Font Frenzy (hopefully) False Positive

[sk]

I was surprised, to say the least, the first time I ran
MSAS, and it indicated that a file in my Font Frenzy
folder was none other than the dreaded "My Daily
Horoscope" AdWare, (lol) carrying with it a rather high
risk factor as well. (not so lol if it turns out to be
correct). I notfied Font Frenzy of what MSAS was
indicating, but so far I have not heard back from them.
Unless or until I hear otherwise, I am assuming that
MSAS's alert is a false positive. No other AVS software or
scan has indicated that there is anything wrong with the
Font Frenzy unins.exe file. Now, I'm posting my experience
here for whatever it's worth.

sk

 

[Guest]

Please submit a Tools, suspected spyware report from the
infected machine!

 

[sk]

The problem with what you are suggesting is that I am NOT
experiencing any problems related to Font Frenzy. The
problem, I believe, is with MSAS, and the fact that it is
reporting what I believe to be a false positive Adware ID.
I've looked at the reporting tool and cannot see how that
can possibly accomplish what I want it to. That's why I
posted my original entry here - because it's MSAS that I
believe is at fault.

 

[Bill Sanderson]

Thanks - this is the right place to report this.

If a Microsoft staff person were trying to replicate this, is this
application downloadable, as a trial, perhaps?

Can you give more details of the detected object?

 

[sk]

Sure, Bill. It's a freeware program.
http://www.fontfrenzy.org/
The detected object is uninst.exe, a file in the main Font
Frenzy install folder, and it's identified by MSAS "My
Daily Horoscope" AdWare. I have not
uninstalled/reinstalled Font Frenzy to see if uninst.exe
is a normal file in Font Frenzy, and I guess there's
nothing to say that the "My Daily Horoscope" AdWare could
not have re-written itself/renamed itself with that
particular file name, but NO other AV or Anti Trojan or
Anti Spyware program or online scan/check has ever named
that particular file to be a problem except MSAS. Hope
this helps. If you need any further info, just let me
know.

sk

 

[Bill Sanderson]

I've seen a file with this name cited before as a false positive. I suspect
it will turn out that this is a generic piece of an installer, and that the
detections need to be improved.

Do report this back to the author, and refer them to:
http://www.spynet.com/falsepositive.aspx

where there is a form a software vendor can use to get such a false positive
rectified.

 

[sk]

Thanks again for your reply. And I will contact the author
again - with the link you provided below - so that the
situation can be adequately addressed/resolved.