Nurech in Bitcomet ?

[Diabolo]

Hi,

When I scan my computer with SpyBot 1.4 (with latest definitions), the following "problem" is found :

Nurech: User settings (Registry value, nothing done) HKEY_USERS\S-1-5-21-606747145-725345543-111207290-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\*\upnp.exe


I have found the following key in the registry :

[HKEY_USERS\S-1-5-21-606747145-725345543-111207290-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"C:\\Program Files\\Communication\\BitComet\\tools\\UPNP.exe"="UPNP config tool for BitComet"


Bitcomet 0.84 is installed in my computer.

The "UPNP config tools for Bitcomet" (UPNP.exe) is a part of Bitcomet.

So, is this a false positive ?

Or does Bitcomet contain the Nurech worm ?

Thanks.

[MisterW]

The detection for Nurech has been adjusted and I can confirm that it was a false positive.

A fixed detection file will be released on Wednesday.

regards
Markus

[Diabolo]

Thanks a lot for your quick reply !

[yman25]

You can use the new version of limewire which is faster and users can now use web proxies to route their downloads to protect their identity.

[one eyed rider]

dont use limewire. use utorrent instead

[tashi]

You can use the new version of limewire which is faster and users can now use web proxies to route their downloads to protect their identity.

dont use limewire. use utorrent instead

A huge amount of users with infections produced by the use of P2P fill up our malware forums, which is why we have these stickies:


File Sharing, otherwise known as Peer To Peer. (P2P)
Particularly post #4, http://forums.spybot.info/showpost.p...03&postcount=4

Regards.

[md usa spybot fan]

yman25:
one eyed rider:

I am confused by both of your comments in a year and a half old thread posted in False Positives forum concerning a false positive in the detection for the Trojan "Nurech".

Are you indicating that a false positive has returned in the detection for the Trojan "Nurech" or just picking random threads to post recomendations for P2P products because Diabolo was using Bitcomet a year and a half ago?