Seems Ewido missed spyware

Re: Suf60runtime?

Interesting update because I found this via a roundabout route -- Google brought me right back here.

Tonight's Ad-Aware def updates is suddenly turning this up with "Found Favoriteman Item!" header. I haven't installed anything new other than Belarc in ages, so I have to assume I've had it all along and Lavasoft has just now added it to their defs. They rate it as 8, which if you're familiar with their system is very poor (lower means less harmful).

Two locations on my XP system -- the System32 folder, and the system restore folder. I've cleaned both out, and will keep my fingers crossed -- that 8 rating from Lavasoft means they're now very concerned about it.

 

Greetings..........just did a scan with Ad-Aware and it found Favoriteman................how did it get by Ewido?
Also, it is a BHO...i think...so how come Spyware Guard saw nothing ?................false positive

 

I personally wouldn't rely on Ewido for my anti-spyware needs, from what I understand it's more of an anti-trojan. Nothing bad about Ewido, just that I don't think it can detect all spyware, it also misses some keyloggers too. For the heck of it, I just ran a fully updated Ad-aware on my xp sp2 machine and didn't get a detection for Favoriteman. I hope it's only a FP for you though.

 

my adaware has found favouriteman as well.

 

I thought that ewido is one of the better programs when i did a scan with spysweeper it didnt found anything but ewido found a couple of traces even a radmin and netwatcher.

 

Because Spyware Guard is not that effective anymore, which is why a new version has been in the works for some time.

No scanner/guard catches everything, even the good ones like Ewido. You could add Microsoft AntiSpyware, it adds BHO protection and along with a hostfile you would be a lot less likely to be hit by spy/adware.

 

I would be a bit careful of what you delete with the latest AdAware definitions - they may be suspect:-

https://www.wilderssecurity.com/showthread.php?p=546760#post546760

 

I would agree with Topper in regards to the latest AdAware definitions....especially in regards to your findings of Favoriteman\iun6002.exe. This particular item is making the rounds in regards to a False positive on other message boards and as usual will be commented to in a timely matter. I would also ask you to right click the iun6002.exe file and post what it says concerning it's properties. Many programs....one of which you may have unknowingly used....utilize a program called Setup Factory for installations.

Threads to watch elsewhere:

Ad-Aware f/p with SE1R64 31.08.2005 ??

 

A big thanks to all..

Properties: SUR60Runtime
720kb File Version 6.0.1.4.
2002 Indigo Rose Corp.
Product Name: Setup Factory 6.0 Runtime Module

So should i keep it or dump it Bubba
and thanks again

 

For now I would definetly treat this as a False Positive. Spybot incorrectly had this item at one time and a number of months back we dealt with this same False positive. I have also moved your thread to a more appropriate Forum since this is neither an Ewido issue nor trojan software issue IMHO.

 

Just to share ... what I posted on another board regarding this this detection to further enforce the F/P status. ...

 

Hi, Rainwalker and dog

Might mean nothing.

They are not the same, Re: SUR and SUF.

Take Care,
TheQuest

 

Thanks Quest..........typo

 

False positives have been addressed by Lavasoft.

SE1R64 31.08.2005 Build 75 available

 

Thanks Bubba...........................i guess

 

Just got update and scanned ..............this time found THREE instances..................Ad-Aware log showed 3am activity............what is that all about ??........i am in bed at 3am and the computer is off