win32\patched.NAW Trojan...

Discussion in 'ESET Smart Security' started by aadesilva, Jun 27, 2011.

Thread Status:
Not open for further replies.
  1. aadesilva

    aadesilva Registered Member

    Joined:
    Jun 27, 2011
    Posts:
    7
    afer I updted my database just today, it detected that patched trojan attacking my sfc_os.dll file... Is this a glitch or is it really a bad thing hapenning on my PC?
     
  2. k!b?

    k!b? Registered Member

    Joined:
    Jan 16, 2006
    Posts:
    22
    Re: win32\patched NAW Trojan...

    ESET please fix this fast - it is false positive.

    The file sfc_os.dll is patched with nLite to disable SFC. That is why it is detected as trojan.
    Mcafee had the same problem:

    http://www.msfn.org/board/topic/142814-mcafee-virusscan-and-disabled-sfc/

    Maybe SFC should be left enabled but right now I have literally hundreds of installed copies of this nLite tweaked XP so it will be hell to explain people that it is not a virus but false positive.
     
  3. aadesilva

    aadesilva Registered Member

    Joined:
    Jun 27, 2011
    Posts:
    7
    so does this mean this is not really a serious problem?
     
  4. Cosmin3

    Cosmin3 Registered Member

    Joined:
    Jun 2, 2010
    Posts:
    29
    I too have this problem with my sfc_os.dll and I also think that it's a false positive.
    At Virustotal only 4 out of 42 antiviruses says that is infected.
    The file is also in a backup that I made when I installed Windows XP last time (3..4 months ago). And is also in my modified XP installation files as SFC_OS.DL_.
    For now I have added it to exclusions.
    But please fix this as soon as possible.
    Thank you.
     
    Last edited: Jun 28, 2011
  5. claartjevisser

    claartjevisser Registered Member

    Joined:
    Jun 28, 2011
    Posts:
    1
    I too have this problem with my sfc_os.dll, since yesterday...I hope it's nothing serious...:mad:
     
  6. Cudni

    Cudni Global Moderator

    Joined:
    May 24, 2009
    Posts:
    6,956
    Location:
    Somethingshire
    don't forget to submit the file to Eset to check and fix
     
  7. Cosmin3

    Cosmin3 Registered Member

    Joined:
    Jun 2, 2010
    Posts:
    29
    I already did.
    But I submitted files before and until today I still keep them as exclusions because nothing was fixed + nobody answered to my email accounts EVER.
    So my confidence isn't that high...
     
  8. dmaasland

    dmaasland Registered Member

    Joined:
    Nov 10, 2010
    Posts:
    468
    Can someone with this problem create a SysInspector log and pm me the link?
     
  9. ninja2111

    ninja2111 Registered Member

    Joined:
    Mar 10, 2010
    Posts:
    4
    Had this problem this morning on multiple machines, I'm thinking it's a false positive - would be nice for an official response.
     
  10. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,374
    It's actually a sort of patched file. We've also received it among other samples from a test set from a famious AV tester.

    The case is still under investigation and we're trying to determine the source responsible for patching the system file. It's a matter of fact that official installation CDs from Microsoft do not contain this file.
     
  11. Cosmin3

    Cosmin3 Registered Member

    Joined:
    Jun 2, 2010
    Posts:
    29
    NLite 100%.
    In my original XP CD sfc_os.dl_ isn't seen as infected. After using NLite is seen as infected.
     
  12. aadesilva

    aadesilva Registered Member

    Joined:
    Jun 27, 2011
    Posts:
    7
    still popping up... :oops:
     
  13. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,374
    Could you confirm you installed your Windows using nLite? Any chance you're running a cracked version of Windows?
     
  14. GregecSLO

    GregecSLO Registered Member

    Joined:
    Aug 3, 2009
    Posts:
    6
    We had couple of cases when nLite was NOT used to customize Win install and user is using original MS XP software...

    Will send Sysinspector log... :)
     
  15. loot270

    loot270 Registered Member

    Joined:
    Jun 28, 2011
    Posts:
    1
    Yes, all nlite mode of sfc_os.dll from original XP are marked like win32\patched.NAW Trojan
    Even add this to excludes, NOD still alerts! And some apps don't want to work, because Nod block this .dll!..
     
  16. PHar

    PHar Registered Member

    Joined:
    Jun 28, 2011
    Posts:
    1
    I have a question...

    Is this a potential virus or just a glitch? Should I consider backing up my files?
     
  17. GregecSLO

    GregecSLO Registered Member

    Joined:
    Aug 3, 2009
    Posts:
    6
    Probably just a false positive, nothing to worry about.
     
  18. sober

    sober Registered Member

    Joined:
    Jun 28, 2011
    Posts:
    3
    Did update 6246 fix this?
    Thanks
     
  19. aadesilva

    aadesilva Registered Member

    Joined:
    Jun 27, 2011
    Posts:
    7
    I don't know what nlite is (noob) I've been running both my OS and Eset for quite sometime already. Just after the virus database update today it happens.
     
  20. toxinon12345

    toxinon12345 Registered Member

    Joined:
    Sep 8, 2010
    Posts:
    1,200
    Location:
    Managua, Nicaragua
    I have installed vistamizer in my OS, this problem does not occurs
     
  21. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,374
    To whom with Win32\Patched.NAW Trojan detected: this detection was for a patched system file sfc_os_dll (ie. not originating from Microsoft) which, in effect, rendered one of the important Windows security features called System File Checker disabled. For this reason it's often exploited by malware for malicious purposes so that the malware could infect system files or replace them with malicious files easily, without the operating system detecting these changes, notifying the user about them and offering replacement with a clean copy of the affected file(s).
    The detection will be (at least temporarily) withdrawn as of the update 6247.
     
  22. Cosmin3

    Cosmin3 Registered Member

    Joined:
    Jun 2, 2010
    Posts:
    29
    My personal reason to remove SFC from XP: because it's not providing real protection + it's taking from resources.
    Since then I have a fast and stable OS.
    And I haven't had a real virus on my OS for many years.
    I know, because I check every few weeks with other 3 antiviruses.
     
    Last edited: Jun 28, 2011
  23. scsitsupport

    scsitsupport Registered Member

    Joined:
    Apr 7, 2011
    Posts:
    6
    Oh I do hope this is a false positive.
    We have these popping up all over the network since the last update :ouch:
     
  24. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,374
    No, it's not actually a false positive but the detection was eventually removed in an update released several hours ago and the quarantined files were restored.
     
  25. Cosmin3

    Cosmin3 Registered Member

    Joined:
    Jun 2, 2010
    Posts:
    29
    Thank you for removing it.
     
Thread Status:
Not open for further replies.