Results 1 to 10 of 10

Thread: False Positive

  1. #1
    Junior Member
    Join Date
    Oct 2006
    Posts
    8

    Default False Positive

    Mind checking the log possible F/P for searchclickads trojan.

  2. #2
    Security Expert-Emeritus
    Join Date
    Oct 2005
    Posts
    5,025

    Default

    Hi

    Why are you still running 1.3 and why do you think its a false possitive ?

    "--- Spybot - Search && Destroy version: 1.3 ---"
    ~~~~~~~~~~~~~~~~~~~~~~~
    Microsoft MVP Windows-Security 2006

  3. #3
    Junior Member
    Join Date
    Oct 2006
    Posts
    8

    Default

    Old backup

    The trojan isn`t detected by any other anti spyware/virus program.
    Not the first F/P i`ve posted about either.

  4. #4
    Spybot Advisor Team [Retired] md usa spybot fan's Avatar
    Join Date
    Oct 2005
    Posts
    5,859

    Default

    UnknownFate:

    Quote Originally Posted by UnknownFate View Post
    The trojan isn`t detected by any other anti spyware/virus program.
    re: The following detection:

    Code:
    SearchClickAds: Interface (Registry key, fixed)
      HKEY_CLASSES_ROOT\Interface\{6C51F7E9-8542-4F25-A30F-2060157752E1}
    That registry entry is listed, among others, in the following eTrust Spyware Encyclopedia article:

    In addition Computer Associates categorizes it as Adware not a Trojan.

    Getting an answer is one thing, learning is another.


    Microsoft Windows XP Home Edition running on a 2.40GHz IntelŪ PentiumŪ 4 Processor with 512 MB of RAM and a 533 MHz System Bus.

  5. #5
    Junior Member
    Join Date
    Oct 2006
    Posts
    8

    Default

    Spybot has it classified as a Trojan.

  6. #6
    Member of Team Spybot tashi's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    30,961

    Default

    Quote Originally Posted by LonnyRJones View Post
    Hi

    Why are you still running 1.3 and why do you think its a false possitive ?

    "--- Spybot - Search && Destroy version: 1.3 ---"
    Quote Originally Posted by UnknownFate View Post
    Old backup

    The trojan isn`t detected by any other anti spyware/virus program.
    Not the first F/P i`ve posted about either.
    Yes and you were answered here:
    http://forums.spybot.info/showthread.php?t=8431
    Thank you for reporting.

    Perhaps I am mis-understanding, you are now posting a possible F/P from an old backup running Spybot-S&D version 1.3?
    Microsoft MVP Reconnect 2018-
    Windows Insider MVP 2016-2018
    Microsoft Consumer Security MVP 2006-2016

  7. #7
    Junior Member
    Join Date
    Oct 2006
    Posts
    8

    Default

    Got the same results using S&D 1.4.

    Webroot doesn`t detect anything, so I don`t think it`s the Scaggy spybot

  8. #8
    Retired
    Join Date
    Oct 2005
    Posts
    566

    Default

    We checked our detection and can NOT confirm the FP. The detected interface belongs to SearchClickAds.
    SearchClickAds adds itself as browser helper objekt (BHO) to the Internet Explorer to start automatically if the IE is started. It connects to the internet in background, installs itself without user consent and causes popups and error messages.
    May be installed by other trojan horses.

    best regards
    Markus

  9. #9
    Junior Member
    Join Date
    Oct 2006
    Posts
    8

    Default

    Ran a scan having nothing but Mcafee Internet Security Suite 2007 and Spybot installed. SearchClickAds trojan detected. After uninstalling Mcafee spyware was no longer detected. Seems to be a F/P on one of the Mcafee components again.

  10. #10
    Retired
    Join Date
    Oct 2005
    Posts
    566

    Default

    I can confirm that there is a false positive with McAfee Internet Security Suite 2007.
    Sorry for the confusion but we did not see that the problem is in combination with McAfee.

    the fp will be fixed with the next update , which is expected for today.

    Thanks for reporting

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •