SearchSquire

Microsofts antispyware beta 1 gave me a false positive on
a adware program called SearchSquire. It is really a
definition for Spybot's Search and Destroy Anti spyware
program which is a well known and trusted antispy app. By
deleting this definition you will get less protection from
searchsquire adware as spybot is no longer protecting you
from it.

>-----Original Message-----
>Microsofts antispyware beta 1 gave me a false positive
on
>a adware program called SearchSquire. It is really a
>definition for Spybot's Search and Destroy Anti spyware
>program which is a well known and trusted antispy app.
By
>deleting this definition you will get less protection
from
>searchsquire adware as spybot is no longer protecting
you
>from it.
>.

It's worse. The actual entry (at least on my machine) is:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Internet Settings\ZoneMap\Domains\searchsquire.com]
"*"=dword:00000004

which, I believe, is a Internet Explorer record that puts
SearchSquire.com in the Restricted Zone...

I.e, not something to complain about.

Otherwise, contrary to every other package I tried, I
didn't get loads of false positives.

>-----Original Message-----
>It's worse. The actual entry (at least on my machine) is:
>
>
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
>on\Internet Settings\ZoneMap\Domains\searchsquire.com]
>"*"=dword:00000004
>
>which, I believe, is a Internet Explorer record that
puts
>SearchSquire.com in the Restricted Zone...
>
>I.e, not something to complain about.
>
>Otherwise, contrary to every other package I tried, I
>didn't get loads of false positives.

Yes, this "Restricted Zone" false positive
with "searchsquire.com" is very troublesome -- since I
assume other domains in the Restricted Zone could be
flagged during the registry scan, as well.

Another false positive I found was with domain "redv.net"
in MSIE's "Always Block" cookies list. Similar to above,
Microsoft's AntiSpyware Beta1 product flagged it as
a "High" security risk. Yeah, right...sure.

Needless to say, I had to change the default action for
these two domains from "Remove" to "Always Ignore".

Personally, the AntiSpyware scan should only be concerned
if these domains appeared in the "Trusted Sites" list or
the "Always Allow" cookie list.