False positive - Multibot Pro

[trickyricky]

I suddenly got an alert about Multibot Pro trying to
install. I clicked Remove, and confirmed the removal, then
told MSAS to carry out a complete scan, which found
nothing. Then the pop-up re-appeared for the same security
risk - Multibot Pro. This was repeated ad nauseam until I
got bored and told MSAS to ignore it and allow it to install.
There is no trace of this trojan on my system and F-Prot
AV, Kaspersky AV, Spybot S&D, Pest Patrol, Trend Micro
Housecall and Ad-Aware Se can't find anything either.

Is this known?

MSAS has the latest signatures and it's the updated beta 1
(only MS could update beta 1 and still call it beta 1 !!
Are numbers in short supply as MS??).

Windows XP Home SP2 with all updates applied.

 

[plun]

It happens that trickyricky formulated :

Multibot Pro

Hi

Check your PC with this from CA.

http://www3.ca.com/securityadvisor/pest/pest.aspx?id=453075518

 

[Bill Sanderson]

We've settled this one in another group.

If you want to amuse yourself, it is fun to watch:

Create a subdirectory of \windows (or \winnt, as the case may be), called
"winlogon.exe"

and see what happens. Try all three possible responses to the prompts.
It's fun, it's educational, and it is real-world--this subdir is actually
created by an antivirus product as a form of innoculation--not an
unreasonable idea.

(There's no risk to this experiment, but please don't blame me if the
results drive you nuts and you don't know how to fix it!) (not addressed to
you plun, but others may, for example, have trouble finding the ignored
spyware list which is in options, settings, spyware scans.)