View Full Version : Is this a false postive?
robinb
February 6th, 2007, 10:59 AM
HKU\S-1-5-21-1539001950-3149648297-3202504066-1005_Classes\Interface\{8148A489-F54E-4D74-B6F3-81901D0AA54A}\TypeLib\\Version -> Adware.ActivityMonitor : Cleaned with backup (quarantined).
As you see I quarantined it but i have no clue what it is so i do not know if i should put it back, ignore it or leave it in quarantine.
I am using the license version of AVG 7.5 antispyware running xp pro sp2
Please help.
robin
TopperID
February 6th, 2007, 01:33 PM
It's only a Reg entry that can't harm you anyway, so I would leave it alone for the moment. It could be a fp, do you have eBay Accounting Assistant by any chance?:-
http://www.siteadvisor.com/sites/ebay.com/downloads/514433/
That will add this Key, so it could be the reason.
robinb
February 6th, 2007, 05:48 PM
no but it might have been added when we loaded Quickbooks 2 days ago.
That is the last program we added on this computer.
I removed it from quarantine and set it up to ignore for now.
Would Quickbooks cause it since it does have a monitoring system?
and connects to the internet?
robin
TopperID
February 6th, 2007, 08:52 PM
I'm afraid I can't say what put the Key there in your case, it just happens sometimes that malware files will share the same CLID number as a lgitimate file, they are supposed to be unique but that is not always the case. Sometimes a scanner will pick out the entry because it is associated with malware, when in fact there is a legitimate reason for it being there.
I can't be sure of course, but if it was my machine I would leave it be for the moment, on the basis that if it really was part of an infection I would expect to see a lot more evidence of it than this one Reg Key.
vBulletin® Copyright ©2000-2012, Jelsoft Enterprises Ltd.
Copyright ©2002 - 2012, Wilders Security Forums