Stealth Recorder

[pjb024]

PES says I have Stealth Recorder on my PC. I can remove it successfully with PES but if I run SpywareBlaster to check for latest protection updates then PES again says I have Stealth Recorder on my system. Neither Spybot nor Microsoft AntiSpyware detect anything just PES. In the circumstances I feel this is a false positive.

[dog]

Can you provide a little more detail about what exactly PES is finding, CLSID, registry etc. ... if it doesn't provide detailed info (I don't know I've never used PES) ... Could you open Spyware Blaster after PES has cleaned the problem, and see if ALL of Spyware Blasters Protections are enabled.

It likely is a FP, but we'll need more info to confirm it.

Steve

[pjb024]

hi dog, I have just repeated the SpywareBlaster protections update and it is showing 0 protections disabled and 3926 protections in the database. I use both IE and Firefox although Firefox is my primary browser.

Having just run the SpywareBlaster update I have done a scan with PES and it once again shows Stealth Recorder as being on my system. The information collected is as follows:-

HKEY_LOCAL_MACHINE\SOFTWARE\Licenses | {K7C0DB872A3F777C0}

After removing Stealth Recorder with PES I have opened SpywareBlaster and it shows no protections disabled.

[dog]

Well a quick Google search indicates it's a FP http://www.google.com/search?q=%7BK7C0DB872A3F777C0%7D&, which I would happen to agree with, as that key alone, doesn't constitute anything - I also confirmed that it's also in my registry, and this system is absolutely clean. But the exact use, purpose of it ... I don't know. :-\ But browsing through some of the HJT logs posted elsewhere, they are all clean, with commonly Aluria/AOL AS flagging that key. I'll see if I can dig anything else up. ;)

One of the Acronis Support People will forward this to their tech/research dept. and they'll comment either way.

Regards;

Steve

[dog]

I request the advice of an expert, and that entry is created by almost any program protected with a certain software protection system that is used by many commercial (and shareware) applications. In fact there's really no reason for any values in the HKEY_LOCAL_MACHINE\SOFTWARE\Licenses registry key to be detected as anything malicious. It seems that a certain keylogger may also employ that particular protection scheme as indicated by this Symantec KB Article (http://securityresponse.symantec.com/avcenter/venc/data/spyware.elitekeylogger.html) ... but that key shouldn't be flagged by itself as it is a legitimate entry for the aforementioned protection scheme.

So it is indeed a FP, no question.

Regards;

Steve

[Acronis Support]

Hello pjb024,

Thank you for choosing Acronis Internet Privacy and Antispyware Software. (http://www.acronis.com/homecomputing/products/privacyexpert/)

First of all please download the latest build (748.) of Acronis Privacy Expert Suite 8.0. (http://www.acronis.com/homecomputing/my/updates/) In order to get access to updates you should register account (http://www.acronis.com/homecomputing/my/registration/) on our site (or just log in if you have already created it) and then register your copy of the product (http://www.acronis.com/homecomputing/my/products/registration/). Then please download the latest spyware updates and try to scan for spyware again. If the problem remains please create a screenshot of what Acronis Privacy Expert Suite found on your computer and send it to support@acronis.com along with the link to this thread, also please indicate in the subject that you want to contact Irina Shirokova.

Thank you.
--
Irina Shirokova

[pjb024]

Hello Irina

I was already using the latest build and latest spyware definitions. I'll send you the screen shots. I have found that simply loading and then closing SpywareBlaster is sufficient to cause this.

Thanks

[Acronis Support]

Hello pjb024,

Thank you for all the information you sent. I have forwarded this problem to our Development Team and will let you know the results of their investigation as soon as possible.

Thank you.
--
Irina Shirokova

[Long View]

Acronis Privacy Expert 8 has just found stealth recorder on my machine - just after running SpywareBlaster. Looks like a False Positive. Have also reported to Acronis

[zebis]

Dear Acronis,

I have found the same stealth recorder entry on my machine as well, it appeared after one of your spyware updates. I can remove it but it reappears when rescanning.

Seems like the same problem that acronis had with the chupacabra update as well.

I'm sure it will be fixed soon.

Thx,

Zebis

[myluvnttl]

Yeah I'm am getting False Positive when I install Spyware Blaster with everything protected.

[Acronis Support]

Hello all,

We are really sorry for the inconveniences. This issue has been forwarded to our Development Team. We will let you know as soon as the problem is fixed.

Thank you.
--
Irina Shirokova

[Stephanos G.]

same here, stealth recorder, thanks

[Acronis Support]

Hello all,

This issue has been resolved and the fix will be available in the near Spyware Update. Please accept our apologies for your inconvenience.

Thank you.
--
Irina Shirokova

[Stephanos G.]

No proble here anymore, problem seems that has been fixed,thanx