carima enterprises

[mischa12345]

I've got the same message reporting a link to PaintShopPro 8 (german). The link was dead (PSP uninstalled) and not using a direct file link (like msoffice-links in start menu). Unfortunately I deleted the link before reading this. So I cannot send the file to you :(

SD 1.4, rules: 3.3.2006

[Cosmo]

Hi

scanning my system by using spybot from a bart pe-cd I got a (quite sure) false positive for carima enterprises. Questioned file is a desktop-link, that I put as a copy of the original link for Windows Update. The Original link was not been shown as carima-related. When scanning with spybot inside the XP-system, none of these files are shown in the result list. Also: Both files are identical (proved by MD5-check with filalyzer) and show to wupdmgr.exe in the system32-folder. I double-checked the results, they were reproducable.

BTW (only a very little quirk): looking inside spybot in ignore products -> all products there I find carima enterprises listet twice, both entries with category dialer, but looking in the dialer-category there is only one to be seen; another entry is in the trojans-category. Just FYI.

My system: XP pro SP2 with the latest updates, spybot 1.4 with the latest definitions (very last weekend)

Nevertheless: Very many thanks to Pepi and all the others in spybot-team, you are doing a very great job. (Danke Patrick)

Greetings,

Thomas

[MisterW]

Thanks for reporting,

the false positive of Carima Enterprises will be fixed on Friday!

Markus

[Cosmo]

Thank you, Markus, for answering.

I did update yesterday (Saturday) and checked again.

First the good news: The little quirk I mentioned in my previous post (ignore products list) is solved; Carima shows in all products once as dialer, once as trojan.

The bad news: The (IMHO) wrong detection by scanning from a Bart-environment is still there, unchanged from that, what I described before.


Greetings
Thomas

[Cosmo]

Redid the test from Bart PE yesterday (Sunday) after downloading the newest definitions. The problem is still there as described above.

Thomas

[Cosmo]

Redid the test once a week since my last post on every weekend.

There is no change regarding the scan from Bart PE.