RootKit: Hidden File

Viruses and worms
1

I was installing RivaTuner (reputable graphics utility) and was prompted to update at the end of the installation. I cliked OK and it downloaded a 64 bit compatibility file (RivaTuner64.sys) which Avast flagged as a rootkit (Rootkit: Hidden File). Google turned up nothing related, and virustotal had zero detections. So after much deliberation I decide to ignore the warning and continue with the installation. I figured it was plausible that RivaTuner might have some rootkit type properties?? even though i really have no idea.

Anyway, it’s still haunting me so I rescanned the file and Avast didnt find anything. Would that be because I previously instructed it to ignore it? If so, how would I change it back so that it doesn’t? Also does anyone have any idea if the file is most likely legitimate due to it’s hardware monitoring properties?

Thank you.

2

always post link to scan result as it will give us lots of info…

you can report a possible false positive case to avast lab using one of these options

You can upload files and report issues to avast here : http://www.avast.com/contact-form.php (select subject according to Your case)

You can use mail
send to virus@avast.com in a password protected zip file
mail subject: False Positive / undetected sample (select subject according to your case)
zip password: infected

or you can send files from avast chest
how to use the chest. http://www.avast.com/faq.php?article=AVKB21