Suspicious file found in rootkit hidden process "C:\windows\system32.\ils.dll"

Avast Free Antivirus / Premium Security
1

I have avast pro latest version. today a warning popped up showing that there’s a suspicious file found in rootkit hidden process : “C:\windows\system32.\ils.dll”.
I think it’s a false positive : I searched in google and other sites, the file is authentic.
and this the report of virstotal site :
http://www.virustotal.com/fr/analisis/106adb90b408e372ad7fd3ff22af087e
I didn’t delete it and avast recommended to run scan boot but I haven’t yet. I need to make sure it’s not a false positive.

2

I went to the file “ils.dll” and scanned it but avast detects nothing about it?! I don’t understand what’s wrong!!!

3

Same case here, on Windows XP. Details:
File: C:\windows\system32\ils.dll
OS: Windows XP SP3 (greek)
File version: 5.1.2600.5512
MD5Sum of the file: bd51ab8c4dbdb5ec2b28c613687fcbd8

@Nourine: I’d suggest to press “Ignore” but also check the “Submit the file to …” option. Seems like a false positive.

4

thanks Maleas! I did. I hope I can find a solution as soon as possible, because I’m not the only user of this computer, my sisters use it, too. and they don’t know much about viruses and computer. they would have immediately deleted it if they had found it.

5

Hi,

First post :slight_smile:

Same thing here. Shortly after booting up this morning I got the “suspicious hidden file found” warning.

I’m ultra paranoid when it comes to internet security so I’m going to assume that this is a FP?

6

one more thing, I checked the log viewer and found in warning :

15/12/2008 10:32 1229337133 SYSTEM 1128 Function setifaceUpdatePackages() has failed. Return code is 0x20000006, dwRes is 20000006.
15/12/2008 10:49 1229338167 SYSTEM 1128 Function setifaceUpdatePackages() has failed. Return code is 0x20000006, dwRes is 20000006.
???
I think the problem started after the today’s update, because the database has been updated at 10:20 this morning.

7

The problem should be fixed in a few minutes (with a new VPS update).

8

Thanks, I had I the same problem and run boot scan, but Avast found nothing, all is clear. Glad that you will fix problem so quick! I am extremly satisified with Avast! I was saved 6 times in last year by it! Thanks also for free licence key!

9

Also got ils.dll being flagged as bad. Unable to get on here for a while, kept getting “TRy Later”. In the meanwhile did a boot scan - nothing, submitted the dll to Virus Total - 0/38 and finally zipped and submitted to avast vie email.
Having now read this will wait for the next definitions update and re-scan the file.

10

thanks. vps has already updated I will restart and see.

11

:slight_smile: I’m glad to say that I’m satisfied with avast, too

12

the same prb here.

13

Morning igor and all,

The 2nd update today seems to have fixed this quirk.
Thanks for the prompt fix.
Regards,
2harts4ever

14

sorry, my mistake… it’s a false positive… fixed VPS should be available already…

15

this morning I have had the same problem >:( >:( >:(. now I have the 081215-1 version of the VPS. The problem has been resolved? ???

16

same file, same problem, at 13.52 avast sent a new update, may be the problem has been fixed.
DO NOT ELIMINATE THE FILE.

17

all we make errors ;D

18

the problem was solved by the vps?
???

19

with VPS 081215-1, the problem is fixed :slight_smile:

20

yes, no more pop-up concerning ils.dll in system32
:slight_smile: :slight_smile: :slight_smile: :slight_smile: :slight_smile: :slight_smile: