Fraud.Virus Doctor

[ACupOfCffee]

I was informed of CLIStart.exe being Fraud.VirusDoctor today upon boot. This file is part of my ATI graphics driver which I downloaded from Dell several months ago. I found ran a context menu scan on it from Windows Explorer and found that the detection was not based on signatures but heuristics.

If it helps to note my AV is avast! Professional. From Resident.log

3/28/2009 9:32:50 AM Allowed (based on user decision) value "{18DF081C-E8AD-4283-A596-FA578C2EBDC3}" (new data: "") added in Browser Helper Object!
3/28/2009 9:32:56 AM Allowed (based on user decision) value "AirShare" (new data: ""C:\Program Files\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A91000000001}\AirShareInstaller.exe" 0;1;1;1.6.65;C:\Program Files\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A91000000001}\;") added in System Startup global entry!
3/28/2009 9:33:19 AM Allowed (based on user decision) value "AirShare" (new data: "") deleted in System Startup global entry!
3/29/2009 11:48:45 AM Allowed (based on user decision) value "scrnsave.exe" (new data: "") deleted in Desktop settings!
3/29/2009 11:48:56 AM Allowed (based on user decision) value "scrnsave.exe" (new data: "C:\Windows\system32\AvastSS.scr") added in Desktop settings!
4/3/2009 11:33:38 AM Encountered and terminated Fraud.VirusDoctor in C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe!

I most recently updated Spybot late last night and I got the TeaTimer update March 13 according to the log. I will send an email with the detected file and full logs shortly.

[Yodama]

the false positive on Fraud.VirusDoctor is a detection false positive and will be corrected with the next detection update

[jbetatum]

After starting my computer this a.m. Was greeted w/message from Spybot that it had detected Fraud.VirusDoctor in the pppeuser.exe file. That file is from my backup battery (Cyber Power).
I unchecked the delete file from the spy-bot pop up but left the inform me button highlighted if it encounters again.
I've attached the report.

OS is windows xp sp2 and my last spybot update was 04/04/09.

Is there anything else you need?

[ender222]

Hi,

SD-Resident detectet: "Fraud.VirusDoctor" I hav deletet over the Botton in Checkbox.
My Work in this Time, Configuration in the ATI-CCC,Avivo,Presets.

OS WIN XP/Home SP3
SpybotSD V 1.6.246 last Update 01.04.09
Catalyst V: 9.3 Driver V: 8.591...ATI
Avira premium V:9.0.0421 Vir-def.7.01.03.27 date 07.04.09

I think this is not Danger, and hope this Report help for the next Update in SD.
Result for CCC, not Image/Video in Avivo-Presets, thats all.

by GL