It claimed that tapicfg was CoolWebSearch. It isn't (at least, the file it
found isn't, maybe CWS has something of the same name). It's part of
Windows Server 2003. The default is to remove this (which for CWS makes
sense...) but it shouldn't be touching it.

It similarly claimed that remote.exe in the Win2K Support Tools is
malicious. It's claiming it to be Cyanure or somesuch. It's not. It is a
tool that could be used for nefarious things (it's a remote control tool),
but it's not ipso facto malicious. Detecting it as an enabler would be
reasonable, perhaps.

It believed tvenuax.dll from an (ancient) version of Lernout and Hauspie
TruVoice to be WhenU.SaveNow, which again is not the case.

Finally, it detected sporder.dll from SafeTP as part of WebHancer. Again,
it ain't. Potentially it can be (there is a sporder.dll in WebHancer,
AIUI), but it's an MS-distributed dll that's perfectly legitimate.

Is there a mechanism within the program itself for reporting false
positives?

This is the place to report false positives.

"Dr Pizza" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> It claimed that tapicfg was CoolWebSearch. It isn't (at least, the file
> it
> found isn't, maybe CWS has something of the same name). It's part of
> Windows Server 2003. The default is to remove this (which for CWS makes
> sense...) but it shouldn't be touching it.
>
> It similarly claimed that remote.exe in the Win2K Support Tools is
> malicious. It's claiming it to be Cyanure or somesuch. It's not. It is
> a
> tool that could be used for nefarious things (it's a remote control tool),
> but it's not ipso facto malicious. Detecting it as an enabler would be
> reasonable, perhaps.
>
> It believed tvenuax.dll from an (ancient) version of Lernout and Hauspie
> TruVoice to be WhenU.SaveNow, which again is not the case.
>
> Finally, it detected sporder.dll from SafeTP as part of WebHancer. Again,
> it ain't. Potentially it can be (there is a sporder.dll in WebHancer,
> AIUI), but it's an MS-distributed dll that's perfectly legitimate.
>
> Is there a mechanism within the program itself for reporting false
> positives?
>
>