PDA

View Full Version : Fixed (Heuristics): Is RedCrab calculator spyware?



Aloysius
2010-01-04, 06:18
I downloaded RedCrab the Calculator v1.1 last night; and then I scanned with Norton Antivirus, Ad-Aware, and Malwarebytes' Antmalware in addition to Spybot Search & Destroy. None found any malware except Spybot S&D, which marked the scanned file with a red X and reported scan status as "Fraud.SecurityTool."

I e-mailed the developer, who promptly responded with the following:

Hi xxx,

thanks for letting me know..

Sorry for the problem you encountered. Be assured that my software is safe. I haven't install Spybot Search & Destroy yet. But I read over the internet that this software found more suspected files than any another software, but it is not clear if the alert is really correct. My suspect leading to this tag: RedCrab includes the indy software library for internet access. This means whenever RedCrab is started during an open internet access, it ask for the file: http://www.redchillicrab.com/download/version.rcb . This is a 8 byte file that includes the number of the actual version of redcrab. So RedCrab can inform you whenever a new version is available. Most software do it this way.

It is possible that <Spybot Search & Destroy> found this procedure.

Pleace check if your RedCrab software is the original file. The actual zip file of version 1.10.10 is 1.134KByte or 1.161.947 Byte.

It is available online through various software database. They usually checked the software before they put it online:

Lookup link for reference:

http://www.softpedia.com/get/Science-CAD/Red-Crab.shtml

http://download.cnet.com/RedCrab/3000-2053_4-10976974.html?tag=contentMain;contentBody

or a copy of the following email:

Dear Developer,
Thank you for submitting your software product RedCrab 1.01, it has been tested by the Soft-Files.com editors team and found to be completely clean of adware/spyware components.
Your product review page is located at: http://www.soft-files.com/redcrab_69701.html.
Your software has received 5 stars award from Soft-Files editors team, based on price, usability, documentation & support.

Hope I can put some light in your concern.

Please feel free to email me if you have any further questions.

Have fun with RedCrab !

Regards

Gerd
___________________________

I verified that I had the same size file referenced in the e-mail. A Spybot report and an image of the Spybot report on the suspect scanned file are attached. I update my copy of Spybot S&D weekly.

I wonder if this is a false positive finding on the part of Spybot S&D.

:thanks:

Yodama
2010-01-04, 14:02
Hello,

thank you for reporting this issue. I can confirm that it is a false positive. It will be fixed with the detection update scheduled for Wednesday 2010-01-06.