PDA

View Full Version : Fixed: False positive: Spybot is flagging Glary Registry Repair as "FlashDollars"



Johnny Sokko
2012-11-16, 16:28
Hello,

I would like to report a false positive, which is: Spybot is flagging Glarysoft Registry Repair as malware called "FlashDollars.RegistryRepair."

I ran a scan with Spybot three days ago, and it showed my system as being clean. Yesterday morning, though, I downloaded and installed Glarysoft Registry Repair, and before I went to bed, I scanned my system again, and this time, Spybot reported that it found malware — which it identified as FlashDollars.RegistryRepair.

I suspected that the detection might be a false positive, so I did not allow Spybot to remove the detection. I did, however, remove Glarysoft Registry Repair, and then I scanned my computer again, and this time the scan was clean — so I know that the detection was definitely related to my installation of the Glarysoft program.

I'm fairly certain that Glarysoft is a reputable company, so I do not believe that they would wrap any of their software with malware, so I'm sure that this is just a false positive that needs to be fixed.

I believe the problem stems from the fact that the name of GlarySoft's program Registry Repair is very similar to the name of the rogue program described here:http://forums.spybot.info/showthread.php?t=37470

Not only are the names of the two products similar (i.e., they both use the phrase "Registry Repair" in their names), but I would also be willing to bet that
the Glarysoft program also has an executable named "RegistryRepair.exe" (or something similar) somewhere in its program as well, so it's easy to see why Spybot may have incorrectly flagged the Glarysoft program as being the same as the rogue registry cleaner (i.e., FlashDollars.RegistryRepair) that's described in the above link.

PS: I'm not sure if you need this information or not, but in case you do, I'm using the latest version of Spybot S & D (1.62) with the latest updates installed, and my operating system is Windows XP. If you need any other information, please let me know. I would like to help with getting this issue resolved. :-)

Yodama
2012-11-19, 07:59
Thank you for reporting this issue.
I can confirm a false positive with the App Path and the Uninstall registry paths.
The detection rules for FlashDollars.RegistryRepair will be adjusted with the next detectin update scheduled for Wednesday 2012-11-21.

Johnny Sokko
2012-11-19, 15:47
Thank you for letting me know what you found out. :)