FOA: Nick Skrepetos - SUPERAntiSpyware question

[Andy Walker]

This is a snippet from my ZA firewall logs after I started a
SUPERAntiSpyware scan (using the free version). I was performing a
"complete" scan using your latest defs. [Core: 3109, Trace: 1135,
Program Version: 3.2.1028]

Description SUPERAntiSpyware was prevented from changing the
behavior of ZoneAlarm Anti-virus by modifying the file:
WINDIR\Internet Logs\IAMDB.RDB
Rating High
Type File
Subtype File Write
Data WINDIR\Internet Logs\IAMDB.RDB
Program C:\PROGRAM FILES\SUPERANTISPYWARE\SUPERANTISPYWARE.EXE
Action Taken Blocked (once)
Count 1

The firewall AV blocked the action automatically and didn't offer an
option to allow the file to be written to - I had the automatic
treatment of threats turned on for AV.


To the best of my knowledge the IAMDB.RDB file is where user settings
for ZA are stored.


Can you please tell me why SUPERAntiSpyware would need write access to
IAMDB.RDB?


Thank you,

Andy

[Nick Skrepetos]

Andy Walker wrote:
> This is a snippet from my ZA firewall logs after I started a
> SUPERAntiSpyware scan (using the free version). I was performing a
> "complete" scan using your latest defs. [Core: 3109, Trace: 1135,
> Program Version: 3.2.1028]
>
> Description SUPERAntiSpyware was prevented from changing the
> behavior of ZoneAlarm Anti-virus by modifying the file:
> WINDIR\Internet Logs\IAMDB.RDB
> Rating High
> Type File
> Subtype File Write
> Data WINDIR\Internet Logs\IAMDB.RDB
> Program C:\PROGRAM FILES\SUPERANTISPYWARE\SUPERANTISPYWARE.EXE
> Action Taken Blocked (once)
> Count 1
>
> The firewall AV blocked the action automatically and didn't offer an
> option to allow the file to be written to - I had the automatic
> treatment of threats turned on for AV.
>
>
> To the best of my knowledge the IAMDB.RDB file is where user settings
> for ZA are stored.
>
>
> Can you please tell me why SUPERAntiSpyware would need write access to
> IAMDB.RDB?
>
>
> Thank you,
>
> Andy

Andy,

SUPERAntiSpyware wouldn't write to the log files (or any files), we
only open files for reading while scanning. ZoneAlarm AV appears to be
false detecting a write to the file.

I will install the Zone Alarm AV here and see if I get the same
results.

Nick Skrepetos
SUPERAntiSpyware.com
http://www.superantispyware.com