False positive? Choplifter HD on steam (ChopLaunch.exe as Bancos.Santander)

[insfrag]

Hi all,

I just bought the ChopLifter HD game on Steam today and when I try to launch it, Spybot kills it immediately, recognizing the Bancos.Santander malicious software.

My OS is windows 7 Ultimate SP1, 64 bit.
Firefox 9.0.1, IE 9.0.4
Spybot 1.6.2.46, did the latest update right before this post (January 21st), but the about page says "Latest detection update 18/01/2012".
The (supposedly) false positive occurs when I try to launch the game.
I've attached the screenshot of the Spybot popup.
In the Spybot logs (resident.log), there is this line regarding this problem:
21/01/2012 16:19:10 Encountered and terminated Bancos.Santander in f:\valve\steam\steamapps\common\choplifter hd\ChopLaunch.exe!

I've also ran Avast 6.0.1367, with today's definitions (120121-0) on the folder containing the exe, no problems/threats were found. I'm currently scanning my entire system as well.

At least one other user of Steam has the problem (and another doesn't):
http://forums.steampowered.com/forum....php?t=2484174

Please help, thank you!

[Yodama]

hello,

thank you for reporting this issue.

Please do a right click on the file in question and scan it with Spybot S&D.

a)
If the file is still detected as Bancos.Santander please send the file to detections@spybot.info with a reference to this thread.

b)
If the file does not get detected as Bancos.Santander you got a random TeaTimer false positive that may occur if the TeaTimer has issues reading the detection database or the file to be scanned. In this case it is recommended to disable the TeaTimer since you are already using a different real time protection.
To disable the TeaTimer please do the following:

• run Spybot S&D and switch to advanced mode
• navigate to tools - resident
• uncheck the checkbox for resident TeaTimer to close and disable TeaTimer

[insfrag]

Hello Yodama,

Thank you for your help!
As I didn't have the contextual menu for Spybot, I uninstalled it and reinstalled it. I guess the first time I installed it I didn't check the checkbox.
Since the problem is still found in the exe, I am sending it to the email address you provided me with, in a RAR file.

Best regards, insfrag.

[Yodama]

Hello,

thanks for sending in the file.
Updated detection rules fixing this heuristics false positive will be released on Wednesday 2012-01-25.

[insfrag]

Thank you for your help & quick reaction.

Take care.