Results 1 to 7 of 7

Thread: Possible F/P, AstaKiller ?

  1. #1
    Security Expert-Emeritus
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    3,934

    Default Possible F/P, AstaKiller ?

    Hello

    Could this be a false positive ?

    AstaKiller: Class ID (Registry key, nothing done)
    HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{6BF52A52-394A-11D3-B153-00C04F79FAA6}

    I have a user and the original thread here

    Thanks
    MalWare Removal University - You too could train to help others
    UNITE & ASAP member since 2006

  2. #2
    Spybot Advisor Team [Retired] md usa spybot fan's Avatar
    Join Date
    Oct 2005
    Posts
    5,859

    Default

    There is a related post by kerol here:


    Getting an answer is one thing, learning is another.


    Microsoft Windows XP Home Edition running on a 2.40GHz IntelŪ PentiumŪ 4 Processor with 512 MB of RAM and a 533 MHz System Bus.

  3. #3
    Member of Team Spybot Buster's Avatar
    Join Date
    Oct 2005
    Location
    Bochum/Germany
    Posts
    389

    Default

    We will fix this false positive in the next detection update scheduled for Friday.
    "The advantage of wisdom is that you can always act the fool. The opposite is quite tough."

    K. Tucholsky

    _______________________________________________________________

    Please help us improve Spybot and download our distributed testing client.

  4. #4
    Security Expert-Emeritus
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    3,934

    Default

    Ohh so the user posted to two forums

    Thanks for the info Buster
    MalWare Removal University - You too could train to help others
    UNITE & ASAP member since 2006

  5. #5
    Spybot Advisor Team [Retired] md usa spybot fan's Avatar
    Join Date
    Oct 2005
    Posts
    5,859

    Default

    Quote Originally Posted by Mr_JAk3 View Post
    Ohh so the user posted to two forums
    In all fairness to kerol, they did wait 5 days without an answer before posting at the Malware Removal forum.

    Getting an answer is one thing, learning is another.


    Microsoft Windows XP Home Edition running on a 2.40GHz IntelŪ PentiumŪ 4 Processor with 512 MB of RAM and a 533 MHz System Bus.

  6. #6
    Security Expert-Emeritus
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    3,934

    Default

    You're rigth about that...

    The reason why he/she got overlooked here is prolly because he/she replyed to the own thread --> it wasn't a 0 reply thread anymore...
    MalWare Removal University - You too could train to help others
    UNITE & ASAP member since 2006

  7. #7
    Junior Member
    Join Date
    Nov 2006
    Posts
    6

    Default already updated but scan still show astakiller threat

    I already updated the SSD, but after I ran a scan, SSD still give me warning of possible threat of AstaKiller.

    When I ran a scan with BitDefender 10, it shows same result.

    Scan result from BitDefender 10:

    <System>=>HKEY_CLASSES_ROOT\MEZZIACODEC.CHL Detected: Trojan.Nebuler-G
    <System>=>HKEY_CLASSES_ROOT\MEZZIACODEC.CHL Deleted
    <System> Update failed

    Scan result from SSD

    Microsoft.WindowsSecurityCenter.FirewallDisableNotify: Settings (Registry change, nothing done)
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify!=dword:0

    AstaKiller: Root class (Registry key, nothing done)
    HKEY_CLASSES_ROOT\MezziaCodec.Chl


    --- Spybot - Search & Destroy version: 1.4 (build: 20050523) ---

    2005-05-31 blindman.exe (1.0.0.1)
    2005-05-31 SpybotSD.exe (1.4.0.3)
    2005-05-31 TeaTimer.exe (1.4.0.2)
    2006-09-11 unins000.exe (51.41.0.0)
    2005-05-31 Update.exe (1.4.0.0)
    2006-02-06 advcheck.dll (1.0.2.0)
    2005-05-31 aports.dll (2.1.0.0)
    2005-05-31 borlndmm.dll (7.0.4.453)
    2005-05-31 delphimm.dll (7.0.4.453)
    2005-05-31 SDHelper.dll (1.4.0.0)
    2006-02-20 Tools.dll (2.0.0.2)
    2005-05-31 UnzDll.dll (1.73.1.1)
    2005-05-31 ZipDll.dll (1.73.2.0)
    2006-11-24 Includes\Cookies.sbi (*)
    2006-10-13 Includes\Dialer.sbi (*)
    2006-11-24 Includes\DialerC.sbi (*)
    2006-11-24 Includes\Hijackers.sbi (*)
    2006-11-24 Includes\HijackersC.sbi (*)
    2006-10-27 Includes\Keyloggers.sbi (*)
    2006-11-24 Includes\KeyloggersC.sbi (*)
    2006-10-13 Includes\Malware.sbi (*)
    2006-11-24 Includes\MalwareC.sbi (*)
    2006-10-20 Includes\PUPS.sbi (*)
    2006-11-24 Includes\PUPSC.sbi (*)
    2006-11-24 Includes\Revision.sbi (*)
    2006-10-13 Includes\Security.sbi (*)
    2006-11-24 Includes\SecurityC.sbi (*)
    2006-10-13 Includes\Spybots.sbi (*)
    2006-11-24 Includes\SpybotsC.sbi (*)
    2005-02-17 Includes\Tracks.uti
    2006-11-24 Includes\Trojans.sbi (*)
    2006-11-24 Includes\TrojansC.sbi (*)


    So, I'm quite confused. If the AstaKiller is false warning, why the BitDefender show the same result.
    Is the Bitdefender also shows a false warning.

    I ran scans with Ad-Aware SE Personal and AVG Anti-Spyware and both show no infections - system is clean.

    Could you clear me on this. It scared seeing warning of possible threats.

    Thanks a lot

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •