AproposMedia BHO

[Nameless]

Microsoft AntiSpyware recently identified an installation
of libexpat.dll as a 'serious privacy threat/violation.'

libexpat.dll is an open source XML parser, see
http://expat.sourceforge.net/ In particular, it is not
spyware.

In my case, libexpat.dll was distributed with AT&T's
Graphviz (1.10), which is a tool for laying out and
displaying graphs, see
http://www.research.att.com/sw/tools/graphviz/

Some web research indicates that there are spyware
detection tools (AntiSpyware, Spy Sweeper, and possibly
older versions of AdAware and PestPatrol) which
incorrectly flag up libexpat.dll as spyware, apparently
because it is _used_by_ at least one actual spyware
product (AproposMedia BHO).

It is important to state that I have not experienced any
adverse effects after installing Graphviz. To quarantine
libexpat.dll just because it is used by actual spyware
seems to be a rather harsh (re-)action. Is it not possible
to add a little 'intelligence' to Microsoft AntiSpyware,
ie actually analyze the user's installation before passing
judgement?

 

[Guest]

Hi

Im using the latest versions of zonealarm and pestpatrol
and these do not shows LIBEXPAT.DLL as a security threat
at all.

Rodney
(e-mail address removed)

 

[Andre Da Costa]

Send in your false positives here:
http://www.spynet.com/falsepositive.aspx