rotated 90° and using PivotPro from PortraitDisplay v.7.61 to do that (OEM). A couple of days ago Avast started to delete pivot.sys from system32/drivers causing a real mess in my display setup. The file was identified as a malware but was clearly a false positive. I was forced to reinstall a recent Reflect image to have the system properly working and disable automatic definition file update in order to maintain 130907-0 that works smooth. Placing the pivot.sys file in Global Exclusion do not solve the problem.
Anyone else?

2

Hello,
send us (virus@avast.com) the file to analyze, please. Put “False positive” to email subject.

Milos

3

I have a similar problem, except Avast deleted all my startup executables (like mouse, keyboard drivers, defrag, dropbox, truecrypt, firewall etc). So, in a way, you’re actually lucky :slight_smile:

As Milos said, send them those files, but for now I’d recommend uninstalling your avast and installing the previous version (I think it was .1489)

4

Just done, thanks

5

I suspect the misbehaviour is not related to program version but to definition file. I’m currently running 8.0.1497 with 130907-0 with no problem, as before.

6

I hope it’s true, but I had already survived 3 definition file updates and it still kept deleting files.

7

Hello,
did you send the files to virus@avast.com to analyze?

Milos

8

Yes of course :slight_smile: I have created a separate topic here for my case and have gotten quite a few responses and hints, received no answer as to why this could’ve happened (except for “for some reason, it treats those unrelated files as a virus”), and what is avast doing to prevent such cases and deletions in the future.

I am now running newest avast with newest AVS and so far so good.

9

An update

I manually updated the definition file this morning (after a Reflect partition image just to avoid any hassle) just to see if the problem I encountered with pivot.sys from Portrait Displays was fixed.
The definition file is 928-0 now and the pivot.sys is not recognized as a malware anymore (927.1 was good as well).