Fixed: Possible False-Positive: PornoAssist (registry entry for addthis.com)? Again!

W

Wendykins

New member
There is a thread a bit further down in the false-positive list labelled "Possible False-Positive: PornoAssist (registry entry for addthis.com)?"

The link is below:

http://forums.spybot.info/showthrea...-PornoAssist-(registry-entry-for-addthis-com)

I have been having the same problem with a slightly different registry entry. When I have carried out a Spybot scan, I get this:

PornoAssist. (When expanded, I get as shown below)

HKEY_USERS\S-1-5-21-2212291575-3940681457-2494179134-1002\Software\Microsoft\Internet Explorer\DOMStorage\addthis.com

Spybot is telling me that it is a Trojan. Spybot safely removes it but when I reboot or come back onto the computer again, when I do another scan, it is back there again.

Can anybody tell me how I get rid of this completely or what the procedure is to eliminate it once and for all please?

It does not seem to affect my computer in any way. Is this anything to worry about?

Thank you

Wendykins
 
tashi said:
Hello Wendykins,

Please wait for the update this week which should remove the false positive reported, after updating please perform another scan and see if the entry returns, or not. :)

Kind regards.
Click to expand...

Hi Tashi,

Okay, understood. So it is not anything to worry about?

Will you let us know when the update this week is implemented so we know when to perform another scan and let you know if it is still there or not?

Thanks

Wendykins
 
Hello Wendykins, :greeting:

Wendykins said:
Will you let us know when the update this week is implemented so we know when to perform another scan and let you know if it is still there or not?
Click to expand...

From the topic previously linked to. :)

micha said:
Thank you for reporting this, please ignore this result, it will be removed from our detection database effective with the next detection update scheduled for Wednesday 2014-05-07.
Click to expand...

Please perform another scan after updating on Wednesday. :kboard:

Best regards.
 
Possible False-Positive: PornoAssist (registry entry for addthis.com)? Again!

I've had the same problem as described in this and a prior thread, i.e. delete the "addthis.com" registry key, then it returns--in an hour or in a day, with or without a reboot, with or without going on the internet--with no apparent rhyme or reason (there is another key added as well: "ct1.addthis.com" which I deleted using Regedit--multiple times). I discovered "addthis" not during a routine scan but running it in response to my computer's squirrelly behavior. Performed the delete and it returned to normal so I assumed that it was indeed an active and malicious Trojan. So if the "addthis.com" registry key is not malicious, where does it come from and what does it do? I'm not ready to accept that it's a false positive (not detected by either AVG or Malwarebytes scans), but hoping it is so.
 
Hello jvandermade,

jvandermade said:
I'm not ready to accept that it's a false positive (not detected by either AVG or Malwarebytes scans), but hoping it is so.
Click to expand...

tashi said:
Please perform another scan after updating on Wednesday. :kboard:
Click to expand...

If the issue is not resolved by the new update I will re-direct you to the malware forum so someone can take a look at the system. :)

Best regards.
 
You must log in or register to reply here.
Back
Top