Spybot Logo
Go Back   Safer-Networking Forums > Software > Spybot-S&D > False Positives
Register ProjectsBlogs FAQ Search Today's Posts Mark Forums Read Home Support Download Donate

Reply
 
Thread Tools Display Modes
Old 2007-11-08, 04:50   #1
toolfortheman
Junior Member
 
Join Date: Nov 2007
Posts: 1
Default Tvichw32.sys

With the latest scan I get a TVICHW32.SYS file
showing up? Has anyone else gotten this?
it's found in c:\windows\system32\drivers file
When I do a search on Google, I get some Tiawan
company driver? <a href="http://www.entechtaiwan.net/dev/hw32/faq.shtm" target="_blank">
PHP Code:
http://www.entechtaiwan.net/dev/hw32/faq.shtm 
This is all Greek to me. Is this a false positive?
If I have posted in the wrong place, sorry.

Last edited by tashi; 2007-11-08 at 05:59. Reason: disabled url so we are not source of traffic. ;-)
toolfortheman is offline   Reply With Quote
Old 2007-11-08, 08:09   #2
Yodama
Member of Team Spybot
 
Yodama's Avatar
 
Join Date: Oct 2005
Location: Buchenheim
Posts: 935
Blog Entries: 1
Rated LASSHes: 119
Default

please follow the steps in this post
for submitting a false positive to avoid many questions.

so but since you did not, I will have to ask you a couple of questions, ok, some would have been asked anyway

If you follow the link you posted, you can see that the file in question is not a driver but a tool for accessing the hardware. Looking up the description for the product 'eSupport.FFBiosExt' within Spybot S&D will tell you that this file also came along an online check for the mainboard Bios. This was added to detection as PUPS (possibly unpopular software) because it failed to have an uninstall option while it installed a service.

Since the only thing you found is the file named above, it could be the case that the file is used by other software for hardware analysis. If you have such software installed please name it, so we can check if it is a false positive.

Attaching a Spybot S&D log to your next post will also help us determin if this is a false positive.
__________________
born in the shadow to die in the shadow, that is the fate of the shinobi

Spybot S&D Downloads

Please help us improve Spybot and download our distributed testing client.
Yodama is offline   Reply With Quote
Old 2007-11-08, 09:03   #3
Maestro
Junior Member
 
Join Date: Oct 2007
Posts: 7
Default eSupport.FFBiosExt

I've been using Spybot for a while now, and it has proven to be a great program. Today I did the latest update and then scanned my latop. This scan showed that I had this on my machine: eSupport.FFBiosExt. Naturally, I went ahead and fixed the 'problem.' But I just wondered if anyone could tell me a little more about this eSupport.FFBiosExt thing?
Maestro is offline   Reply With Quote
Old 2007-11-08, 12:32   #4
Yodama
Member of Team Spybot
 
Yodama's Avatar
 
Join Date: Oct 2005
Location: Buchenheim
Posts: 935
Blog Entries: 1
Rated LASSHes: 119
Default

hi,

eSupport.FFBiosExt
is a Firefox extension that allows reading out the Bios information and helps finding an update.
Unfortunately it also installs the file and a service, because the vendor of this software did not supply an uninstall functionallity it has been labled as PUPS (Possibly Unpopular Software).

As it turns out the TVICHW32.SYS is also being used with other hardware analysis software, which may run, for instance with ATI software.

We will exclude detection on this file with the next detection update.
__________________
born in the shadow to die in the shadow, that is the fate of the shinobi

Spybot S&D Downloads

Please help us improve Spybot and download our distributed testing client.
Yodama is offline   Reply With Quote
Old 2007-11-08, 14:34   #5
Kavanagh
Junior Member
 
Join Date: Nov 2007
Posts: 1
Default

toolfortheman writes:-
With the latest scan I get a TVICHW32.SYS file
showing up? Has anyone else gotten this?

Yes, same here. File was written in January 2007 and I have had no trouble since then. Probably a false +ve.
Richard
Kavanagh is offline   Reply With Quote
Old 2007-11-08, 16:59   #6
Maestro
Junior Member
 
Join Date: Oct 2007
Posts: 7
Default Reply

Thanks for the info, Yodama.

So, I actually deleted that eSupport.FFBiosExt extension after Spybot identified it as a threat. Should I restore it?
Maestro is offline   Reply With Quote
Old 2007-11-08, 17:58   #7
Icaro
Junior Member
 
Join Date: Nov 2007
Posts: 5
Default Good evening

Hello to all,


I've just proceeded a spybot 1.4 scan on my pc and I noticed this "eSupport.FFBiosExt" issue being pop up at scan time in threats results panel.
So I found this thread useful to get more relevant info about whether or not we should "destroy" this thing.
But before doing so, we, users, still need the confirmation from Yodama Sama on the "false positiveness" of this threat.
So Yodama San, what do you say? "false positive"or not?

Icaro is offline   Reply With Quote
Old 2007-11-09, 12:13   #8
Yodama
Member of Team Spybot
 
Yodama's Avatar
 
Join Date: Oct 2005
Location: Buchenheim
Posts: 935
Blog Entries: 1
Rated LASSHes: 119
Default

Quote:
Originally Posted by Icaro View Post
So Yodama San, what do you say? "false positive"or not?
yes consider it a false positive , and restore the file if needed. The file is part of tools that access hardware, for instance hardware analysis tools.

*blush*
I have not been addressed with san for a while and do not remember to have ever been addressed with sama
__________________
born in the shadow to die in the shadow, that is the fate of the shinobi

Spybot S&D Downloads

Please help us improve Spybot and download our distributed testing client.
Yodama is offline   Reply With Quote
Old 2007-11-09, 13:16   #9
Ol PB
Junior Member
 
Join Date: Nov 2007
Posts: 1
Default Same issue - Dell support tool?

I have the same detection as everyone else. Assuming that this isn't a new addition to the spybot scan, then I suspect that it has been loaded as part of the Dell support tools that I installed in the last week or so, as recommended by their 'Support agent' that keeps popping up.
Ol PB is offline   Reply With Quote
Old 2007-11-09, 20:05   #10
owilky1
Junior Member
 
Join Date: Nov 2005
Posts: 4
Default

i have this today the last thing i did was to run Nvidia's display optimization wizard.
It's possible this app uses it!

The reason i am checking it now is because i had my first problem with firefox for a long long time. Today it would not work for several minutes.
ie7 did work but i hate using it.

It was not on my system before that as far as i know, at least not yesterday!
owilky1 is offline   Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump


All times are GMT +2. The time now is 16:29.


Copyright © 2000-2010 Safer-Networking Limited. All rights reserved.