False positive on both AOL Spyware Protection and PestPatrol?

[Alan]

I just ran a scan with both AOL Spyware Protection and
PestPatrol's free online scanner and both detected
ISTbar. I looked at the location of the file that
was "infected" through PestPatrol and it said it was
c:\windows\system32\mciwndx.ocx.

When I checked the properties of that file, the
description was MCIWndX OLE Control Module and the
Company was Microsoft. After doing a search at
microsoft.com, I determined the file was from Visual
Basic 5.0 Learning Edition. I installed the Learning
Edition on my system a while back, and aparantly these
two apps are falsely detecting the file as an infection,
when it really isn't. I have run scans with MSAS, Ad-
Aware, Spybot, ewido, and the trial version of Giant
AntiSpyware (before MS bought out Giant Company) and
none have ever detected this as an infection.

I've used past versions of AOL Spyware Protection and it
didn't detect this infection either. I'm thinking that
AOL might be now using PestPatrol as their engine for the
latest version of their spyware scanner, since both are
detecting the same files and other scanners aren't keying
in on these files.

Both are detecting PowerReg Scheduler, which was
installed in my Startup folder when I installed an Iomega
ZIP drive a few years ago, which is listed as adware.
They are also both detecting ExecutiveSoftware's Deleted
File Analysis Utility, which both are detecting as a misc
tool. Neither of these files has ever been flagged by
the MSAS, Ad-Aware, ewido, Spybot, not the trial version
of Giant AntiSpyware (before MS bought out Giant Company).

Alan

 

[Bill Sanderson]

Thanks, Alan--This is illustrative of the nature of the beast. False
positives are a problem for every antispyware vendor and app. What will
differentiate them is how responsive the team is to reports. I believe
Microsoft has done quite well in this regard, judging from what we've seen
in these groups.