SearchSquire and MediaTickets CDT

[Kent]

Afternoon...

First of all I am running WindowsXP SP2 with all MS
Patches installed and have scanned my PC for spyware
using As-Aware SE and SpybotS&D 1.3TX (TX version Fixes
DSO Exploit problem) and for virii with NAV2004. All
scans came up clean.

I would like to know why we have not heard back from any
MS people on this "SearchSquire.com" False Positive and
now another False Positive called "MediaTickets CDT" that
Microsoft AntiSpyware (MSAS) Beta1 finds.

I posted earlier that I believe that the FP was due to
the IE-SPYADS program that adds the SearchSquire.com to
the "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentV
ersion\Internet Settings\ZoneMap\Domains" folder with
DWORD value of 4. This also adds the SearchSquire to the
Restricted Sites Zone. Or it also could be the SpybotS&D
1.3TX "Immunize" feature.

I did a test by removing SpybotS&D 1.3TX, Ad-Aware SE
Plus 1.05, and the IE-SPYADS setup then removing all the
Domains in
the "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Current
Version\Internet Settings\ZoneMap\Domains" folder
and "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentV
ersion\Internet Settings\ZoneMap\Domains" folder. I
rebooted then scanned with MSAS and came up totally clean.

I then installed IE-SPYADS, rebooted, and rescanned with
MSAS. MSAS finds the "SearchSquire.com" once again
in "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVe
rsion\Internet Settings\ZoneMap\Domains".

I then reinstalled SpybotS&D 1.3TX, got all the latest
updates, and used the "Immunize" feature that adds more
protection against Spyware on my PC. By manually
checking the Registry I now have a SearchSquire.com entry
in both HKLM and HKCU. I then ran another MSAS scan.
The scan came up with the "SearchSquire.com" hit as
before but now it also comes up with multiple
(9) "MediaTickets CDT" hits
in "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentV
ersion\Internet Settings\ZoneMap\Domains".

So to summarize if I don't install IE-SPYADS (a program
that help keeps my PC spyware free) and I don't use the
SpybotS&D "Immunize" feature (Which also helps keep my PC
Spyware free) MSAS does not find anything.

Hope someone from MS can give me a reason for this.

As stated in my ealier post I do like this software and
do not mind Beta testing it...but I would like to know
that I'm being heard and that MS is investigating this
issue.

Thanks,

Kent

 

[Mike...]

I just wanna say that I have the same programs installed
(NAV 2005 though), including IE-SPYAD (not really a
program but still), and I get the same false positives.
These are all blocked sites, strange that MS AS would
report these, what with MS behind the internet zones
stuff in the internet properties and all. Otherwise, I
like the program.