MusicMatch bookmark detection.

[md usa spybot fan]

MusicMatch bookmark detection.

This post is actually more of a matter of curiosity rather than a report of a real false positive (since the detection is so minor that it is not a real concern).

After the 2006-06-02 updates, I received the following detection:


MusicMatch

Bookmark (Internet Explorer username)
Internet Explorer (username) MusicmatchJukebox - World's best music player (http://www.musicmatch.com/)I am curious as to what is so ominous about a bookmark to www.musicmatch.com?

MusicMatch originally came loaded on my system, but has since been removed. Because MusicMatch is no longer on my system, I am not absolute sure about what detections there are in Spybot for MusicMatch. However, from the Ignore products list in Spybot it would appear that the only detection for "MusicMatch JukeBox" is "Tracks" (which would only come into play if doing a "Usage Tracking" scan). If the software itself is not a danger than why would the bookmark to the www.musicmatch.com site be flagged?

As I indicated in the beginning of this post that it is really a matter of curiosity. In fact, if the MusicMatch bookmark is actually benign, having a detection for a benign bookmark actually makes it easier to answer the questions that periodically pop up in this forum such as:
"Spybot hasn’t detected anything in months, how do I know it is working".All the responder to such a query would have to do is tell the poster to access www.musicmatch.com, add the site to their favorites and then run a scan. It would prove/disprove if Spybot was actually detecting problems.

Feed back from a "Member of Team Spybot" would be appreciated.

Regards,
md usa spybot fan

[Yodama]

first thanks for reporting, "musicmatch.com" really has been falsely added to detection.
unfortunately it is not only the bookmark that gets detected here, it is also included in the hosts file and the immunization.
so we will have to think of something to get this undone :blush:

and about your second question, I will make it a topic for the next local Teammeeting.

[RollaCoasta]

(...)
unfortunately it is not only the bookmark that gets detected here, it is also included in the hosts file and the immunization.
so we will have to think of something to get this undone :blush:
(...)
Hi,
I just wanted to report this false positive here, but found out MD was faster :bigthumb:
But if this is also included in the hostsfile and the immunization, shouldn't I have had problems, running MusicMatch (de_9.00.5100) or accesing the site? Cause nothing like that happend. I just found, that it was detected on a weekly scan, in bookmarks of my Firefox and IE profiles.

Regards
RollaCoasta

[md usa spybot fan]

Yodama:

The detection for the MusicMatch bookmark appears to have been eliminated with the 2006-06-10 updates.

Thank you.

[Yodama]

But if this is also included in the hostsfile and the immunization, shouldn't I have had problems, running MusicMatch (de_9.00.5100) or accesing the site? Cause nothing like that happend.



jein :p

putting a domain into immunization still allows the IE to access the site, it is just a restricted zone, so many active content is disabled. Firefox for example is not affected by this.

The hosts file is something different. With the hosts added to the hosts file and (usual redirection to localhost) the hosts are blocked for the computer (except those listed in dnsapi.dll). But this only applies to the added hosts, in our false positive here, the standard host "www.musicmatch.com" was not entered. The hosts file requires every single host to be redirected to be added. Thus "www.musicmatch.com" was reachable.
The false positive added "musicmatch.com" , thus if you entered "musicmatch.com" in the browser (or tried to ping it) it was not available if the hostfile has been added.

Running MusicMatch was also not affected, because only the domain was falsely added to detection no file and no registry entry from musicmatch.

I hope that clearyfies all questions :blush: