Suspicious file found in rootkit hidden process

Avast Free Antivirus / Premium Security
1

Hi, I am a complete novice, but like others on this forum I’m having ‘Suspicious files found in rootkit hidden process’ errors when running the Avast. One example of the many suspicious files:

windows\system32\spoolsv.exe\drivers\w32x86\2\ppbiUif.dll

I have updated to build 4.8.1296 with vps 081214.0. XP SP3 machine (not an Acer PC).

I have read through the various threads which talk about these suspicious files and frankly I’m confused. I have carried out the reboot scan ect but the problem still exists. Yes the files have been sent to Avast for study.

The problem only seemed to come to light after updating to build 4.8.1296 if that helps.

Please can you advise what I need to do to rectify,

atb mrwobbly

2

Avast is detecting as false positives some drivers on Acer computers.
Hope they can review the antirootkit scanning soon and help all the users that are experiencing problems with it…

I suppose that file, when submitted to www.virustotal.com, returns clean…

3

Try updating avast again. The latest definitions is: 081215-1

There were some false positives being detected in ‘rootkit’ scan.

4

this is another kind of error, which was seen on some Acer computers… Vlk tried to resolve it, but i don’t know the current status…

5

i am also a novice and can’t find where I am supposed to post my message.
I am trying to down load Avast on my MS. windows 98. I am getting a message that an error has occured because there isn’t enough storage. I have 3.5GB of hard disk free so I wonder what it means?

6

Please start a New Topic of your own as this seems unrelated to the original subject and will just confuse the topic and we will try to help. - Go to this link, http://forum.avast.com/index.php, scroll down to the avast! 4.x Home/Pro forum and click it, click the New Topic button at the top of the list and post there.

7

:slight_smile:

8

Hi Rick F, have already updated both program and vps to the latest levels 4.8.1296 and 081215-1 and the problem still exists when running a scan!!!

Both my laptop and PC, NIETHER of which are Acer machines.

Still not sure how to get rid of this problem or if my pc/laptop are safe to use. Being disabled i use them for on-line banking etc.

Do we have a resolution for this error, which looking at the forum seems to be growing in number of those people affected???

atb tim

9

I, too, have updated VPS, manually. The summary says: VPS Already up to date - Current version (081215-1)

When checking my Log viewer under ‘Notice’, it doesn’t reflect this update. It still reads 081215-0 as the last entry. I’ve rebooted and am still getting the ‘Suspicious File Found’ notice. Why is the update not showing in the log? What else should I try? Thanks in advance.

10

Don’t post twice the same. Just double the help effort.

11

Sorry, just looking for some answers.

12

Not sure what your problem is if you don’t have an Acer machine. Sorry.

13

I get the same problem with ‘suspicious’ rootkit files being reported and I don’t have an Acer either. (Have an ASUS laptop) The scan also seems to freeze at different stages too, then tells me a virus has been found in memory and to do a boot scan. Do that but it always comes up clean.
I think it is a problem with build 1296. Hoping they sort it out.