SPR/Madtol.C program

[David H. Lipman]

From: "Kayman" <[email protected]>

| Dear David:
|
| Only file ppv5exc.dat indicates 0 bytes.
|
| Details of the other 7 files are as follows:
|
| DF31B3.temp, DF4513.temp, DF981A.temp and DF9D21 all have 32.0 KB.
|
| ppfile.dat =>499.0 KB, ppinfo.dat => 201 KB and pploc.dat => 553.0 KB.
|
| Sorry David, I would not know whether the file handle is or is not in use, I
| don't even know what a file handle is. So I looked up "Using a File Handle"
| in the Microsoft Knowledge Base (MSDN Library) but having a hard time to
| comprehend all this. The write up with respect to "File Basic Information" is
| also way beyond my understanding.
|
| When I submitted the files to (e-mail address removed) I don't think opening any
| files. I just clicked the 'attach' button in Outlook Express and looked
| for/inserted the appropriate attachment which I then submitted accordingly.
| Kind regards,
|
| "David H. Lipman" wrote:

The concept of the "file handle being open" just means that a program or the Operating
System is presently using that file exclusively and will not other activity access said
file. If you try to submit a file like this, it will be of zero bytes. If you try to copy
a file like this you will get "access denied", if you try to scan a file like this the AV
scanner will generate an error message indicating it can't scan the file.

OK, back to the problem...

So the other files that were submitted to Virus Total, were not zero byte files, were
flagged by AntiVir to have the "SPR/Madtol C" and Virus Total showed NO anti Virus vendor
could find anything and all vendors indicated "No Virus Found" ?

If that is the case, it sounds like AntiVir is declaring a False Positive !

I have found another poster in a non-Microsoft News Group indicating that has indicated --
"...i get a message from the AntiVir program that i have a problem and it's name is
Spr/madtol.c i also ran AVG and it does not come up on that at all"

I have a strong feeling this is a False Positive declaration.

 

[Guest]

Thanks Dave.
Some new developments.
I clicked on Spyware Doctor and prior loading the AntiVir warning sign
popped up again. Like several times before the number (following"MC") has
changed, this time to "2C". I immediately clicked Start=>Run and typed
C:\DOCUME~1\PATTAY~1\LOCALS~1\TEMP\MC2C.TMP into the space provided for.
For the first time this file showed up!
I accessed VirusTotal, attached the file but was unable to send off the
message. Without my doing, the computer then behaved somewhat erratic, making
several "clicking" sounds in quick repetitions (identical sounds/noises when
using the mouse). A window popped up displaying a message that it the message
could not be send (these are not the exact words as the window disappeared
very quickly). Many more of the AntiVir warning signs and New Message signs
from Outlook Express popped up in quick successions and for a short while my
computer "froze". Again, without my doing the, message to scan@ virustotal
was saved in the Outlook Express Outbox but without attachment.
I again clicked Start=>Run and typed
C:\DOCUME~1\PATTAY~1\LOCALS~1\TEMP\MC2C.TMP into the space provided for but
this time the file has disappeared.

Also, while the AntiVir warning sign is showing it seems to be the dominant
display on my desktop - it always will stay on top - for example when opening
VirusTotal or click Start=>Run these applications can not be moved on the top
of the Warning sign but stay underneath.

Coming back to your response. If this is a False Positive declaration,
should I just leave everything as is and ignore the AntiVir Warning sign?
Or is there anything else I could do like deleting the AntiVir and Spyware
Doctor Programms and the files I had sent to VirusTotal?
Is a False Positive declaration something I should be concerned with and if
so, is there a program commercially available for removing this?
If you wish I could send you a screenshot which shows the AntiVir Warning
sign.
I also wish to confirm that none of the 20 Anti Virus vendors found any
viruses in the files sent to VirusTotal.
Best regards,

 

[David H. Lipman]

From: "Kayman" <[email protected]>

| Thanks Dave.
| Some new developments.
| I clicked on Spyware Doctor and prior loading the AntiVir warning sign
| popped up again. Like several times before the number (following"MC") has
| changed, this time to "2C". I immediately clicked Start=>Run and typed
| C:\DOCUME~1\PATTAY~1\LOCALS~1\TEMP\MC2C.TMP into the space provided for.
| For the first time this file showed up!
| I accessed VirusTotal, attached the file but was unable to send off the
| message. Without my doing, the computer then behaved somewhat erratic, making
| several "clicking" sounds in quick repetitions (identical sounds/noises when
| using the mouse). A window popped up displaying a message that it the message
| could not be send (these are not the exact words as the window disappeared
| very quickly). Many more of the AntiVir warning signs and New Message signs
| from Outlook Express popped up in quick successions and for a short while my
| computer "froze". Again, without my doing the, message to scan@ virustotal
| was saved in the Outlook Express Outbox but without attachment.
| I again clicked Start=>Run and typed
| C:\DOCUME~1\PATTAY~1\LOCALS~1\TEMP\MC2C.TMP into the space provided for but
| this time the file has disappeared.
|
| Also, while the AntiVir warning sign is showing it seems to be the dominant
| display on my desktop - it always will stay on top - for example when opening
| VirusTotal or click Start=>Run these applications can not be moved on the top
| of the Warning sign but stay underneath.
|
| Coming back to your response. If this is a False Positive declaration,
| should I just leave everything as is and ignore the AntiVir Warning sign?
| Or is there anything else I could do like deleting the AntiVir and Spyware
| Doctor Programms and the files I had sent to VirusTotal?
| Is a False Positive declaration something I should be concerned with and if
| so, is there a program commercially available for removing this?
| If you wish I could send you a screenshot which shows the AntiVir Warning
| sign.
| I also wish to confirm that none of the 20 Anti Virus vendors found any
| viruses in the files sent to VirusTotal.
| Best regards,

If none of the AV vendors found anything on a file declared to have the SPR/Madtol.C, and is
what not a zero byte file than I strongly think it is a False Poistive declaration.

I am waiting for another poster to send his file(s) to Virus Total. If he too finds a
report where "where no virus found" is indicated for all the AV vendors, then AntiVir has a
definite False Positive declaration problem. That poster also noted the file flagged was a
..TMP file ( mc22.tmp ). Not unlike your file.

 

[Md. Younus Ali]

SDStbRes.dll

url:http://www.ureader.com/msg/12892024.aspx

 

[Malke]

Md. Younus Ali wrote:

strange URL

I can't imagine why you would have asked someone to click on an Internet
link (which is obviously not anything to do with email) to do this
unless you are a malicious spammer. On the off-chance that you are
well-meaning, contact McAfee for that .dll.

http://forums.mcafeehelp.com/ - McAfee support forum
http://us.mcafee.com/root/support.asp - McAfee Support
http://www.mcafeehelp.com/


Malke