Avira FP: ute4mtyw.sys - where did it come from?

Today I started receiving this notification from Avira Premium v8:

Virus or unwanted program 'TR/Rootkit.Gen [trojan]'
detected in file 'C:\WINDOWS\system32\drivers\ute4mtyw.sys.
Action performed: Allow access

The properties of the file say AVZ driver 1.2.0.0, and I know AVZ to be a Russian anti-malware outfit. However I have never had AVZ on my pc, but I have loaded the Kaspersky AVP tool a few times. Here's a recent thread on AVZ: https://www.wilderssecurity.com/showthread.php?t=201548

~VirusTotal link removed per Policy~ I submitted the file to Avira and here’s their response:

I am using VDF 7.0.3.189, with the guard heuristics set to high, and it is still detecting 'ute4mtyw.sys' as a TR/Rootkit.Gen. Does anyone else have this file on their pc? Google search does not display any search results.

 

It's still detected with heurist. settings at medium or low? Btw, i don't have this file on my box.

 

Yes.

 

then Elite i would try asking this on avira forums

 

I see no harm in choosing to post on this forum since a majority of the Avira forum 'regulars' frequent this place. FWIW the file was previously uploaded to both virscan.org and virustotal by other people within the past week before I chose to rescan the file today. The date the file was created on my pc was Dec. 25, 2007 @ 8:25am, and that was the first day I actually installed the AVP Tool.

https://www.wilderssecurity.com/showthread.php?t=195577

 

AVZ is bundled with the AVP Tool. AVZ is property of Kaspersky.

 

I suspected this per my original post, and I do appreciate the additional input.


What's odd is that I sent an email to support@avira.com seeking advice on this issue, yet I receive a canned response from virus_malware@avira.com stating:

I realize that virus@ and virus_malware@ request that you not spam, however why would the support@ email refuse to answer specific questions?

 

from the link you posted:

 

I submitted the file via the web interface as discussed in my original post. The mod deleted the URL from 'submitted' when he edited my post.

The email sent to support@avira.com was inquiring about the FP and why it is still being detected with latter VDF's. In return I received a canned response from a different email (virus_malware@avira.com) instead of support@.

 

post on their forum. It's faster and better.

 

EliteKiller, did you try submitting the file to Stefan (heuristik2@avira.com) since he is the one dealing with heuristics and generic detections? Maybe that will be fixed after an engine update.

thanatos

 

Yup, please send binary malware HEUR or .Gen detection problems to the email Thanatos mentioned. I made them, so I need to fix them aswell.

Changing heuristic level does not affect .Gen detection.

What is strange that the FP popped up suddenly with no engine update and no changed .Gen rules. It seems the AVZ driver changed?