IE-SPYAD2 and M$AS

[Pete Yevchak]

Anyone seeing a bunch of "hits" on MediaTickets CDT" if
you're using IE-SPYAD2? Pete

 

[Bill Sanderson]

Yes- I've seen one other report of this issue. Thanks for the additional
report.

 

[JRosenfeld]

Also reported here:

http://www.wilderssecurity.com/showthread.php?t=69578

 

[Bill Sanderson]

Yes--that would be the same issue. the 4 is the tipoff.

 

[Pete Yevchak]

-----Original Message-----
Yes- I've seen one other report of this issue. Thanks for the additional
report.

Bill - Is there any way MAS can change its' detection
routine to include reading the STATE of the key (include
the sub-keys), instead of just the key itself?

IOW, this key here is a "4" on the sub-key, which means
it's beneficial, not malicious.

If MAS can be made to read the sub-keys (and would know
what they represent) wouldn't that help PREVENT the false
positive?

Just about everyone's "layered" defenses-wise these days.
In the case of anyone using E. Howes IE-SPYAD2, they'd
(if they weren't cautious) go ahead and either quarantine
or delete that result in MAS, thus actually DEFEATING the
protection against the actual malware provided by the IE-
SPYAD2 entries.

How hard would it be to implement something like that?
Pete

 

[Bill Sanderson]

There was an equivalent false positive early in the beta--it was for
SearchSquire, and the entry was put in by Spybot Search & Destroy, as I
recall.

I've passed the details of this detection (from a different thead) on to
Microsoft. They've been able to fix this via definition updates in the
past.

So--I would expect this to get fixed, but can't promise when.

 

[Engel]

Bill:
See in this forum, dated 2-27-2005 under Subject:IE-SpyAd.
Are you talking about de same program?
Please let me know, so I can delete it.

Engel

 

[Engel]

You should comment in this subject.
Engel

-----Original Message-----
There was an equivalent false positive early in the beta-- it was for
SearchSquire, and the entry was put in by Spybot Search & Destroy, as I
recall.

I've passed the details of this detection (from a different thead) on to
Microsoft. They've been able to fix this via definition updates in the
past.

So--I would expect this to get fixed, but can't promise when.

--
FAQ for Microsoft Antispyware:
http://www.geocities.com/marfer_mvp/FAQ_MSantispy.htm




.

 

[Bill Sanderson]

I'm not sure that your program and the one involved in this thread are the
same program.

However, the issue here is not with either third-party program--I know
nothing detrimental about these program(s.)

The problem is that an attempt to "innoculate" the system against a
particular threat causes Microsoft Antispyware to raise an alarm--when it
should not--in other words, a false positive.

So the problem is with Microsoft Antispyware, not the other application
involved.

 

[Engel]

Bill:
Thank you por your reply.
Since I download the mention program and CCleaner, my
system is acting funny, so I like to troubleshoot and keep
one eye on my system so I can select which one of the two
is responsable.

Thank you one more time and I like to tell you, you and
the others doing a super and ulmost impossible job.

Engel

 

[Bill Sanderson]

I understand why you posted the question now.

Good luck with your system. I don't know of any problem with either
application you named.