Results 1 to 3 of 3

Thread: symantec antivirus finds Adware.Mirar after immunization

  1. #1
    Junior Member
    Join Date
    Dec 2006
    Posts
    2

    Default symantec antivirus finds Adware.Mirar after immunization

    Symantec antivirus finds Adware.Mirar active after immunizing with spybot

    I'm pretty sure this is a false positive in symantec av itself but it was an unwelcome surprise to see the alert when i thought my computer was clean.
    The alert only popped up today on the weekly manual scan though, not from the auto-protect realtime scan.

    Scan type: Manual Scan
    Event: Security Risk Found!
    Risk: Adware.Mirar
    File: Unavailable
    Location: Quarantine
    Computer: HOMEPC
    User: HOMEPC\Me
    Action taken: Quarantine succeeded
    Date found: 30 septembrie 2007 09:55:34


  2. #2
    Junior Member
    Join Date
    Nov 2005
    Posts
    21

    Default

    See my post in the above thread, this lives in many places and will take a little effort to get rid of. Be sure to close IE out before the scan and the deletes. Then clean disk as well as clear all restore points. Once it is clean, create your new restore point. Good luck on this one.

  3. #3
    Spybot Advisor Team [Retired] md usa spybot fan's Avatar
    Join Date
    Oct 2005
    Posts
    5,859

    Default

    It is most likely a Symantec false positive. Spybot adds the following registry entries during its immunization process:

    Code:
    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\net-nucleus.com]
    *=dword:00000004
    
    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\getmirar.com]
    *=dword:00000004
    
    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\mirarsearch.com]
    *=dword:00000004
    The dword:00000004 in these entries is adding the sites (net-nucleus.com, getmirar.com and mirarsearch.com) to Internet Explorer's restricted zone as described in the following Microsoft article:

    Getting an answer is one thing, learning is another.


    Microsoft Windows XP Home Edition running on a 2.40GHz Intel® Pentium® 4 Processor with 512 MB of RAM and a 533 MHz System Bus.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •