SuperAnitSpyware.exe is malware?

[Buffalo]

FredW wrote:
> On Sat, 13 Aug 2011 13:52:31 -0600, "Buffalo" <Eric@nada.com.invalid>
> wrote:
>> FredW wrote:
>>> On Sat, 13 Aug 2011 11:50:23 -0600, "Buffalo"
>>> <Eric@nada.com.invalid> wrote:
>>>
>>>> But, how about you sending the superantispyware.exe (in the
>>>> programfiles\superantispyware) file to VirusTotal and see if Avira
>>>> still hits on it?
>>>> Then I don't have to chance a screw up by uninstalling the 16
>>>> version and installing the 18 ver.
>>>
>>> Complete scanning result of "SUPERAntiSpyware.exe", processed in
>>> VirusTotal at 08/13/2011 20:35:25 (CET).
>>
>> Hey Fred W, thanks for doing that.
>> Sounds like SAS corrected what the problem was triggering that
>> detection by Avira and Comodo.
>> Buffalo
>
>
> It was the very first time I sent something to VirusTotal.
> I did so by email, I did not know it was so easy.
>
> I am glad you asked.
> ;-)
Great, we all came out ahead.
Buffalo

[Buffalo]

FredW wrote:
> On Sat, 13 Aug 2011 14:17:23 -0600, "Buffalo" <Eric@nada.com.invalid>
> wrote:
>> FredW wrote:
>>> On Sat, 13 Aug 2011 11:50:23 -0600, "Buffalo"
>>> <Eric@nada.com.invalid> wrote:
>>>
>>>> But, how about you sending the superantispyware.exe (in the
>>>> programfiles\superantispyware) file to VirusTotal and see if Avira
>>>> still hits on it?
>>>> Then I don't have to chance a screw up by uninstalling the 16
>>>> version and installing the 18 ver.
>>
>> Thanks again. I uninstalled 1116 with SAS uninstall program and dl'd
>> and installed ver 1118 and everything is fine.
>> Buffalo
>
> :-)
>
> Release history of SAS is still at 5.0.1108 - 08/02/2011
> Version 5.0.1118 is nowhere mentioned on the SAS forum.
>
http://forums.superantispyware.com/i...vir-antivirus/
Yep,
I just got off that forum.
Buffalo
PS: I think the new version of SAS is really a big improvement. (ver 5).

[Buffalo]

FredW wrote:
> On Sat, 13 Aug 2011 22:55:30 +0200, FredW <fredw@blackholespam.net>
> wrote:
>> On Sat, 13 Aug 2011 14:17:23 -0600, "Buffalo" <Eric@nada.com.invalid>
>> wrote:
>>> FredW wrote:
>>>> On Sat, 13 Aug 2011 11:50:23 -0600, "Buffalo"
>>>> <Eric@nada.com.invalid> wrote:
>>>>
>>>>> But, how about you sending the superantispyware.exe (in the
>>>>> programfiles\superantispyware) file to VirusTotal and see if
>>>>> Avira still hits on it?
>>>>> Then I don't have to chance a screw up by uninstalling the 16
>>>>> version and installing the 18 ver.
>>>
>>> Thanks again. I uninstalled 1116 with SAS uninstall program and
>>> dl'd and installed ver 1118 and everything is fine.
>>> Buffalo
>>
>> :-)
>>
>> Release history of SAS is still at 5.0.1108 - 08/02/2011
>> Version 5.0.1118 is nowhere mentioned on the SAS forum.
>>
http://forums.superantispyware.com/i...vir-antivirus/
>
> I see you reported this in the SAS forum.
>
http://forums.superantispyware.com/i...erantispyware/
> (post #4)
> I wonder how many people at SAS know of this version?
>
> :-) :-)

If it wasn't for you, I wouldn't have know either.
Thanks,
Buffalo

[Buffalo]

David H. Lipman wrote:
> From: "Buffalo" <Eric@nada.com.invalid>
>
>> Well, according to Avira AntiVir it is TR/SpySpatet.BC.
>> Yes, I did submit that file to Avira as a suspected False Positive.
>> Definition: V7.11.13.37 8/12/2011
>> Buffalo
>>
>
> Did you get a response ?

Just got it today:
File ID Filename Size (Byte) Result
26252326 SUPERANTISPYWARE.EXE 4.39 MB CLEAN


Please find a detailed report concerning each individual sample below:

Filename Result
SUPERANTISPYWARE.EXE CLEAN

The file 'SUPERANTISPYWARE.EXE' has been determined to be 'CLEAN'. Our
analysts did not discover any malicious content.

Buffalo

[Bullwinkle.]

So, you pulled a boaterdave over nothing. Nice going.


"Buffalo" <Eric@nada.com.invalid> wrote in message
news:j29ko2$o9g$1@dont-email.me...


David H. Lipman wrote:
> From: "Buffalo" <Eric@nada.com.invalid>
>
>> Well, according to Avira AntiVir it is TR/SpySpatet.BC.
>> Yes, I did submit that file to Avira as a suspected False Positive.
>> Definition: V7.11.13.37 8/12/2011
>> Buffalo
>>
>
> Did you get a response ?

Just got it today:
File ID Filename Size (Byte) Result
26252326 SUPERANTISPYWARE.EXE 4.39 MB CLEAN


Please find a detailed report concerning each individual sample below:

Filename Result
SUPERANTISPYWARE.EXE CLEAN

The file 'SUPERANTISPYWARE.EXE' has been determined to be 'CLEAN'. Our
analysts did not discover any malicious content.

Buffalo

[David H. Lipman]

From: "Bullwinkle." <BDTJ@loa..mo>

> So, you pulled a boaterdave over nothing. Nice going.
>

No, not even close.

He received his email AFTER I provided a sample and the False Positive report to a couple
of POCs I have at Avira where one replied...

"Thanks alot! I reported the file to the Vlab boss to get it fixed."

--
Dave
Multi-AV Scanning Tool - http://multi-av.thespykiller.co.uk
http://www.pctipp.ch/downloads/dl/35905.asp

[FromTheRafters]

"David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote in message
news:j2b0u6021n7@news1.newsguy.com...
> From: "Bullwinkle." <BDTJ@loa..mo>
>
>> So, you pulled a boaterdave over nothing. Nice going.
>
> No, not even close.
>
> He received his email AFTER I provided a sample and the False Positive report
> to a couple of POCs I have at Avira where one replied...
>
> "Thanks alot! I reported the file to the Vlab boss to get it fixed."

So, contrary to the idea that SAS was changed to correct the
problem, it is as I suspected a FP since corrected by Avira?

How does the sympathetic Comodo FP fit in? As I understand
it, the Comodo AV engine is their very own engine not related
to Avira's. Perhaps the definitions are enough similar?

[~BD~]

David H. Lipman wrote:
> From: "Bullwinkle."<BDTJ@loa..mo>
>
>> So, you pulled a boaterdave over nothing. Nice going.
>>
>
> No, not even close.
>
> He received his email AFTER I provided a sample and the False Positive report to a couple
> of POCs I have at Avira where one replied...
>
> "Thanks alot! I reported the file to the Vlab boss to get it fixed."
>


I like the fact that there's now a web site in *English* available!

"The Multi-AV Scanning Tool is a software utility that provides multiple
anti malware command line scanners to find or detect malware as well as
remove it from your computer."

What, though, is the subtle difference between "find" and "detect"?

[David H. Lipman]

From: "FromTheRafters" <erratic.howard@gmail.com>

> "David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote in message news:j2b0u6021n7@news1.newsguy.com...
>> From: "Bullwinkle." <BDTJ@loa..mo>
>>
>>> So, you pulled a boaterdave over nothing. Nice going.
>>
>> No, not even close.
>>
>> He received his email AFTER I provided a sample and the False Positive report to a
>> couple of POCs I have at Avira where one replied...
>>
>> "Thanks alot! I reported the file to the Vlab boss to get it fixed."
>
> So, contrary to the idea that SAS was changed to correct the
> problem, it is as I suspected a FP since corrected by Avira?

Yes.


> How does the sympathetic Comodo FP fit in? As I understand
> it, the Comodo AV engine is their very own engine not related
> to Avira's. Perhaps the definitions are enough similar?

I don't know. Pure coincidence maybe. I could have sent a false Positive report to
Kishor at Comodo but, I didn't.

Probably something in the way the EXE was compiled that caused the two vendors to flag it.



--
Dave
Multi-AV Scanning Tool - http://multi-av.thespykiller.co.uk
http://www.pctipp.ch/downloads/dl/35905.asp

[Buffalo]

Bullwinkle. wrote:
> So, you pulled a boaterdave over nothing. Nice going.

So, once again you prove that you do not logically comprehend what you read.
Buffalo