Ignore reports about unins000.exe; they are FALSE ALARMS

J

Jordan Russell

It has come to my attention that the current signatures for Microsoft
AntiSpyware are claiming the following file contains "NS Keylogger
Personsal Monitor":

File name: Inno Setup
File path: C:\Program Files\[program name goes here]\unins000.exe
Publisher: None
File size: 640957 bytes
File MD5: 7f1f1e05a30a027583ff3406f48a4690

As creator of unins000.exe -- the Inno Setup Uninstaller
(http://www.innosetup.com/), which is bundled with a variety of
applications (e.g. SpywareBlaster) -- I can confirm that this is a FALSE
ALARM. There is NO spyware of any kind in this executable.

You should NOT let AntiSpyware quarantine or remove these files, or you
will have trouble uninstalling applications. Just ignore the reports.

I have filed a vendor report, so hopefully this will be corrected soon.
 
A

Andre Da Costa

From Bill Sanderson:
Beware the ides of unins000.exe with these definitions.

NS Keylogger is the ID--and so far it seems to be a false positive.
 
P

plun

Andre said:
From Bill Sanderson:
Beware the ides of unins000.exe with these definitions.

Andre, if it matches these criteria its is a real threat.

programfilesdir+\active key logger\sys32win.exe
programfilesdir+\active key logger\unins000.exe
programfilesdir+\active key logger\uninstall.exe

http://www3.ca.com/securityadvisor/pest/pest.aspx?id=453077694

Cant understand how MS has make this scanning logic for
unins000.exe

Quality insurance.........
 
B

Bill Sanderson

You'll be pleased to hear that this is fixed with the 5711 definitions which
were available at some point earlier this afternoon.
 
S

ST

Hello.

I did get the NS Keylogger Personal Monitor thing
after I scanned my comp with MS spyware and I removed
that NS Keylogger.

If it is a false alarm, how can I correct it? Since
I've already removed it, I may have to reinstall whatever
I may have removed.

Any suggestion?
 
J

Johan Leezer

If you have quarantined the applicable file(s) then you
can restore those via
Tools --> Spyware Scan --> Manage Spyware Quarantine
-----Original Message-----
Hello.

I did get the NS Keylogger Personal Monitor thing
after I scanned my comp with MS spyware and I removed
that NS Keylogger.

If it is a false alarm, how can I correct it? Since
I've already removed it, I may have to reinstall whatever
I may have removed.

Any suggestion?
-----Original Message-----
It has come to my attention that the current signatures for Microsoft
AntiSpyware are claiming the following file
contains "NS
Keylogger
Personsal Monitor":

File name: Inno Setup
File path: C:\Program Files\[program name goes here] \unins000.exe
Publisher: None
File size: 640957 bytes
File MD5: 7f1f1e05a30a027583ff3406f48a4690

As creator of unins000.exe -- the Inno Setup Uninstaller
(http://www.innosetup.com/), which is bundled with a variety of
applications (e.g. SpywareBlaster) -- I can confirm
that
this is a FALSE
ALARM. There is NO spyware of any kind in this executable.

You should NOT let AntiSpyware quarantine or remove these files, or you
will have trouble uninstalling applications. Just
ignore
the reports.
I have filed a vendor report, so hopefully this will be corrected soon.
.
 
B

Bill Sanderson

Reinstalling the removed app would be one way. Moving the applicable file
from another system would be another. This file is not custom to a given
application--the identical file may be used in several apps--so you just
need version 51.34.0.0 of the uninstaller. I've posted the reading from the
Tools, advanced tools, advanced file analyzer tool in Microsoft Antispyware
in a number of places.

--
FAQ for Microsoft Antispyware:
http://www.geocities.com/marfer_mvp/FAQ_MSantispy.htm

ST said:
Hello.

I did get the NS Keylogger Personal Monitor thing
after I scanned my comp with MS spyware and I removed
that NS Keylogger.

If it is a false alarm, how can I correct it? Since
I've already removed it, I may have to reinstall whatever
I may have removed.

Any suggestion?
-----Original Message-----
It has come to my attention that the current signatures for Microsoft
AntiSpyware are claiming the following file contains "NS Keylogger
Personsal Monitor":

File name: Inno Setup
File path: C:\Program Files\[program name goes here] \unins000.exe
Publisher: None
File size: 640957 bytes
File MD5: 7f1f1e05a30a027583ff3406f48a4690

As creator of unins000.exe -- the Inno Setup Uninstaller
(http://www.innosetup.com/), which is bundled with a variety of
applications (e.g. SpywareBlaster) -- I can confirm that this is a FALSE
ALARM. There is NO spyware of any kind in this executable.

You should NOT let AntiSpyware quarantine or remove these files, or you
will have trouble uninstalling applications. Just ignore the reports.

I have filed a vendor report, so hopefully this will be corrected soon.
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Top