Windows 7 Service pack 1 installed. Virus warning is a FALSE POSITIVE

Hi Folks,

I just installed SP1 for W7 and now it’s saying I have a virus.

Original file name: mscorlib.dll Original folder: c:\windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP9EFD.tmp Original size of file: 11490304 Last Modification Time: 3/1/2011 8:19:57 PM Time of transfer to Chest: 3/1/2011 1:19:58 PM Category: Infected files Virus Decsription: Win32:Spyeye-BG[Trj] File ID: 18

It’s annoying because the “Trojan Horse Blocked” message is spamming my desktop every few minutes. It says no further action is required but just keeps popping up!

Any thoughts?

Upload as a false positive from the chest

I get the exact same thing, I have installed SP1 on my work PC that is protected by Sophos and it went fine, used the same DVD to install, so it must be false…or the infection is only showing since sp1 update (if its real)…

I have no problems with SP1 myself so definitely comes under the heading weird

Lovely a false positive that keep coming back and back and back…

I don’t even get the time to fill in the feed-back form before another pops up again.

Ahh so I am not alone in this, thats good.

Hi

Have the same problem after installation of Service Pack 1 today.
I was able to fill the form. The information will be uploaded with the next virus definition update.
I put the link to this thread as additional information.
But I do not feel well to suppress the message :o. Is it really not an infected file downloaded from Microsoft? ???

Best regards
Paul

add another file to the list:
mscorlib.ni.dll

Same alert as the mscorlib.dll

For the record I am using Windows 7 x64 Ultimate
Avast! AIS6 installed (latest update)

Having the same exact issue as well… All After installing Windows 7 SP1, system was fine all day until I installed the service pack… Now nothing but alerts every 5 seconds…

Windows 7 x64 Ultimate
Avast Program Version: 6.0.1000
Virus Definitions: 110301-1

I just downloaded Windows 7 Service pak 1 and have the same problem. HELP!

Well, I am not NOT going to install SP1 on another PC I have. Else I might have another PC having issue’s in the end.

(Guess I will come back to the forum to see if it has been resolved or I might even read about it in the news… www.h-online.com might report it. They did so with other false possitive in the past too of other anti-virus vendors.)

Here is what you can do for now. Press the “PIN” on the top right next to the X on the warning dialog box. That at least will keep it from popping up every 30 seconds, but it will remain there. So you have to judge for yourself which is more annoying.

Then all we can do now is wait for definition updates. =p

Getting the same thing here as well, done an update on the program and definitions and still getting it.

Hi

I pressed the x pin on the top left of the window and it was closed.
But a new message is displayed just after ~2 minutes.
But I could temporary stop the message permanently: I stopped the service named “Microsoft .NET Framework NGEN v4.0.30319_X86”.
This was consuming my CPU very much because of the high avast activity caused by the messages above.
Now the CPU load is down and the messages disappears. But with the next machine start the service will start again automatically. Not sure if I should disable the service complete.

Kind regards
Paul

I have the same file in the same location but with no continuous popups.

I installed SP1 days ago bu this morning was the first time that the warning appeared.

Maybe Avast update & ignore it?

Cheers :slight_smile:

i had the same problem for a while after the service pack 1 install and it has now stopped…
i ran ashampoo winoptimizer and updated avast program and updates.

not sure if either solved the problem… ???

Just installed Win7 SP1 and I get the same virus warning.
Windows 7 Home Premium 64bit.
C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP428B.tmp\mscorlib.dll
Anyone know if this is real or a false positive for sure?
Updated virus definitions and program then rebooted. That did not resolve the issue.
Ran CCleaner, Cleaned all temp files and cleaned registry and it stopped.

just updated avast…program update…about to reboot…fingers crossed…

I just registered to add that I’m having the same problem. I hope they fix this soon, and REALLY hope windows patch service hasn’t been breached and sending out malware in their updates! btw full legal non-pirated win7 home premium 64 fresh install. only other software on it is ms office 2010 (licensed), avast free and printer drivers.

http://img.myph.us/YCp.gif

Interestingly I just got Avast to run a scan on the c:\windows\microsoft.net\ folder and it found no viruses.