Spyware, Viruses, & Security forum

General discussion

MBAM reporting beep.sys as a trojan. False Positive?

by MarkFlax Forum moderator / January 30, 2009 7:22 AM PST

Hi everyone.

I have just done a sweep with MBAM, (updated a couple of minutes before), and it is reporting 3 trojan infected beep.sys files on my system. They are;

"Trojan.Patched", file, in C:\I386\BEEP.SYS
"Trojan.Patched", file, in C:\Windows\System32\Drivers\Beep.sys, and
"Trojan.Patched", file, in C:\Windows\System32\DLLCACHE\beep.sys, (DLLCACHEis a hidden folder).

That was in the MBAM results window. The log file shows
C:\I386\BEEP.SYS (Trojan.Patched) -> No action taken.
C:\WINDOWS\SYSTEM32\DRIVERS\BEEP.SYS (Trojan.Patched) -> No action taken.
C:\WINDOWS\SYSTEM32\DLLCACHE\beep.sys (Trojan.Patched) -> No action taken.

I am wondering if these are false positives. All of the beep.sys files (Properties), show the same file size, 4.12KB, (4,224 bytes), 2 were created on August 29 2002, and the 3rd on Sept 6 2003. I purchased this computer in September 2003.

I have uploaded the files to http://virusscan.jotti.org/ and their online scan found no infection in two of them. The site wouldn't accept my 3rd file, telling me off for sending duplicate files, Happy

I have researched both beep.sys and Trojan.Patched in Google, and have found tons of results, but many are confusing. A couple of forum results seem to suggest MBAM is reporting beep.sys as a false positive. Results for Trojan.Patched are mostly, "How to remove", but I am not yet convinced I have anything to remove.

What I have done so far;

AVG Free version, (updated). Full scan, no infections found. Daily scheduled scans.
MBAM Free version, (updated). Full scan, results above. Manual scans once a week.
Windows Defender, (updated). Full scan, no spyware found. (Weekly scan schedule, but I ran a manual scan just now).
(Spybot S&D, installed but no longer used).
Spywareblaster, updated and inoculated.
Sophos free Anti-Rootkit installed, latest version, full scan, no rootkits found.

My System;

Dell 8300 3.0 GHz Pentium, 2 GB RAM, 220GB Raid 0 hard disk. Windows XP Pro, SP3 and fully updated.

Any ideas? I am almost convinced this is a false positive.

Many thanks,


Discussion is locked
You are posting a reply to: MBAM reporting beep.sys as a trojan. False Positive?
The posting of advertisements, profanity, or personal attacks is prohibited. Please refer to our CNET Forums policies for details. All submitted content is subject to our Terms of Use.
Track this discussion and email me when there are updates

If you're asking for technical help, please be sure to include all your system info, including operating system, model number, and any other specifics related to the problem. Also please exercise your best judgment when posting in the forums--revealing personal information such as your e-mail address, telephone number, and address is not recommended.

You are reporting the following post: MBAM reporting beep.sys as a trojan. False Positive?
This post has been flagged and will be reviewed by our staff. Thank you for helping us maintain CNET's great community.
Sorry, there was a problem flagging this post. Please try again now or at a later time.
If you believe this post is offensive or violates the CNET Forums' Usage policies, you can report it below (this will not automatically remove the post). Once reported, our moderators will be notified and the post will be reviewed.
Collapse -
Mark, it's been reported already at MB
by Carol~ Moderator / January 30, 2009 7:27 AM PST
Collapse -
(NT) And already fixed. Update to v1710 :)
by Carol~ Moderator / January 30, 2009 7:30 AM PST
Collapse -
Excellent. Thanks you two.
by MarkFlax Forum moderator / January 30, 2009 8:17 AM PST

That's a weight off my mind.

Strange though, when I checked for updates before scanning I only got 1709. But now I have just tried updating again, and have 1710. I guess I should have kept clicking the Update button until MBAM told me off! Happy


Collapse -
It was almost "we three" :)
by Carol~ Moderator / January 30, 2009 9:03 AM PST

I'm SO VERY impressed with how quickly they deal with f/p's, I almost posted again to point it out. Blush I thought better of it and left it a twosome. Plus, I wanted to keep my post count down.

Not only do they attend to the posts quickly, but also fixing "what needs be". I've reported f/p's for myself and other's, and never once had to wait overnight for it to be fixed. In this specific case, it took them a mere 53 minutes from the time it was first reported. Am I over-doing it? There's more. I'll leave it as me "doing short". Happy


Collapse -
You two?
by MarkFlax Forum moderator / January 30, 2009 8:14 PM PST

Hi Carol.

I think I had a brain storm there when I thanked you both. I thought one of you were Marianna! Happy

My apologies, and thank you once again.


Collapse -
I too!
by Carol~ Moderator / January 31, 2009 4:36 AM PST
In reply to: You two?

Hi Mark..

I too apologize. I mistook your brain storm for "clever and humorous". No problem. It's perfectly understandable how you might confuse 1 of the 2 "curcat's", as "Marianna Schmudlach". I see the similarities. Devil On a more serious note, I've had more than my share of faux pas. Far more than yours, I suspect.

You're welcome..

Collapse -
You mean I'm 'not' clever and humorous?
by MarkFlax Forum moderator / January 31, 2009 4:50 AM PST
In reply to: I too!

And there you go, signing yourself as Marianna!

I'm right confused now.... Happy


Collapse -
(NT) Have no fear. You STILL remain so!
by Carol~ Moderator / January 31, 2009 5:35 AM PST
Popular Forums
Computer Newbies 10,686 discussions
Computer Help 54,365 discussions
Laptops 21,181 discussions
Networking & Wireless 16,313 discussions
Phones 17,137 discussions
Security 31,287 discussions
TVs & Home Theaters 22,101 discussions
Windows 7 8,164 discussions
Windows 10 2,657 discussions

Does BMW or Volvo do it best?

Pint-size luxury and funky style

Shopping for a new car this weekend? See how the BMW X2 stacks up against the Volvo XC40 in our side-by-side comparison.