Hotsearchbar - NSPR4.DLL

[LightWray]

In the last couple of days, Spybot has started detecting and removing this dll (nspr4.dll). However it broke a program I had created using Visual Studio 2003 (VB .NET) and Crystal Reports to automatically distribute reports via email.

I believe that this dll is a component of either Visual Studio or Crystal Reports. A quick search on the web seems to indicate that it is also part of the Mozilla line of browsers.

I have removed the specific dll from detection at the moment but could someone please look into this and adjust the blanket removal of this dll where it is not part of the Hotsearchbar spyware.

Many Thanks

[Kumar Venkataraman]

(I tried contacting Spybot through the website, but the Submit button on the Contact form does not work!)

The 2005-12-09 update to the detection rules, detects NSPR4.DLL as a threat belonging to the spyware HotsearchBar, and deletes it. NSPR4.DLL is part of Netscape Security Services (NSS).

This causes a fatal issue in the UPS WorldShip software, which has several hundred thousand installations all over the world. In customer workstations who have WorldShip and Spybot installed, WorldShip is unable to startup because it uses NSS and it cannot find the NSPR4.DLL on the system after Spybot Search & Destroy deletes the file.

The questions I have are:
1) Why does Spybot Search & Destroy detect NSPR4.DLL as a spyware?
2) How can we permanently prevent Spybot Search & Destroy from deleting this file? Excluding HotsearchBar from future searches is an option, but we do not want to jeopardize the security on our customers' workstations.

Thanks, Kumar V.
UPS Customer Technology

[bitman]

The question of why NSPR4.DLL is being detected as spyware will need to be answered by the detections team.

To prevent Spybot Search & Destroy from deleting the file:

Expand the HotsearchBar product in Results by clicking the plus sign on the left.
Highlight the NSPR4.DLL detection by left clicking it.
Right click and select; 'Exclude this detection from further searches'.

This will disable the file from being detected without disabling the detection of HotsearchBar.

[Buster]

This false positive will be fixed in the next update.