This didn't happen to me. But from the screenshots at their forum I see that mscorsvw.exe accesses a dll (in c:\windows\assembly...) and that dll is detected as malware and moved to chest or even deleted (I do not like these default settings, btw). But as far as I know mscorsvw.exe is related to .NET Optimization service... that is disabled on my machine and maybe this is why I never had this problem. SP1 didn't install any new .NET framework for me (my version is v4 - Client - the last version available but was updated before SP1, last year actually). Maybe for those who didn't had .NET framework v4 SP1 included that too.