SuperAnitSpyware.exe is malware?

[David H. Lipman]

From: "Buffalo" <Eric@nada.com.invalid>

>
> Han wrote:
>> "Buffalo" <Eric@nada.com.invalid> wrote in
>> news:j247qe$pff$1@dont-email.me:
>>
>>> Well, according to Avira AntiVir it is TR/SpySpatet.BC.
>>> Yes, I did submit that file to Avira as a suspected False Positive.
>>> Definition: V7.11.13.37 8/12/2011
>>> Buffalo
>>
>> My wife has the same problem. I just made sure everything is updated
>> and both Avira paid and SAS free are up to date. Problem persists,
>> so I had to exit SAS to let her do her work.
>
> I have just the opposite. Paid SAS and Free Avira. Still no word back from
> Avira except that they are looking at it.
> I believe it is because of the latest update of SAS that was put out which I
> believe may have been to correct a problem with the new SAS and Win2kProSP4.
> Buffalo
>


Provide me the file that is being flagged and I'll escalate the resolution.

--
Dave
Multi-AV Scanning Tool - http://multi-av.thespykiller.co.uk
http://www.pctipp.ch/downloads/dl/35905.asp

[Buffalo]

David H. Lipman wrote:
> From: "Buffalo" <Eric@nada.com.invalid>
>
>>
>> Han wrote:
>>> "Buffalo" <Eric@nada.com.invalid> wrote in
>>> news:j247qe$pff$1@dont-email.me:
>>>
>>>> Well, according to Avira AntiVir it is TR/SpySpatet.BC.
>>>> Yes, I did submit that file to Avira as a suspected False Positive.
>>>> Definition: V7.11.13.37 8/12/2011
>>>> Buffalo
>>>
>>> My wife has the same problem. I just made sure everything is
>>> updated and both Avira paid and SAS free are up to date. Problem
>>> persists, so I had to exit SAS to let her do her work.
>>
>> I have just the opposite. Paid SAS and Free Avira. Still no word
>> back from Avira except that they are looking at it.
>> I believe it is because of the latest update of SAS that was put out
>> which I believe may have been to correct a problem with the new SAS
>> and Win2kProSP4. Buffalo
>>
>
>
> Provide me the file that is being flagged and I'll escalate the
> resolution.
It is the superantispyware.exe file that is being flagged, I don't know
which part of it.
Can you tell me how to find out?
I don't believe you want the whole 4.3MB file.
If so, tell me how to send it to you.
Buffalo

[David H. Lipman]

From: "Buffalo" <Eric@nada.com.invalid>

>
> David H. Lipman wrote:
>> From: "Buffalo" <Eric@nada.com.invalid>
>>
>>> Han wrote:
>>>> "Buffalo" <Eric@nada.com.invalid> wrote in
>>>> news:j247qe$pff$1@dont-email.me:
>>>>
>>>>> Well, according to Avira AntiVir it is TR/SpySpatet.BC.
>>>>> Yes, I did submit that file to Avira as a suspected False Positive.
>>>>> Definition: V7.11.13.37 8/12/2011
>>>>> Buffalo
>>>>
>>>> My wife has the same problem. I just made sure everything is
>>>> updated and both Avira paid and SAS free are up to date. Problem
>>>> persists, so I had to exit SAS to let her do her work.
>>>
>>> I have just the opposite. Paid SAS and Free Avira. Still no word
>>> back from Avira except that they are looking at it.
>>> I believe it is because of the latest update of SAS that was put out
>>> which I believe may have been to correct a problem with the new SAS
>>> and Win2kProSP4. Buffalo
>>>
>> Provide me the file that is being flagged and I'll escalate the
>> resolution.
> It is the superantispyware.exe file that is being flagged, I don't know
> which part of it.
> Can you tell me how to find out?
> I don't believe you want the whole 4.3MB file.
> If so, tell me how to send it to you.

Yes, of course I'd want the whole file(s). Whatever file(s) Avira is flagging on SAS.



--
Dave
Multi-AV Scanning Tool - http://multi-av.thespykiller.co.uk
http://www.pctipp.ch/downloads/dl/35905.asp

[Buffalo]

David H. Lipman wrote:
> From: "Buffalo" <Eric@nada.com.invalid>
[snip]
>>> Provide me the file that is being flagged and I'll escalate the
>>> resolution.
>> It is the superantispyware.exe file that is being flagged, I don't
>> know which part of it.
>> Can you tell me how to find out?
>> I don't believe you want the whole 4.3MB file.
>> If so, tell me how to send it to you.
>
> Yes, of course I'd want the whole file(s). Whatever file(s) Avira is
> flagging on SAS.

Sorry Dave, but how do I send it to you? Do I need to zip it?
What email addy or website to send it to.
Thanks,
Buffalo

[Buffalo]

Buffalo wrote:
> David H. Lipman wrote:
>> From: "Buffalo" <Eric@nada.com.invalid>
> [snip]
>>>> Provide me the file that is being flagged and I'll escalate the
>>>> resolution.
>>> It is the superantispyware.exe file that is being flagged, I don't
>>> know which part of it.
>>> Can you tell me how to find out?
>>> I don't believe you want the whole 4.3MB file.
>>> If so, tell me how to send it to you.
>>
>> Yes, of course I'd want the whole file(s). Whatever file(s) Avira is
>> flagging on SAS.
>
> Sorry Dave, but how do I send it to you? Do I need to zip it?
> What email addy or website to send it to.
> Thanks,
> Buffalo

When I sent the SAS file to virusscan.jotti.org only Avira hit on it.
Same name. TR/'Spy.Spatet.BC
Additional info was :File size: 4600704 bytes Filetype: PE32 executable for
MS Windows (GUI) Intel 80386 32-bit MD5: caad6aa8367483b4dcb34ebfb040e478
SHA1: a91c66fb887941b84718e0b3b2f4aff80374f668
and the Filename: A0155114.EXE
Buffalo

[David H. Lipman]

From: "Buffalo" <Eric@nada.com.invalid>

>
> David H. Lipman wrote:
>> From: "Buffalo" <Eric@nada.com.invalid>
> [snip]
>>>> Provide me the file that is being flagged and I'll escalate the
>>>> resolution.
>>> It is the superantispyware.exe file that is being flagged, I don't
>>> know which part of it.
>>> Can you tell me how to find out?
>>> I don't believe you want the whole 4.3MB file.
>>> If so, tell me how to send it to you.
>>
>> Yes, of course I'd want the whole file(s). Whatever file(s) Avira is
>> flagging on SAS.
>
> Sorry Dave, but how do I send it to you? Do I need to zip it?
> What email addy or website to send it to.
> Thanks,
> Buffalo
>

Email file(s) in ZIP or upload to; http://www.uploadmalware.com/

If you upload it to UploadMalware, put my name in the comments as well as the False
Positive declaration by Avira.


--
Dave
Multi-AV Scanning Tool - http://multi-av.thespykiller.co.uk
http://www.pctipp.ch/downloads/dl/35905.asp

[Buffalo]

David H. Lipman wrote:
> From: "Buffalo" <Eric@nada.com.invalid>
>
>>
>> David H. Lipman wrote:
>>> From: "Buffalo" <Eric@nada.com.invalid>
>> [snip]
>>>>> Provide me the file that is being flagged and I'll escalate the
>>>>> resolution.
>>>> It is the superantispyware.exe file that is being flagged, I don't
>>>> know which part of it.
>>>> Can you tell me how to find out?
>>>> I don't believe you want the whole 4.3MB file.
>>>> If so, tell me how to send it to you.
>>>
>>> Yes, of course I'd want the whole file(s). Whatever file(s) Avira
>>> is flagging on SAS.
>>
>> Sorry Dave, but how do I send it to you? Do I need to zip it?
>> What email addy or website to send it to.
>> Thanks,
>> Buffalo
>>
>
> Email file(s) in ZIP or upload to; http://www.uploadmalware.com/
>
> If you upload it to UploadMalware, put my name in the comments as
> well as the False Positive declaration by Avira.
I just successfully submitted that file to uploadmalware and included your
name.
Buffalo

[David H. Lipman]

From: "Buffalo" <Eric@nada.com.invalid>

> I just successfully submitted that file to uploadmalware and included your
> name.
> Buffalo

Received - Done.
Sent to two POCs at Avira.

--
Dave
Multi-AV Scanning Tool - http://multi-av.thespykiller.co.uk
http://www.pctipp.ch/downloads/dl/35905.asp