New False Positive

[plun]

As creator of unins000.exe (the Inno Setup uninstaller), I can tell you
for a certainty that this *IS* a false positive. There is absolutely no
spyware of any kind in this executable.

As for why only some unins000.exe files are detected, the program
appears to be only be checking for a certain version or versions.

I'll be filing a vendor report (assuming MS isn't reading this thread
already).

I think MS already have had emergeny meetings about this
severe mistake.

Bless this mess.....

 

[OldBoy]

Okay, here it goes:
? ver 51.5.0.0 71 kB DScaler
Inno Setup ver 51.13.0.0 75 kB Taskinfo
Inno Setup ver 51.15.0.0 76 kB IZarc
? ver 51.5.0.0 70 kB Everest
Inno Setup ver 51.15.0.0 76 kB PC Wizard 2005
? ver 51.7.0.0 75 kB FileAlyzer
? ver 51.5.0.0 72 kB RegscrubXP
Inno Setup ver 51.13.0.0 77 kB Spybot S&D
Inno Setup ver 51.40.0.0 631 kB GTK
Inno Setup ver 51.40.0.0 631 kB Gimp 2.0
? ver 51.5.0.0 72 kB Lexun Backaup
Inno Setup ver 51.15.0.0 76 kB MBM
Inno Setup ver 51.15.0.0 77 kB TimeWriter Pro

I downloaded and installed SpywareBlaster 3.3 on my system with XP Home NL
(with MSAS real-time protection disabled; no warnings during install); the
related unins000.exe has a size of 1.252 kB, ver 51.34.0.0 and AFAICT the
only unins000.exe file on my systems with a reference to internet sites:
www.innosetup.com and www.remobjects.com !?
Did an uninstall (with MSAS real-time protection still disabled) with
Add/Remove Programs.
Did a deep scan with MSAS (with MSAS real-time protection ENabled): no
issues found.
Installed SpywareBlaster again (with MSAS real-time protection ENabled) but
did NOT enable anything to be sure.
Did a deep scan with MSAS (with MSAS real-time protection ENabled): no
issues found!!!!!!!!!

To morrow (local time now 22:40) I'll try to run SpywareBlaster enabled on
my system with XP PRO UK and have a further look.
I am a lttle baffled now

Gr. Jan

 

[Jack Bauer]

Bill - I don't have an advanced file analyzer but i know
both spywareblaster and extreme thumbnail generator both
use the InnoSetup uninstaller. What they have in common
is the file version for InnoSetup in both cases is
51.34.0.0.

I have other versions of InnoSetup uninstaller on my
machine with various other apps. Its seems however MSAS
only has a problem with uninstallers with the above file
version.

Reading other posts the creator of Innosetup states that
it is an FP.

Which it may well be, but then, if it was, why does MSAS
not point to all innosetup files instead of this specific
version. Is it because someone has found a way of using
this version to deliver malware?

Jack

PS where can i download a good advanced file analyzer?

 

[OldBoy]

As creator of unins000.exe (the Inno Setup uninstaller), I can tell you
for a certainty that this *IS* a false positive. There is absolutely no
spyware of any kind in this executable.

As for why only some unins000.exe files are detected, the program
appears to be only be checking for a certain version or versions.

I'll be filing a vendor report (assuming MS isn't reading this thread
already).

Maybe the problem is that some did not read the license.txt in your
packages:-(
In an earlier message I reported about some versions of unins000.exe;
clearly the text "Inno Setup" was removed from som executables.
I for sure believe you are not to blame.

Gr. Jan

 

[Bill Sanderson]

If I understand correctly the FP is for a commercial key logger application.
Such a commercial app could be installed with a standard commercial setup
mechanism.

Somebody was overzealous in defining "presence."

 

[Bill Sanderson]

OK - Jack Bauer, in a nearby thread, has confirmed that only a specific
version of innovisions installer seems to be detected this way--51.34.0.0

This would allow for your experience, unless you can confirm that 1) you
have that version of unins000.exe, and 2) you are indeed scanning the
partition that it is on, and 3) with 5709.

--
FAQ for Microsoft Antispyware:
http://www.geocities.com/marfer_mvp/FAQ_MSantispy.htm

Yep, and did a deep scan

Gr. Jan

 

[Bill Sanderson]

We are looking for 51.34.0.0--as you've probably already read above. That
should be what the current SpywareBlaster uses.

--
FAQ for Microsoft Antispyware:
http://www.geocities.com/marfer_mvp/FAQ_MSantispy.htm

Okay, here it goes:
? ver 51.5.0.0 71 kB DScaler
Inno Setup ver 51.13.0.0 75 kB Taskinfo
Inno Setup ver 51.15.0.0 76 kB IZarc
? ver 51.5.0.0 70 kB Everest
Inno Setup ver 51.15.0.0 76 kB PC Wizard 2005
? ver 51.7.0.0 75 kB FileAlyzer
? ver 51.5.0.0 72 kB RegscrubXP
Inno Setup ver 51.13.0.0 77 kB Spybot S&D
Inno Setup ver 51.40.0.0 631 kB GTK
Inno Setup ver 51.40.0.0 631 kB Gimp 2.0
? ver 51.5.0.0 72 kB Lexun Backaup
Inno Setup ver 51.15.0.0 76 kB MBM
Inno Setup ver 51.15.0.0 77 kB TimeWriter Pro

I downloaded and installed SpywareBlaster 3.3 on my system with XP Home NL
(with MSAS real-time protection disabled; no warnings during install); the
related unins000.exe has a size of 1.252 kB, ver 51.34.0.0 and AFAICT the
only unins000.exe file on my systems with a reference to internet sites:
www.innosetup.com and www.remobjects.com !?
Did an uninstall (with MSAS real-time protection still disabled) with
Add/Remove Programs.
Did a deep scan with MSAS (with MSAS real-time protection ENabled): no
issues found.
Installed SpywareBlaster again (with MSAS real-time protection ENabled)
but did NOT enable anything to be sure.
Did a deep scan with MSAS (with MSAS real-time protection ENabled): no
issues found!!!!!!!!!

To morrow (local time now 22:40) I'll try to run SpywareBlaster enabled on
my system with XP PRO UK and have a further look.
I am a lttle baffled now

Gr. Jan

 

[Bill Sanderson]

I've sent this message on, by several channels, but the most effective
channel will be the web report form, from you directly.

It wouldn't surprise me if both channels I've used have gone unread--I've
had no response.

 

[Bill Sanderson]

Sorry--In Microsoft Antispyware, Tools, advanced file analyzer (menu
anomaly!)

At any rate--this appears likely to be fixed in the 5711 definitions
apparently now available--testing asap.