[FALSE POSITIVE] NS Keylogger in Total Uninstall 3

[Seagal]

new definitions say I have "NS Keylogger Personsal Monitor"
(there is also a bug in the name "personsal") in
c:\programs\total uninstall3\unins000.exe"

 

[Engel]

Submit a Suspected Spyware Report

 

[seagal]

Submit a Suspected Spyware Report

how?

 

[JohnBurns]

-----Original Message-----
new definitions say I have "NS Keylogger Personsal Monitor"
(there is also a bug in the name "personsal") in
c:\programs\total uninstall3\unins000.exe"
.
Same problem here 04/22/05

 

[Andre Da Costa]

http://www.spynet.com/falsepositive.aspx

With the information you send to them, the community can determine
definitions for AntiSpyware which software products on your computer are not
spyware and can be bypassed.

 

[Bill Sanderson]

Correct!

It's best to report these in the .signatures group. This one is already
there.

 

[Bill Sanderson]

Seagal - what application is this file associated with?

Can you post the results of Tools, advanced file analyzer for your file?

This is a file with the same name, but a different location, than the other
reports I've seen--and I'd like to figure out whether it is really as stupid
as to just be checking the name, or whether this file has the same MD5 hash.

The other reports I've seen are for the uninstall for SpywareBlaster, which
looks like this on my system:
Detailed File Analysis

Display name: Inno Setup

Name: unins000.exe

Description: Setup/Uninstall

Original file name: None

Publisher: None

Path: D:\Program Files\SpywareBlaster\unins000.exe

Version: 51.34.0.0

Size: 640957 bytes

Copyright: Copyright (C) 1997-2005 Jordan Russell. Portions Copyright (C)
2000-2005 Martijn Laan.

Create date: Sunday March 13, 2005

Access date: Friday April 22, 2005

Modified date: Sunday March 13, 2005

MD5: 7f1f1e05a30a027583ff3406f48a4690

 

[Steve Wechsler [MVP]]

how?

Open MSAS, click Tools, Suspected Spyware Report.


Steve Wechsler (akaMowGreen)
MS-MVP 2004-2005

===============
*-343-* FDNY
Never Forgotten
===============

 

[Seagal]

File name: Inno Setup
File path: C:\Programs\Total Uninstall 3\unins000.exe
Publisher: None
File size: 640957 bytes
File MD5: 7f1f1e05a30a027583ff3406f48a4690

 

[Seagal]

Open MSAS, click Tools, Suspected Spyware Report.

submit doesn't work. A bug?

 

[plun]

submit doesn't work. A bug?

Hi

Yes it will be fixed for Beta2

We will probably get a hotfix/new defs from MS about this
beacuse
this can lead to a real mess for million of users.

 

[Steve Wechsler [MVP]]

submit doesn't work. A bug?

Are you getting an error message relating to a proxy server ? It's a
known issue. Keep trying it and the report will eventually go through.

Steve Wechsler (akaMowGreen)
MS-MVP 2004-2005

===============
*-343-* FDNY
Never Forgotten
===============

 

[Bill Sanderson]

Thanks - that's somewhat reassuring then--looks like it is the same
file--not just by name.

 

[Bill Sanderson]

Yep!

 

[Bill Sanderson]

Thanks again. This appears (to me, anyway) to be resolved in 5711
definitions available around 6 PM EDT or so today.

If you believe you have 5711 definitions, and are still seeing this issue,
please check these particulars:
---------------------------------------------------------------------------
04/21/2005 12:13 AM 2,309,022 gcThreatAuditScanData.gcd
04/22/2005 06:46 PM 1,320,692 gcThreatAuditThreatData.gcd

Detailed File Analysis
Display name: gcThreatAuditThreatData.gcd
Name: gcThreatAuditThreatData.gcd
Publisher: Unspecified
Path: D:\Program Files\Microsoft AntiSpyware\gcThreatAuditThreatData.gcd
Size: 1320692 bytes
Create date: Friday April 15, 2005
Access date: Saturday April 23, 2005
Modified date: Friday April 22, 2005

MD5: b14f9714dec123e0194f7febd9d09c57

Detailed File Analysis
Display name: gcThreatAuditScanData.gcd
Name: gcThreatAuditScanData.gcd
Publisher: Unspecified
Path: D:\Program Files\Microsoft AntiSpyware\gcThreatAuditScanData.gcd
Size: 2309022 bytes
Create date: Friday April 15, 2005
Access date: Saturday April 23, 2005
Modified date: Thursday April 21, 2005

MD5: 71790386817e73328e9cb157119e01cd