sd_user_1103
2007-11-06, 19:57
Hi,
i use SpyBot 1.5.1.15 with Update rules from 1st november '07.
System is "XP Home" / SP2 german, IE 7, all fixes installed via Windows Update.
* SYMPTOM:
Thunderbird Portable 2.0.0.6 (running from USB stick) and getting false positives (think so) about an "NSIS media extension" - after full SD scan.
Note: Thunderbird crashed once yesterday, probably leaving these files on disc, without a chance to delete.
* FILES / FOLDERS INVOLVED:
It looks as if a folder is created temporarily in my user's TEMP location, with the following files:
FindProcDLL.dll
newadvsplash.dll
registry.dll
System.dll
UserInfo.dll
splash.jpg (the Thunderbird portable logo!) <=
The name of the folder changes (with each startup?).
* EXCERPT FROM LOG:
Here an excerpt from my SpyBot Log:
--- Search result list ---
NSIS Media Extension: [SBI $1ADFC7D9] Programm-Verzeichnis (Verzeichnis, nothing done)
C:\Dokumente und Einstellungen\Yo\Lokale Einstellungen\Temp\nse2.tmp\
(Yo is my username. I cut the above log file, because i found no other reference to NSIS...)
I googled and found that other scanners also had problems with the remains of the installer:
http://forums.mozillazine.org/viewtopic.php?t=583572&start=15
(posts from Sept.07)
This is a false positive, right?
Thank you very much.
i use SpyBot 1.5.1.15 with Update rules from 1st november '07.
System is "XP Home" / SP2 german, IE 7, all fixes installed via Windows Update.
* SYMPTOM:
Thunderbird Portable 2.0.0.6 (running from USB stick) and getting false positives (think so) about an "NSIS media extension" - after full SD scan.
Note: Thunderbird crashed once yesterday, probably leaving these files on disc, without a chance to delete.
* FILES / FOLDERS INVOLVED:
It looks as if a folder is created temporarily in my user's TEMP location, with the following files:
FindProcDLL.dll
newadvsplash.dll
registry.dll
System.dll
UserInfo.dll
splash.jpg (the Thunderbird portable logo!) <=
The name of the folder changes (with each startup?).
* EXCERPT FROM LOG:
Here an excerpt from my SpyBot Log:
--- Search result list ---
NSIS Media Extension: [SBI $1ADFC7D9] Programm-Verzeichnis (Verzeichnis, nothing done)
C:\Dokumente und Einstellungen\Yo\Lokale Einstellungen\Temp\nse2.tmp\
(Yo is my username. I cut the above log file, because i found no other reference to NSIS...)
I googled and found that other scanners also had problems with the remains of the installer:
http://forums.mozillazine.org/viewtopic.php?t=583572&start=15
(posts from Sept.07)
This is a false positive, right?
Thank you very much.