Solved Avast thinks nVidia driver package contains a rootkit

[TVeblen]

Interesting. I ignored it.

*

 

[Slartybart]

Probably a false positive, but why not run TDSSkiller?

Malware Remediation - Scan for Rootkits
or

Kaspersky download site: Anti-rootkit utility TDSSKiller

 

[ICIT2LOL]

TV some more you can try mate
Best Free Rootkit Scanner and Remover - Avast has one in here too.

 

[TVeblen]

Thanks gents.
I believe it to be a false positive too, something for nVidia and Avast to work out.
I ran an Avast boot scan and a full general scan afterward and nothing came up.

But I will run one of those suggested programs too, just to be sure. Not today though, leaving in one hour.

 

[andrew129260]

It most likely is a false positive.


Virustotal is your friend.

Herd protects last known scan of the item commonly found in that location with that name:

Malware scan of nvhda64v.sys (NVIDIA HDMI Audio Driver) a67cfe443588e8d7427b3b7c76d88726ef8b1f3a - herdProtect

All good.

You can use that info to match the md5 and other variables if you are unsure. Although it is possible for malware to lie about its md5 hash. But that's another story.

Also wanted to add, avast starts out with the letters svc in that warning. Avast is telling you it is also running as a service. I am not sure how obvious it is to others so I thought I would add this info just in case.

 

[ICIT2LOL]

It most likely is a false positive.


Virustotal is your friend.

Herd protects last known scan of the item commonly found in that location with that name:

Malware scan of nvhda64v.sys (NVIDIA HDMI Audio Driver) a67cfe443588e8d7427b3b7c76d88726ef8b1f3a - herdProtect

All good.

You can use that info to match the md5 and other variables if you are unsure. Although it is possible for malware to lie about its md5 hash. But that's another story.

Good point Andrew had forgotten about them - Virustotal

 

[TVeblen]

Thanks again. I think that is cleared up.
Sorry, no love for either of you due to rep limit.

 

[andrew129260]

I would also make sure to report it to avast as a false positive.

http://www.avast.com/contact-form.php

or post in the forum here:

https://forum.avast.com/index.php?board=2.0