Results 1 to 7 of 7

Thread: Possible False-Positive: PornoAssist (registry entry for addthis.com)? Again!

  1. #1
    Junior Member Wendykins's Avatar
    Join Date
    Sep 2010
    Posts
    22

    Default Possible False-Positive: PornoAssist (registry entry for addthis.com)? Again!

    There is a thread a bit further down in the false-positive list labelled "Possible False-Positive: PornoAssist (registry entry for addthis.com)?"

    The link is below:

    http://forums.spybot.info/showthread...r-addthis-com)

    I have been having the same problem with a slightly different registry entry. When I have carried out a Spybot scan, I get this:

    PornoAssist. (When expanded, I get as shown below)

    HKEY_USERS\S-1-5-21-2212291575-3940681457-2494179134-1002\Software\Microsoft\Internet Explorer\DOMStorage\addthis.com

    Spybot is telling me that it is a Trojan. Spybot safely removes it but when I reboot or come back onto the computer again, when I do another scan, it is back there again.

    Can anybody tell me how I get rid of this completely or what the procedure is to eliminate it once and for all please?

    It does not seem to affect my computer in any way. Is this anything to worry about?

    Thank you

    Wendykins

  2. #2
    Member of Team Spybot tashi's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    30,955

    Default

    Hello Wendykins,

    Quote Originally Posted by Wendykins View Post
    There is a thread a bit further down in the false-positive list labelled "Possible False-Positive: PornoAssist (registry entry for addthis.com)?"

    The link is below:

    http://forums.spybot.info/showthread...r-addthis-com)
    Please wait for the update this week which should remove the false positive reported, after updating please perform another scan and see if the entry returns, or not.

    Kind regards.
    Microsoft MVP Reconnect 2018-
    Windows Insider MVP 2016-2018
    Microsoft Consumer Security MVP 2006-2016

  3. #3
    Junior Member Wendykins's Avatar
    Join Date
    Sep 2010
    Posts
    22

    Default

    Quote Originally Posted by tashi View Post
    Hello Wendykins,

    Please wait for the update this week which should remove the false positive reported, after updating please perform another scan and see if the entry returns, or not.

    Kind regards.
    Hi Tashi,

    Okay, understood. So it is not anything to worry about?

    Will you let us know when the update this week is implemented so we know when to perform another scan and let you know if it is still there or not?

    Thanks

    Wendykins

  4. #4
    Member of Team Spybot tashi's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    30,955

    Default

    Hello Wendykins,

    Quote Originally Posted by Wendykins View Post
    Will you let us know when the update this week is implemented so we know when to perform another scan and let you know if it is still there or not?
    From the topic previously linked to.

    Quote Originally Posted by micha View Post
    Thank you for reporting this, please ignore this result, it will be removed from our detection database effective with the next detection update scheduled for Wednesday 2014-05-07.
    Please perform another scan after updating on Wednesday.

    Best regards.
    Microsoft MVP Reconnect 2018-
    Windows Insider MVP 2016-2018
    Microsoft Consumer Security MVP 2006-2016

  5. #5
    Junior Member Wendykins's Avatar
    Join Date
    Sep 2010
    Posts
    22

    Default

    Okay. Thank you.

  6. #6
    Junior Member
    Join Date
    May 2014
    Posts
    1

    Default Possible False-Positive: PornoAssist (registry entry for addthis.com)? Again!

    I've had the same problem as described in this and a prior thread, i.e. delete the "addthis.com" registry key, then it returns--in an hour or in a day, with or without a reboot, with or without going on the internet--with no apparent rhyme or reason (there is another key added as well: "ct1.addthis.com" which I deleted using Regedit--multiple times). I discovered "addthis" not during a routine scan but running it in response to my computer's squirrelly behavior. Performed the delete and it returned to normal so I assumed that it was indeed an active and malicious Trojan. So if the "addthis.com" registry key is not malicious, where does it come from and what does it do? I'm not ready to accept that it's a false positive (not detected by either AVG or Malwarebytes scans), but hoping it is so.

  7. #7
    Member of Team Spybot tashi's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    30,955

    Default

    Hello jvandermade,

    Quote Originally Posted by jvandermade View Post
    I'm not ready to accept that it's a false positive (not detected by either AVG or Malwarebytes scans), but hoping it is so.
    Quote Originally Posted by tashi View Post
    Please perform another scan after updating on Wednesday.
    If the issue is not resolved by the new update I will re-direct you to the malware forum so someone can take a look at the system.

    Best regards.
    Microsoft MVP Reconnect 2018-
    Windows Insider MVP 2016-2018
    Microsoft Consumer Security MVP 2006-2016

Tags for this Thread

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •