Oldfrog has just posted at Castlecops, confirming autoclk
is from Sagem modem
http://castlecops.com/t130993-
Autoclk_exe_False_Positive.html
-----Original Message-----
Thank you for your continued interest.
I have done some more searching.
First I have identified the probable source of
autoclk.exe
on my system. I found a second reference at castlecops:
http://castlecops.com/s7533-autoclk_exe.html
(why that did not come up on my first searches, I don't
know). It states:
Name autoclk
Command autoclk.exe
Status Y
Description Sagem Modem driver. Installed and required on
systems running Windows 98 or ME
I do have a Sagem USB ADSL F@st 800 modem. But I am not
running W98 or Me (I have XP SP2).
I've looked at the Sagem modem driver install files, but
unfortunately a good part of the install is in two
data.cab files that I can't open (Winzip reports cannot
open error 'not in the standard MS cab format, the
signature bytes are missing', Winrar reports error 'wrong
format or corrupted file')so I can't positively say that
this is the source of autoclk.exe on my system.
Autoclk.exe is not explicitly listed on the CD. The
manual
for the modem makes no reference to it. Nevertheless that
seems a plausible explanation as to how the file got onto
my system and why why nothing untoward happened when I
moved and subsequently deleted autoclk.exe.
As for the Windows utility to which I had earlier found
reference, I finally found the site
http://autoclik.8m.com/ which describes the utility
mentioned in my first post.
I downloaded the .zip file from that site and found that
one of the files in it is autoclik.exe [note different
spelling, 'clik' instead of 'clk']. So I think that some
of the links in my original message have mixed the two
up,
and this utility is a red herring.
The question remains: if this is a file included with
modem drivers, should it be flagged? I double checked in
MSAS history, and it definitely flagged
C:\Windows\autoclk.exe (without the i).
-----Original Message-----
I think I need a test case. It's possible that this
discussion, in this
group, is sufficient, but I think it'd be better to have
someone with a
legitimate autoclk.exe with a clear rationale for how it
got on their syste
(i.e. URL for download of software that includes it)--
and
Microsoft
Antispyware detecting, and thus busting this software.
That'd be something
replicable and clearly not right.
As it is now, it is sort of theoretical--it sounds like
detecting
autoclk.exe by itself is bad, but we don't have any
clear
proof that
autoclk.exe is good.
--
in message
Yes, it was flagged by 5747 as well. That's when I
decided
to let MSAS delete it, as in any case I did not seem to
need it (I don't have problems clicking the mouse :- ))
-----Original Message-----
I guess, now that I can see the initial message in this
thread, which
arrived after the second one--that you don't have it
around to check the new
defs.
I don't know the answer. I lean towards your thought
that when this
detection finds this file alone, it is probably a false
positive.
Still--it'd be nice to have an explanation for how that
file came to be
present on your machine.
I'll have to remember to keep an eye out for this one-
-
it will likely come
to be posted again at some point.
--
"Bill Sanderson" <
[email protected]>
wrote
in message
so
f
t.
com...
Is this detection still present with 5747
definitions?
Thanks for
sticking with this issue and reminding us.
--
"JRosenfeld" <
[email protected]>
wrote in message
Just to add one more reference to autoclk.exe not
being a
trojan by itself:
http://www.2-spyware.com/file-autoclk-exe.html
-----Original Message-----
I had autoclk.exe in c:\Windows. The file
properties
do
not identify the company or the software that it
might
be
associated with, just autoclk MFC Application.
MSAS started flagging it with 5743 or 5745 (forget
which)
as trojan.killreg and indeed there are lots of
reports
from other sources connecting this file with that
Trojan
(and its other name equivalents). However, I
certainly
have none of the symptoms that are said to be
associated
with it. NAV did not flag it.
Other posts indicate that it, by itself, is a
(harmless
if
useless) Windows utility
http://startup.iamnotageek.com/srch- autoclk.exe.html
I have never had it in the startups, however.
and one German site connects it with adsl modem
software
http://www.wintotal.de/Spyware/index.php?Filter=A
although also stating that it is flagged as spyware
by
many apps, but adds falsepositive? at the end of its
comment.
I do have an ADSL modem, but of different
manufacture
from
the one cited there.
I moved it out of C:\windows folder for a week or
so,
and
did not find anything asking for it, using the PC
normally. So now I've let MSAS delete it.
But I am wondering if it should be classed as a
false
positive if just the file is present?
Comments appreciated.
.
.
.
.
)