I have the same concerns. I ran a search for the file this flag references and only found the two (both v5.1.2600.0) apparently added by MS to the original WinXP installation CD back in 2001 (one in C:\WINDOWS\system32\dllcache\ws2ifsl.sys, the other in C:\WINDOWS\system32\drivers\ws2ifsl.sys). Neither of these appear to be fake drivers. Malwarebytes' Anti-Malware 1.34 Database version: 1832 Windows 5.1.2600 Service Pack 3 3/10/2009 3:39:05 PM MBAM 2009-03-10.txt Scan type: Quick Scan Objects scanned: 74552 Time elapsed: 2 minute(s), 7 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 1 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WS2IFSL (Fake.Driver) -> No action taken. [3857535134304144385864454836344564463436414247386152585253384661368683837079853 68079858380775270856152708387746870846156521942395245] Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected)