NSIS *after* latest update

[Victjar]

I posted this message on the tail end of an earlier thread but have received no reply. To make sure it doesn't get overlooked, I'm re-posting it as a new thread (feel free to delete previous message):


I just received the identified NSIS Media Extension entry only after applying the Nov. 17th update to Spybot:

HKEY_LOCAL_MACHINE\SOFTWARE\NSIS\Media

I've run several "Search and Destroy" tests during the past few weeks with all previous updates, none of which produced this entry.

I ran the CHECK.BAT per the instructions in this thread and the logit.txt file was empty.

Here's the Spybot results report:

_______________________

NSIS Media Extension: Settings (Registry key, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\NSIS\Media

--------------------
--- Spybot - Search & Destroy version: 1.4 (build: 20050523) ---

2005-05-31 blindman.exe (1.0.0.1)
2005-05-31 SpybotSD.exe (1.4.0.3)
2005-05-31 TeaTimer.exe (1.4.0.2)
2005-08-15 unins000.exe (51.41.0.0)
2005-05-31 Update.exe (1.4.0.0)
2006-02-06 advcheck.dll (1.0.2.0)
2005-05-31 aports.dll (2.1.0.0)
2005-05-31 borlndmm.dll (7.0.4.453)
2005-05-31 delphimm.dll (7.0.4.453)
2005-05-31 SDHelper.dll (1.4.0.0)
2006-02-20 Tools.dll (2.0.0.2)
2005-05-31 UnzDll.dll (1.73.1.1)
2005-05-31 ZipDll.dll (1.73.2.0)
2006-11-17 Includes\Cookies.sbi (*)
2006-10-13 Includes\Dialer.sbi (*)
2006-11-17 Includes\DialerC.sbi (*)
2006-11-03 Includes\Hijackers.sbi (*)
2006-11-17 Includes\HijackersC.sbi (*)
2006-10-27 Includes\Keyloggers.sbi (*)
2006-11-17 Includes\KeyloggersC.sbi (*)
2006-10-13 Includes\Malware.sbi (*)
2006-11-17 Includes\MalwareC.sbi (*)
2006-10-20 Includes\PUPS.sbi (*)
2006-11-17 Includes\PUPSC.sbi (*)
2006-11-17 Includes\Revision.sbi (*)
2006-10-13 Includes\Security.sbi (*)
2006-11-17 Includes\SecurityC.sbi (*)
2006-10-13 Includes\Spybots.sbi (*)
2006-11-17 Includes\SpybotsC.sbi (*)
2005-02-17 Includes\Tracks.uti
2006-11-17 Includes\Trojans.sbi (*)
2006-11-17 Includes\TrojansC.sbi (*)
_______________________

Is this NSIS Media Extension entry still to be considered a false positive?

Thanks in advance!

-- Victjar

[The_Harbinger]

Nsis is most certainly *not* a false positive. In some cases, it very well may be, but I have been continuously recieving mal/adware from said "NSIS media extension". It has installed quite a few different such things, and i sometimes get popups that actually say NSIS media extension right on them. It appears that after I've just run a few different tools it *may* be gone, but I doubt it's gone yet.

[LonnyRJones]

A reply for Victjar here

http://forums.spybot.info/showthread.php?p=54117