Yes, it seems all the FP only in russian advapi32 's. But these are exactly False Positives, NOT the real infections. There at wrok in my office i encountered that false alert five or more times, and every time only CIS rised up a panic. Other AV-scanners kept silence.