SuperAnitSpyware.exe is malware?

[Buffalo]

David H. Lipman wrote:
> From: "Buffalo" <Eric@nada.com.invalid>
>
>>
>> David H. Lipman wrote:
>>> From: "Buffalo" <Eric@nada.com.invalid>
>> [snip]
>>>>> Provide me the file that is being flagged and I'll escalate the
>>>>> resolution.
>>>> It is the superantispyware.exe file that is being flagged, I don't
>>>> know which part of it.
>>>> Can you tell me how to find out?
>>>> I don't believe you want the whole 4.3MB file.
>>>> If so, tell me how to send it to you.
>>>
>>> Yes, of course I'd want the whole file(s). Whatever file(s) Avira
>>> is flagging on SAS.
>>
>> Sorry Dave, but how do I send it to you? Do I need to zip it?
>> What email addy or website to send it to.
>> Thanks,
>> Buffalo
>>
>
> Email file(s) in ZIP or upload to; http://www.uploadmalware.com/
>
> If you upload it to UploadMalware, put my name in the comments as
> well as the False Positive declaration by Avira.
I just successfully submitted that file to uploadmalware and included your
name.
Buffalo

[David H. Lipman]

From: "Buffalo" <Eric@nada.com.invalid>

> I just successfully submitted that file to uploadmalware and included your
> name.
> Buffalo

Received - Done.
Sent to two POCs at Avira.

--
Dave
Multi-AV Scanning Tool - http://multi-av.thespykiller.co.uk
http://www.pctipp.ch/downloads/dl/35905.asp

[Buffalo]

David H. Lipman wrote:
> From: "Buffalo" <Eric@nada.com.invalid>
>
>> I just successfully submitted that file to uploadmalware and
>> included your name.
>> Buffalo
>
> Received - Done.
> Sent to two POCs at Avira.
Thanks, and also received your email.
Buffalo

[Buffalo]

FredW wrote:
> On Sat, 13 Aug 2011 10:19:49 -0600, "Buffalo" <Eric@nada.com.invalid>
> wrote:
>> FredW wrote:
>>> On Sat, 13 Aug 2011 13:38:12 +0200, FredW <fredw@blackholespam.net>
>>> wrote:
>>>
>>> And I just downloaded a next version from the SuperAntiSpyware
>>> website. I have now version 5.0.1118.
>>> (a new version every day ?)
>>> :-))
>>
>> Well, I can't find any version later than 5.0.1116 on their website.
>> Where is it?
>
> https://www.superantispyware.com/download.html
> I downloaded the bottom version.
> The website states version 5.0.1108, but after installation I have now
> version 5.0.1118 (12,472,736)
>
> Or
> http://www.majorgeeks.com/SUPERAntiSpyware_d5116.html

I still can't get it through the regular update feature of SAS Pro.
Interesting.
I may just uninstall SAS and reinstall with the latest version just to see
if Avira alerts on it also.
But, how about you sending the superantispyware.exe (in the
programfiles\superantispyware) file to VirusTotal and see if Avira still
hits on it?
Then I don't have to chance a screw up by uninstalling the 16 version and
installing the 18 ver.
Thanks,
Buffalo

[1PW]

On 8/13/2011 9:12 AM, Buffalo wrote:

SUPER snip...

Indeed the v5.0.1118 executable passes muster with VT now. Perhaps
Nick took a tip from the malware criminal's cookbook and changed one
insignificant bit in his source and recompiled. Voila! New hash. VT
problem gone. Avira problem gone. Comodo problem gone.

While you folks went after Avira, I went to Comodo. I got a
"non-denial denial" out of them in reply.

Pity.

[Han]

"Buffalo" <Eric@nada.com.invalid> wrote in
news:j26dgq$pt$1@dont-email.me:

>
>
> FredW wrote:
>> On Sat, 13 Aug 2011 10:19:49 -0600, "Buffalo" <Eric@nada.com.invalid>
>> wrote:
>>> FredW wrote:
>>>> On Sat, 13 Aug 2011 13:38:12 +0200, FredW <fredw@blackholespam.net>
>>>> wrote:
>>>>
>>>> And I just downloaded a next version from the SuperAntiSpyware
>>>> website. I have now version 5.0.1118.
>>>> (a new version every day ?)
>>>> :-))
>>>
>>> Well, I can't find any version later than 5.0.1116 on their website.
>>> Where is it?
>>
>> https://www.superantispyware.com/download.html
>> I downloaded the bottom version.
>> The website states version 5.0.1108, but after installation I have
>> now version 5.0.1118 (12,472,736)
>>
>> Or
>> http://www.majorgeeks.com/SUPERAntiSpyware_d5116.html
>
> I still can't get it through the regular update feature of SAS Pro.
> Interesting.
> I may just uninstall SAS and reinstall with the latest version just to
> see if Avira alerts on it also.
> But, how about you sending the superantispyware.exe (in the
> programfiles\superantispyware) file to VirusTotal and see if Avira
> still hits on it?
> Then I don't have to chance a screw up by uninstalling the 16 version
> and installing the 18 ver.
> Thanks,
> Buffalo
I did both the object exclusion thing and the uninstall reinstall newest.
The website (see above) says 5.0.1108, but it gives you 5.0.1118, indeed



--
Best regards
Han
email address is invalid

[Han]

FredW <fredw@blackholespam.net> wrote in
news:fl7d47ddsbcisl2kbtcpab354odj4ah6t4@4ax.com:

> On 13 Aug 2011 15:36:37 GMT, Han <nobody@nospam.not> wrote:
>>FredW <fredw@blackholespam.net> wrote in
>>news:kt4d47h5d5eu5f94mh445gj8ocqmpmmghq@4ax.co m:
>>> Voor het geval je wat nog wat uit Nederland zou willen zien:
>
>>> http://www.nu.nl/
>>> http://www.buienradar.nl/
>>> (maar misschien ken je deze al lang.)
>>
>>Ik krijg een dagelijkse email van nrc.nl.
>>Zie
>><http://www.nrc.nl/nieuws/2011/08/13/twintig-mensen-uit-gondel-gered/>
>
> Zonet (minuut geleden) beelden op de Duitse TV (Nachrichten) gezien.
>
> Het is bijna 18:00, de Bundesliga is weer begonnen.
> Straks maar even kijken.
Ben nooit zo'n sportsfan geweest. Af entoe Olympische spelen of
wereldkampioenschappen is OK ...


--
Best regards
Han
email address is invalid

[Han]

"Buffalo" <Eric@nada.com.invalid> wrote in news:j267pq$qmn$1@dont-email.me:

> It will work.
> Buffalo
> PS:That is, if she lets you.

She did, and it does (I think).
THANKS, man!!

--
Best regards
Han
email address is invalid

[Buffalo]

FredW wrote:
> On Sat, 13 Aug 2011 11:50:23 -0600, "Buffalo" <Eric@nada.com.invalid>
> wrote:
>
>
>> But, how about you sending the superantispyware.exe (in the
>> programfiles\superantispyware) file to VirusTotal and see if Avira
>> still hits on it?
>> Then I don't have to chance a screw up by uninstalling the 16
>> version and installing the 18 ver.
>
> Complete scanning result of "SUPERAntiSpyware.exe", processed in
> VirusTotal at 08/13/2011 20:35:25 (CET).
>
> [ file data ]
> * name..: SUPERAntiSpyware.exe
> * size..: 5471104
> * md5...: bdbfbf77df58aaf8094cd6949bbacc66
> * sha1..: 9a54c1f292762f0953c033edb325e73ede26f976
> * peid..: -
>
> [ scan result ]
> AhnLab-V3 2011.08.13.00/20110813 found nothing
> AntiVir 7.11.13.37/20110812 found nothing
> Antiy-AVL 2.0.3.7/20110813 found nothing
> Avast 4.8.1351.0/20110813 found nothing
> Avast5 5.0.677.0/20110813 found nothing
> AVG 10.0.0.1190/20110813 found nothing
> BitDefender 7.2/20110813 found nothing
> CAT-QuickHeal 11.00/20110813 found nothing
> ClamAV 0.97.0.0/20110813 found nothing
> Commtouch 5.3.2.6/20110813 found nothing
> Comodo 9732/20110813 found nothing
> DrWeb 5.0.2.03300/20110813 found nothing
> Emsisoft 5.1.0.8/20110813 found nothing
> eSafe 7.0.17.0/20110810 found nothing
> eTrust-Vet 36.1.8499/20110812 found nothing
> F-Prot 4.6.2.117/20110813 found nothing
> F-Secure 9.0.16440.0/20110813 found nothing
> Fortinet 4.2.257.0/20110813 found nothing
> GData 22/20110813 found nothing
> Ikarus T3.1.1.107.0/20110813 found nothing
> Jiangmin 13.0.900/20110813 found nothing
> K7AntiVirus 9.109.5010/20110812 found nothing
> Kaspersky 9.0.0.837/20110813 found nothing
> McAfee 5.400.0.1158/20110813 found nothing
> McAfee-GW-Edition 2010.1D/20110813 found nothing
> Microsoft 1.7104/20110813 found nothing
> NOD32 6374/20110813 found nothing
> Norman 6.07.10/20110812 found nothing
> nProtect 2011-08-13.02/20110813 found nothing
> Panda 10.0.3.5/20110813 found nothing
> PCTools 8.0.0.5/20110813 found nothing
> Prevx 3.0/20110813 found nothing
> Rising 23.70.04.03/20110812 found nothing
> Sophos 4.67.0/20110813 found nothing
> SUPERAntiSpyware 4.40.0.1006/20110813 found nothing
> Symantec 20111.2.0.82/20110813 found nothing
> TheHacker 6.7.0.1.276/20110813 found nothing
> TrendMicro 9.500.0.1008/20110813 found nothing
> TrendMicro-HouseCall 9.500.0.1008/20110813 found nothing
> VBA32 3.12.16.4/20110813 found nothing
> VIPRE 10150/20110812 found nothing
> ViRobot 2011.8.13.4621/20110813 found nothing
> VirusBuster 14.0.167.0/20110813 found nothing

Hey Fred W, thanks for doing that.
Sounds like SAS corrected what the problem was triggering that detection by
Avira and Comodo.
Buffalo

[Buffalo]

FredW wrote:
> On Sat, 13 Aug 2011 11:50:23 -0600, "Buffalo" <Eric@nada.com.invalid>
> wrote:
>
>
>> But, how about you sending the superantispyware.exe (in the
>> programfiles\superantispyware) file to VirusTotal and see if Avira
>> still hits on it?
>> Then I don't have to chance a screw up by uninstalling the 16
>> version and installing the 18 ver.

Thanks again. I uninstalled 1116 with SAS uninstall program and dl'd and
installed ver 1118 and everything is fine.
Buffalo