updated to avast 5, spybot reports doubled.desktopsmiley

[andy1man1]

OK, about this 'puter:
. Windows XP home, service pack 3

. Firefox 3.5.7

. Spybot S&D 1.6.2.0, last updated on or about 02/05/10

. false positive occurred while applying the Avast 5.0.396 program update

. Spybot S&D log file:
2/7/2010 1:17:27 PM Allowed (based on user decision) value "NoDriveAutoRun" (new data: "hex:F0,03,00,") changed in System Startup user entry!
2/7/2010 1:17:28 PM Allowed (based on user decision) value "NoRecentDocsMenu" (new data: "hex:01,00,00,") changed in System Startup user entry!
2/7/2010 1:17:28 PM Allowed (based on user decision) value "NoRecentDocsHistory" (new data: "hex:01,00,00,") changed in System Startup user entry!
2/7/2010 1:24:41 PM Allowed (based on user decision) value "avast!" (new data: "") deleted in System Startup global entry!
2/7/2010 1:25:47 PM Allowed (based on user decision) value "avast5" (new data: "C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui") added in System Startup global entry!
2/7/2010 1:25:47 PM Encountered and terminated DoubleD.DesktopSmiley in C:\WINDOWS\system32\msiexec.exe!
2/7/2010 1:33:13 PM Allowed (based on user decision) value "NoDriveAutoRun" (new data: "hex:F0,03,00,") changed in System Startup user entry!
2/7/2010 1:33:14 PM Allowed (based on user decision) value "NoRecentDocsMenu" (new data: "hex:01,00,00,") changed in System Startup user entry!
2/7/2010 1:33:14 PM Allowed (based on user decision) value "NoRecentDocsHistory" (new data: "hex:01,00,00,") changed in System Startup user entry!

[Yodama]

the C:\WINDOWS\system32\msiexec.exe is a Windows component and it should not be flagged as DoubleD.DesktopSmiley by the Teatimer.

Restart your computer and retry the installation of Avast5.
Alternatively restart the TeaTimer:

start Spybot S&D
switch to advanced mode
navigate to tools - Resident
disable the checkbox for Resident TeaTimer to disable the TeaTimer
wait about 1 min to make sure that the TeaTimer has completely unloaded
active the checkbox for Resident TeaTimer to restart the TeaTimer


If the msiexec.exe still gets flagged as DoubleD.DesktopSmiley after this procedure please send the file to detections@spybot.info with a reference to this thread

[andy1man1]

Thanks for your reply, Yodama. I am not having any difficulty with this FP. I will note your instruction for future use, as needed. My OP was written as a report of incident. Thank you for the solid security that SS&D provides for our home computing in the wild...