The Notebook Review forums were hosted by TechTarget, who shut down them down on January 31, 2022. This static read-only archive was pulled by NBR forum users between January 20 and January 31, 2022, in an effort to make sure that the valuable technical information that had been posted on the forums is preserved. For current discussions, many NBR forum users moved over to NotebookTalk.net after the shutdown.
Problems? See this thread at archive.org.

    ATsiv: TRojan false-positive?

    Discussion in 'Security and Anti-Virus Software' started by Meetloaf13, Jan 25, 2009.

  1. Meetloaf13

    Meetloaf13 fear the MONKEY!!!

    Reputations:
    547
    Messages:
    1,717
    Likes Received:
    42
    Trophy Points:
    66
    Hey guys/gals,

    I've been using atsiv for months, but AntiVir just recently identified it as a Trojan.

    I uploaded the file to virustotal, and 4/38 engines identified it as a virus. All of them did so using heuristics (which contains a margin of error).
    http://www.virustotal.com/reanalisis.html?5a572f617c500a4dbc30a73b17afb03e

    I know that ATSIV has been under scrutiny from Microsoft for ages, b/c it enabled us to load the drivers we wanted to load.

    Anywho, just curious if anyone knows of a virus problem with atsiv, it's been scanned as clean for months, just today I had a problem with it.

    It would be a shame if it is a trojan, I use atsiv to load RMClock in my Vista/Win7 x64 environment, and it lowers my idle temps ~15C
     
  2. Big Mike

    Big Mike Notebook Deity

    Reputations:
    57
    Messages:
    956
    Likes Received:
    1
    Trophy Points:
    31
    This is the bypass driver signing thing for x64 right? If so it's behavior is quite possibly suspect just because of what it does. Many programs that allow things that aren't supposed to be allowed trigger heuristic warnings on AV programs.
     
  3. Meetloaf13

    Meetloaf13 fear the MONKEY!!!

    Reputations:
    547
    Messages:
    1,717
    Likes Received:
    42
    Trophy Points:
    66
    Yep, that's exactly what it does, on a driver-by-driver basis.

    Essentially, you initiate a javascript file that tells it which driver to allow. I figured this was the case.