Update list shown currently unavailable

AplusWebMaster

AplusWebMaster

New member
Advisor Team
FYI...

- http://www.spybotupdates.com/index.php?page=updatehistory
Latest Update: 2005-11-25
Dialer
+ DialerPlatform
Hijacker
+ CoolWWWSearch.SearchAssistant + Smitfraud-C. + CoolWWWSearch.Feat2Installer + CoolWWWSearch.Service + CoolWWWSearch.Feat2DLL
Keylogger
+ Phoenix
Malware
+ VirtuMonde + SintCorporation
PUPS
+ Download Accelerator Plus
Trojan
+ Z-Quest

(Update list shown currently unavailable using SSD app update as of date/time of this post.):confused:
 
Ditto here in Canada but the detection rules executable Here seem to have reverted back to 18.11 over the last few minutes.
New definitions withdrawn for some reason?

Regards,
Silj
 
Reverted back? No, never was there ;)

The content on the website was added yesterday as usual, but someone must have accidently released it without waiting till today... the files were only uploaded a few minutes ago (btw the checksum on the download page probably was the old one as well, as the manual installer was only created and the website on that updated today)...

So: nothing withdrawn, updates have come in the usual rythm - every Friday :)
 
I'm good to go, now as well Pepi
xblueman.gif


Regards,
Silj
 
Does anyone know where I can find information about the detection criteria of this "Keylogger Phoenix" ?

The reason I'm asing is that Spybot has identified a file "C:\Windows\setup1.exe" as Phoenix, but I'm reasonably sure that I don't have any keylogger on my system (as I scan daily with spybot, ad-aware and two antivirus apps). The itself has a version information that says something like "Microsoft Visual Basic 6.0 Setup Toolkit" (Version 6.0.0.8171, Size 286.720 Bytes).
 
No really, but thanks anyway!

I was more searching for the criteria built into the latest detection rules, how this "Phoenix" malware gets detected. I'd like to check if it's a false positive.
 
I was aware of that, but thanks anyway. :)

What I'm looking for are the exact criteria (e.g. filenames, hashes,...) which are used to identify this "Phoenix" keylogger.
As I said, I just want to make sure, it's a false positive!
 
Elandril said:
I was aware of that, but thanks anyway. :)

What I'm looking for are the exact criteria (e.g. filenames, hashes,...) which are used to identify this "Phoenix" keylogger.
As I said, I just want to make sure, it's a false positive!
Click to expand...
I don't believe it is an F/P but I'll let the powers that be address your query.

Regards,
Silj
 
I'm fairly sure now, that this is an false positive!
Have a look at here, where they describe exactly the same file that was found on my computer.
I also scanned it via virusscan.jotti.org and every scanner reported a clean file!

I hope someone read this here - if not, I'll try to repost this as a separate thread! :D
 
Elandril wrote:
I hope someone read this here - if not, I'll try to repost this as a separate thread! :D
Click to expand...
You should since I don't believe your thread has any connection with the original post.

Silj
 
Elandril is right

I do have the same situation (the file setup1.exe reported as containing the phoneix keylogger).

I believe the detection is a false positive too and hopefully somebody will confirm or deny this assumption soon and stop debating about if this is or not the right place to post the query.

Setup1.exe
Description: Visual Basic 6.0 Setup Toolkit
Size: 280 KB (286,720 bytes)

If you want I can post a hex dump.
 
You must log in or register to reply here.
Back
Top