Since the 2005-11-25 update, Spybot identifies a file "C:\Windows\setup1.exe" on my computer as "Phoenix", but I'm reasonably sure that I don't have any keylogger on my system (as I scan daily with spybot, ad-aware and two antivirus apps). The file itself has a version information that says something like "Microsoft Visual Basic 6.0 Setup Toolkit" (Version 6.0.0.8171, Size 286.720 Bytes).

After some searching around, I'm fairly sure now, that this is an false positive!
Have a look at here, where they describe exactly the same file that was found on my computer.
I also scanned it via virusscan.jotti.org and every scanner reported a clean file!

What criteria is the Phoenix detection based upon?
Are there any documents describing this keylogger?