tapicfg.exe as CoolWebSearch?

A scan revealed a CoolWebSearch threat. Only file
infected is TAPICFG.EXE. I'm running AntiSpyware on a
Windows 2003 Server PC. I checked the file and it's the
original one shipped with Windows Server 2003.
So:
- is this definitely a false positive?
- what would be the "remove action" of AntiSpyware if I
proceed to remove the threat?

Thanks

Marco Russo

Marco,

Thanks for your post and for testing the beta. A bug has been filed on this
issue.


-steve


Steve Dodson [MSFT]
MCSE, CISSP
PSS Security

--

This posting is provided "AS IS" with no warranties, and confers no rights.
Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm

Note: For the benefit of the community-at-large, all responses to this
message are best directed to the newsgroup/thread from which they
originated.
--------------------
>Content-Class: urn:content-classes:message
>From: "Marco Russo" <marco@devleap.com>
>Sender: "Marco Russo" <marco@devleap.com>
>Subject: tapicfg.exe as CoolWebSearch?
>Date: Thu, 6 Jan 2005 07:07:11 -0800
>Lines: 12
>Message-ID: <178201c4f401$65bcc070$a501280a@phx.gbl>
>MIME-Version: 1.0
>Content-Type: text/plain;
> charset="iso-8859-1"
>Content-Transfer-Encoding: 7bit
>X-Newsreader: Microsoft CDO for Windows 2000
>Thread-Index: AcT0AWW8JrYyl1ugQ7663mlSBk19Gw==
>X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4910.0300
>Newsgroups: microsoft.private.security.spyware.general
>Path: cpmsftngxa10.phx.gbl
>Xref: cpmsftngxa10.phx.gbl microsoft.private.security.spyware.general:51
>NNTP-Posting-Host: tk2msftngxa13.phx.gbl 10.40.1.165
>X-Tomcat-NG: microsoft.private.security.spyware.general
>
>A scan revealed a CoolWebSearch threat. Only file
>infected is TAPICFG.EXE. I'm running AntiSpyware on a
>Windows 2003 Server PC. I checked the file and it's the
>original one shipped with Windows Server 2003.
>So:
>- is this definitely a false positive?
>- what would be the "remove action" of AntiSpyware if I
>proceed to remove the threat?
>
>Thanks
>
>Marco Russo
>

I got the same with Windows 2003 SP1 RC

Peter

>-----Original Message-----
>A scan revealed a CoolWebSearch threat. Only file
>infected is TAPICFG.EXE. I'm running AntiSpyware on a
>Windows 2003 Server PC. I checked the file and it's the
>original one shipped with Windows Server 2003.
>So:
>- is this definitely a false positive?
>- what would be the "remove action" of AntiSpyware if I
>proceed to remove the threat?
>
>Thanks
>
>Marco Russo
>.
>