SuperAnitSpyware.exe is malware?

[Buffalo]

Buffalo wrote:
> FredW wrote:
>> On Fri, 12 Aug 2011 16:00:27 -0600, "Buffalo" <Eric@nada.com.invalid>
>> wrote:
>>
>>> Well, according to Avira AntiVir it is TR/SpySpatet.BC.
>>> Yes, I did submit that file to Avira as a suspected False Positive.
>>> Definition: V7.11.13.37 8/12/2011
>>> Buffalo
>>
>> What version of SuperAntiSpyware?
>>
>> My Avira free 10.2.0.700 found nothing in version 5.0.1108 so far.
>> But I have version 5.0.1118 installed today.
>>
>> A full scan with the "new" SAS did not get any message from my NOD32.
>
> My Free Avira was: Engine V8.02.06.30
> Virus Definition File: V7.11.13.37
> This only happened when I update to the above Virus Definition File.
> Buffalo
> PS: Only Comodo and Avira hit on that file when I submitted it to
> VirusTotal today.
It's also possible that it was caused by the latest SAS update.
Right now I am not running SAS Pro.'
Buffalo

[1PW]

On 8/12/2011 4:39 PM, FredW wrote:
> On Fri, 12 Aug 2011 16:00:27 -0600, "Buffalo" <Eric@nada.com.invalid>
> wrote:
>
>> Well, according to Avira AntiVir it is TR/SpySpatet.BC.
>> Yes, I did submit that file to Avira as a suspected False Positive.
>> Definition: V7.11.13.37 8/12/2011
>> Buffalo
>
> What version of SuperAntiSpyware?
>
> My Avira free 10.2.0.700 found nothing in version 5.0.1108 so far.
> But I have version 5.0.1118 installed today.
>
> A full scan with the "new" SAS did not get any message from my NOD32.

Gee Fred. You got to sit at the adult's table and get v5.0.1118

Some of us were sent to the children's table where we have v5.0.1116

....ain't fair.

[FromTheRafters]

"Buffalo" <Eric@nada.com.invalid> wrote in message
news:j24fjc$coo$1@dont-email.me...
>
>
> FromTheRafters wrote:
>> "Buffalo" <Eric@nada.com.invalid> wrote in message
>> news:j247qe$pff$1@dont-email.me...
>>> Well, according to Avira AntiVir it is TR/SpySpatet.BC.
>>> Yes, I did submit that file to Avira as a suspected False Positive.
>>> Definition: V7.11.13.37 8/12/2011
>>
>> I would be suspicious of it just because the name is *so* close to
>> SUPERAntiSpyware.exe ;o)
>
> Damm, I'm sorry about the mispelling of SuperAntiSpyware and that was a good
> catch.
> It was just a typing mistake on my part. When I submitted that file to Virus
> Total, Avira hit on it and so did Comodo, no others did.

It's probably a false positive if you got the official exe, is the file checksum
good?

[FromTheRafters]

"Buffalo" <Eric@nada.com.invalid> wrote in message
news:j24g04$ese$1@dont-email.me...
>
>
> FredW wrote:
>> On Fri, 12 Aug 2011 16:00:27 -0600, "Buffalo" <Eric@nada.com.invalid>
>> wrote:
>>
>>> Well, according to Avira AntiVir it is TR/SpySpatet.BC.
>>> Yes, I did submit that file to Avira as a suspected False Positive.
>>> Definition: V7.11.13.37 8/12/2011
>>> Buffalo
>>
>> What version of SuperAntiSpyware?
>>
>> My Avira free 10.2.0.700 found nothing in version 5.0.1108 so far.
>> But I have version 5.0.1118 installed today.
>>
>> A full scan with the "new" SAS did not get any message from my NOD32.
>
> My Free Avira was: Engine V8.02.06.30
> Virus Definition File: V7.11.13.37
> This only happened when I update to the above Virus Definition File.
> Buffalo
> PS: Only Comodo and Avira hit on that file when I submitted it to VirusTotal
> today.

If VT shows the MD5 and a submission date from long ago (when
somebody else submitted it) it *really* looks like a FP caused by
the new def files.

[Han]

"Buffalo" <Eric@nada.com.invalid> wrote in news:j247qe$pff$1@dont-email.me:

> Well, according to Avira AntiVir it is TR/SpySpatet.BC.
> Yes, I did submit that file to Avira as a suspected False Positive.
> Definition: V7.11.13.37 8/12/2011
> Buffalo

My wife has the same problem. I just made sure everything is updated and
both Avira paid and SAS free are up to date. Problem persists, so I had to
exit SAS to let her do her work.


--
Best regards
Han
email address is invalid

[Buffalo]

Han wrote:
> "Buffalo" <Eric@nada.com.invalid> wrote in
> news:j247qe$pff$1@dont-email.me:
>
>> Well, according to Avira AntiVir it is TR/SpySpatet.BC.
>> Yes, I did submit that file to Avira as a suspected False Positive.
>> Definition: V7.11.13.37 8/12/2011
>> Buffalo
>
> My wife has the same problem. I just made sure everything is updated
> and both Avira paid and SAS free are up to date. Problem persists,
> so I had to exit SAS to let her do her work.

I have just the opposite. Paid SAS and Free Avira. Still no word back from
Avira except that they are looking at it.
I believe it is because of the latest update of SAS that was put out which I
believe may have been to correct a problem with the new SAS and Win2kProSP4.
Buffalo

[David H. Lipman]

From: "Buffalo" <Eric@nada.com.invalid>

>
> Han wrote:
>> "Buffalo" <Eric@nada.com.invalid> wrote in
>> news:j247qe$pff$1@dont-email.me:
>>
>>> Well, according to Avira AntiVir it is TR/SpySpatet.BC.
>>> Yes, I did submit that file to Avira as a suspected False Positive.
>>> Definition: V7.11.13.37 8/12/2011
>>> Buffalo
>>
>> My wife has the same problem. I just made sure everything is updated
>> and both Avira paid and SAS free are up to date. Problem persists,
>> so I had to exit SAS to let her do her work.
>
> I have just the opposite. Paid SAS and Free Avira. Still no word back from
> Avira except that they are looking at it.
> I believe it is because of the latest update of SAS that was put out which I
> believe may have been to correct a problem with the new SAS and Win2kProSP4.
> Buffalo
>


Provide me the file that is being flagged and I'll escalate the resolution.

--
Dave
Multi-AV Scanning Tool - http://multi-av.thespykiller.co.uk
http://www.pctipp.ch/downloads/dl/35905.asp

[Buffalo]

David H. Lipman wrote:
> From: "Buffalo" <Eric@nada.com.invalid>
>
>>
>> Han wrote:
>>> "Buffalo" <Eric@nada.com.invalid> wrote in
>>> news:j247qe$pff$1@dont-email.me:
>>>
>>>> Well, according to Avira AntiVir it is TR/SpySpatet.BC.
>>>> Yes, I did submit that file to Avira as a suspected False Positive.
>>>> Definition: V7.11.13.37 8/12/2011
>>>> Buffalo
>>>
>>> My wife has the same problem. I just made sure everything is
>>> updated and both Avira paid and SAS free are up to date. Problem
>>> persists, so I had to exit SAS to let her do her work.
>>
>> I have just the opposite. Paid SAS and Free Avira. Still no word
>> back from Avira except that they are looking at it.
>> I believe it is because of the latest update of SAS that was put out
>> which I believe may have been to correct a problem with the new SAS
>> and Win2kProSP4. Buffalo
>>
>
>
> Provide me the file that is being flagged and I'll escalate the
> resolution.
It is the superantispyware.exe file that is being flagged, I don't know
which part of it.
Can you tell me how to find out?
I don't believe you want the whole 4.3MB file.
If so, tell me how to send it to you.
Buffalo

[David H. Lipman]

From: "Buffalo" <Eric@nada.com.invalid>

>
> David H. Lipman wrote:
>> From: "Buffalo" <Eric@nada.com.invalid>
>>
>>> Han wrote:
>>>> "Buffalo" <Eric@nada.com.invalid> wrote in
>>>> news:j247qe$pff$1@dont-email.me:
>>>>
>>>>> Well, according to Avira AntiVir it is TR/SpySpatet.BC.
>>>>> Yes, I did submit that file to Avira as a suspected False Positive.
>>>>> Definition: V7.11.13.37 8/12/2011
>>>>> Buffalo
>>>>
>>>> My wife has the same problem. I just made sure everything is
>>>> updated and both Avira paid and SAS free are up to date. Problem
>>>> persists, so I had to exit SAS to let her do her work.
>>>
>>> I have just the opposite. Paid SAS and Free Avira. Still no word
>>> back from Avira except that they are looking at it.
>>> I believe it is because of the latest update of SAS that was put out
>>> which I believe may have been to correct a problem with the new SAS
>>> and Win2kProSP4. Buffalo
>>>
>> Provide me the file that is being flagged and I'll escalate the
>> resolution.
> It is the superantispyware.exe file that is being flagged, I don't know
> which part of it.
> Can you tell me how to find out?
> I don't believe you want the whole 4.3MB file.
> If so, tell me how to send it to you.

Yes, of course I'd want the whole file(s). Whatever file(s) Avira is flagging on SAS.



--
Dave
Multi-AV Scanning Tool - http://multi-av.thespykiller.co.uk
http://www.pctipp.ch/downloads/dl/35905.asp

[Buffalo]

David H. Lipman wrote:
> From: "Buffalo" <Eric@nada.com.invalid>
[snip]
>>> Provide me the file that is being flagged and I'll escalate the
>>> resolution.
>> It is the superantispyware.exe file that is being flagged, I don't
>> know which part of it.
>> Can you tell me how to find out?
>> I don't believe you want the whole 4.3MB file.
>> If so, tell me how to send it to you.
>
> Yes, of course I'd want the whole file(s). Whatever file(s) Avira is
> flagging on SAS.

Sorry Dave, but how do I send it to you? Do I need to zip it?
What email addy or website to send it to.
Thanks,
Buffalo