SuperAnitSpyware.exe is malware?

[Buffalo]

Buffalo wrote:
> David H. Lipman wrote:
>> From: "Buffalo" <Eric@nada.com.invalid>
> [snip]
>>>> Provide me the file that is being flagged and I'll escalate the
>>>> resolution.
>>> It is the superantispyware.exe file that is being flagged, I don't
>>> know which part of it.
>>> Can you tell me how to find out?
>>> I don't believe you want the whole 4.3MB file.
>>> If so, tell me how to send it to you.
>>
>> Yes, of course I'd want the whole file(s). Whatever file(s) Avira is
>> flagging on SAS.
>
> Sorry Dave, but how do I send it to you? Do I need to zip it?
> What email addy or website to send it to.
> Thanks,
> Buffalo

When I sent the SAS file to virusscan.jotti.org only Avira hit on it.
Same name. TR/'Spy.Spatet.BC
Additional info was :File size: 4600704 bytes Filetype: PE32 executable for
MS Windows (GUI) Intel 80386 32-bit MD5: caad6aa8367483b4dcb34ebfb040e478
SHA1: a91c66fb887941b84718e0b3b2f4aff80374f668
and the Filename: A0155114.EXE
Buffalo

[Han]

FredW <fredw@blackholespam.net> wrote in
news:kt4d47h5d5eu5f94mh445gj8ocqmpmmghq@4ax.com:

> On 13 Aug 2011 12:55:02 GMT, Han <nobody@nospam.not> wrote:
>>"Buffalo" <Eric@nada.com.invalid> wrote in
>>news:j247qe$pff$1@dont-email.me:
>>
>>> Well, according to Avira AntiVir it is TR/SpySpatet.BC.
>>> Yes, I did submit that file to Avira as a suspected False Positive.
>>> Definition: V7.11.13.37 8/12/2011
>>> Buffalo
>>
>>My wife has the same problem. I just made sure everything is updated
>>and both Avira paid and SAS free are up to date. Problem persists, so
>>I had to exit SAS to let her do her work.
>
> That is a pity, as SAS is an excellent program.
> (in combination with MBAM).
>
> When I decide something is a "false positive",
> I add the program to my "Exceptions" in Avira.
> Configuration / Scanner / Scan / Exceptions.
> Configuration / Guard / Scan / Exceptions.

Yes I did. Didn't help a bit.

> I use Avira only as a "second opinion" on-demand scanner,
> so I don't have to add an exception to the Guard part.
> ;-)
>
>
> P.S.
> Ik ben ook gepensioneerd.
> Voor het geval je wat nog wat uit Nederland zou willen zien:
> http://www.nu.nl/
> http://www.buienradar.nl/
> (maar misschien ken je deze al lang.)

Ik krijg een dagelijkse email van nrc.nl.
Zie
<http://www.nrc.nl/nieuws/2011/08/13/twintig-mensen-uit-gondel-gered/>
Ik wist vagelijk van buienradar, maar niet nu.nl; blijf bij nrc.nl
<glimlachje>

Groetjes!
--
Best regards
Han
email address is invalid

[Buffalo]

FredW wrote:
> On 13 Aug 2011 12:55:02 GMT, Han <nobody@nospam.not> wrote:
>> "Buffalo" <Eric@nada.com.invalid> wrote in
>> news:j247qe$pff$1@dont-email.me:
>>
>>> Well, according to Avira AntiVir it is TR/SpySpatet.BC.
>>> Yes, I did submit that file to Avira as a suspected False Positive.
>>> Definition: V7.11.13.37 8/12/2011
>>> Buffalo
>>
>> My wife has the same problem. I just made sure everything is
>> updated and both Avira paid and SAS free are up to date. Problem
>> persists, so I had to exit SAS to let her do her work.
>
> That is a pity, as SAS is an excellent program.
> (in combination with MBAM).
>
> When I decide something is a "false positive",
> I add the program to my "Exceptions" in Avira.
> Configuration / Scanner / Scan / Exceptions.
> Configuration / Guard / Scan / Exceptions.
>
> I use Avira only as a "second opinion" on-demand scanner,
> so I don't have to add an exception to the Guard part.

Even with Avira Guard disabled, it would pick up on that file. I added it to
the 'Processes' Exception in Guard and it still would pick it up.
I then added it to the 'Objects' Exception in Guard and now it ignores it.
Didn't realize it had to be put in the Objects part of the Exception in
Guard.
I already had it listed in the Exceptions in the Scanner part.
Buffalo

[Han]

"Buffalo" <Eric@nada.com.invalid> wrote in
news:j2661j$esa$1@dont-email.me:

> Even with Avira Guard disabled, it would pick up on that file. I added
> it to the 'Processes' Exception in Guard and it still would pick it
> up. I then added it to the 'Objects' Exception in Guard and now it
> ignores it. Didn't realize it had to be put in the Objects part of the
> Exception in Guard.
> I already had it listed in the Exceptions in the Scanner part.
> Buffalo

How exactly do you add it to the objects part? Add SUPERAntispyware.exe?
It seemed to me that it asked for *.exe, but of course that's not what
you'd want to do.

--
Best regards
Han
email address is invalid

[Buffalo]

Han wrote:
> FredW <fredw@blackholespam.net> wrote in
> news:kt4d47h5d5eu5f94mh445gj8ocqmpmmghq@4ax.com:
>
>> On 13 Aug 2011 12:55:02 GMT, Han <nobody@nospam.not> wrote:
>>> "Buffalo" <Eric@nada.com.invalid> wrote in
>>> news:j247qe$pff$1@dont-email.me:
>>>
>>>> Well, according to Avira AntiVir it is TR/SpySpatet.BC.
>>>> Yes, I did submit that file to Avira as a suspected False Positive.
>>>> Definition: V7.11.13.37 8/12/2011
>>>> Buffalo
>>>
>>> My wife has the same problem. I just made sure everything is
>>> updated and both Avira paid and SAS free are up to date. Problem
>>> persists, so I had to exit SAS to let her do her work.
>>
>> That is a pity, as SAS is an excellent program.
>> (in combination with MBAM).
>>
>> When I decide something is a "false positive",
>> I add the program to my "Exceptions" in Avira.
>> Configuration / Scanner / Scan / Exceptions.
>> Configuration / Guard / Scan / Exceptions.
>
> Yes I did. Didn't help a bit.
I had to add the whole path to the Exceptions in Guard in Objects and
Processes to make it ignore it.
When I only add it to the Processes part, it would keep finding it. Now it
ignores it.
Buffalo
PS: I also added the whole path (of Superantispyware.exe) to the exception
in Scanner.

[Buffalo]

Han wrote:
> "Buffalo" <Eric@nada.com.invalid> wrote in
> news:j2661j$esa$1@dont-email.me:
>
>> Even with Avira Guard disabled, it would pick up on that file. I
>> added it to the 'Processes' Exception in Guard and it still would
>> pick it up. I then added it to the 'Objects' Exception in Guard and
>> now it ignores it. Didn't realize it had to be put in the Objects
>> part of the Exception in Guard.
>> I already had it listed in the Exceptions in the Scanner part.
>> Buffalo
>
> How exactly do you add it to the objects part? Add
> SUPERAntispyware.exe? It seemed to me that it asked for *.exe, but of
> course that's not what you'd want to do.

In Configuration and under guard,scan, Exceptions, you get two different
boxes to add exceptions to.
One is "Processes to be omitted by Guard" and the other is "File Objects to
be omitted by the Guard".
I just used the button to the left of the Add button and found the file
(C:\ProgramFiles\SuperAntiSpyware\SuperAntiSpyware .exe) and clicked the Add
button and then the Apply button on the bottom right.

[Han]

"Buffalo" <Eric@nada.com.invalid> wrote in
news:j266ke$ij9$1@dont-email.me:

>
>
> Han wrote:
>> "Buffalo" <Eric@nada.com.invalid> wrote in
>> news:j2661j$esa$1@dont-email.me:
>>
>>> Even with Avira Guard disabled, it would pick up on that file. I
>>> added it to the 'Processes' Exception in Guard and it still would
>>> pick it up. I then added it to the 'Objects' Exception in Guard and
>>> now it ignores it. Didn't realize it had to be put in the Objects
>>> part of the Exception in Guard.
>>> I already had it listed in the Exceptions in the Scanner part.
>>> Buffalo
>>
>> How exactly do you add it to the objects part? Add
>> SUPERAntispyware.exe? It seemed to me that it asked for *.exe, but of
>> course that's not what you'd want to do.
>
> In Configuration and under guard,scan, Exceptions, you get two
> different boxes to add exceptions to.
> One is "Processes to be omitted by Guard" and the other is "File
> Objects to be omitted by the Guard".
> I just used the button to the left of the Add button and found the
> file (C:\ProgramFiles\SuperAntiSpyware\SuperAntiSpyware .exe) and
> clicked the Add button and then the Apply button on the bottom right.

Thanks! I'll try it as soon as "she" lets me on her machone <grin>.

--
Best regards
Han
email address is invalid

[Buffalo]

Han wrote:
> "Buffalo" <Eric@nada.com.invalid> wrote in
> news:j266ke$ij9$1@dont-email.me:
>
>>
>>
>> Han wrote:
>>> "Buffalo" <Eric@nada.com.invalid> wrote in
>>> news:j2661j$esa$1@dont-email.me:
>>>
>>>> Even with Avira Guard disabled, it would pick up on that file. I
>>>> added it to the 'Processes' Exception in Guard and it still would
>>>> pick it up. I then added it to the 'Objects' Exception in Guard and
>>>> now it ignores it. Didn't realize it had to be put in the Objects
>>>> part of the Exception in Guard.
>>>> I already had it listed in the Exceptions in the Scanner part.
>>>> Buffalo
>>>
>>> How exactly do you add it to the objects part? Add
>>> SUPERAntispyware.exe? It seemed to me that it asked for *.exe, but
>>> of course that's not what you'd want to do.
>>
>> In Configuration and under guard,scan, Exceptions, you get two
>> different boxes to add exceptions to.
>> One is "Processes to be omitted by Guard" and the other is "File
>> Objects to be omitted by the Guard".
>> I just used the button to the left of the Add button and found the
>> file (C:\ProgramFiles\SuperAntiSpyware\SuperAntiSpyware .exe) and
>> clicked the Add button and then the Apply button on the bottom right.
>
> Thanks! I'll try it as soon as "she" lets me on her machone <grin>.

It will work.
Buffalo
PS:That is, if she lets you.

[Buffalo]

FredW wrote:
> On Sat, 13 Aug 2011 13:38:12 +0200, FredW <fredw@blackholespam.net>
> wrote:
>> On Fri, 12 Aug 2011 19:25:34 -0700, 1PW <1PW@INVALID.net> wrote:
>>> On 8/12/2011 4:39 PM, FredW wrote:
>>>>
>>>> My Avira free 10.2.0.700 found nothing in version 5.0.1108 so far.
>>>> But I have version 5.0.1118 installed today.
>>>>
>>>> A full scan with the "new" SAS did not get any message from my
>>>> NOD32.
>>>
>>> Gee Fred. You got to sit at the adult's table and get v5.0.1118
>>>
>>> Some of us were sent to the children's table where we have v5.0.1116
>>>
>>> ...ain't fair.
>>
>> My mistake, sorry.
>> On rechecking I appear to have version 5.0.1116.
>> ;-)
>
> And I just downloaded a next version from the SuperAntiSpyware
> website. I have now version 5.0.1118.
> (a new version every day ?)
> :-))

Well, I can't find any version later than 5.0.1116 on their website. Where
is it?
Buffalo

[David H. Lipman]

From: "Buffalo" <Eric@nada.com.invalid>

>
> David H. Lipman wrote:
>> From: "Buffalo" <Eric@nada.com.invalid>
> [snip]
>>>> Provide me the file that is being flagged and I'll escalate the
>>>> resolution.
>>> It is the superantispyware.exe file that is being flagged, I don't
>>> know which part of it.
>>> Can you tell me how to find out?
>>> I don't believe you want the whole 4.3MB file.
>>> If so, tell me how to send it to you.
>>
>> Yes, of course I'd want the whole file(s). Whatever file(s) Avira is
>> flagging on SAS.
>
> Sorry Dave, but how do I send it to you? Do I need to zip it?
> What email addy or website to send it to.
> Thanks,
> Buffalo
>

Email file(s) in ZIP or upload to; http://www.uploadmalware.com/

If you upload it to UploadMalware, put my name in the comments as well as the False
Positive declaration by Avira.


--
Dave
Multi-AV Scanning Tool - http://multi-av.thespykiller.co.uk
http://www.pctipp.ch/downloads/dl/35905.asp