False Positive/Spybot Dummies/Alexa

Discussion in 'NOD32 version 2 Forum' started by aagfr, Dec 19, 2004.

Thread Status:
Not open for further replies.
  1. aagfr

    aagfr Registered Member

    Joined:
    Apr 15, 2004
    Posts:
    56
    I was scanning with Giant AS and got a warning re a virus in the Spybot Dummies directory. Sure seems to be a false positive. I did a couple of online scans (KAV and DrWeb) and it came up negative.

    As a newcomer to NOD32, I have no idea what to do to stop the NOD32 warning windows from popping up; and generally, what is it that one is to do with a false positive, in addition to submitting it for analysis.
     

    Attached Files:

  2. Blackspear

    Blackspear Global Moderator

    Joined:
    Dec 2, 2002
    Posts:
    15,115
    Location:
    Gold Coast, Queensland, Australia
    With this issue can you please send an email with a zipped copy of the file to samples@nod32.com and place a link to this thread. If you do not hear from Eset within 3 days (allows for weekends), please advise us here...

    We would appreciate if you could keep us in the loop with your progress, as we all learn this way…

    Cheers :D
     
  3. redwolfe_98

    redwolfe_98 Registered Member

    Joined:
    Feb 14, 2002
    Posts:
    581
    Location:
    South Carolina, USA
    i noticed it too when i ran a scan with nod32 after the latest updates, v.1.953.. i submitted the file to "samples@nod32.com".. here is the entry from my nod32 scanner log:

    C:\Program Files\Spybot - Search & Destroy\Dummies\dummy.related.htm - Win32/Adware.Alexa Application

    i noticed that there was a "Win32/Adware.Alexa" in the latest nod32 definition-updates..
     
  4. Rainwalker

    Rainwalker Registered Member

    Joined:
    May 18, 2003
    Posts:
    2,106
    Location:
    USA
    Same here and latest Spybot beta also flaged it :doubt:
     
  5. Gauthreau

    Gauthreau Guest

    I had that pop up as well.

    Neil
     
  6. jon_fl

    jon_fl Registered Member

    Joined:
    Sep 4, 2004
    Posts:
    242
    I had the same thing on 2 computers. :eek:
     
  7. Firstshot

    Firstshot Guest

  8. SteelyDon

    SteelyDon Registered Member

    Joined:
    Jul 9, 2004
    Posts:
    81
    Location:
    Southern Ontario
    I got:

    c:\windows\web\related.htm-Win32/Adware.AlexaApplication

    c:comm/Spybot\Spybot-Search&Destroy\Dummies\dummy.related.htm-Win32/Adware.AlexaApplication
     
  9. Blackspear

    Blackspear Global Moderator

    Joined:
    Dec 2, 2002
    Posts:
    15,115
    Location:
    Gold Coast, Queensland, Australia
  10. DonKid

    DonKid Registered Member

    Joined:
    Jun 27, 2004
    Posts:
    566
    Location:
    S?o Paulo, Brazil
    Same here.
     
  11. ellison64

    ellison64 Registered Member

    Joined:
    Oct 5, 2003
    Posts:
    2,499
    Ive just put the dummies folder in the exclusion area of AMON which allows a spybot scan without any trouble now.However a NOD32 scan picks it up again.Its a shame there isnt some sort of excluder (as there is in AMON)in nod32 settings for on demand scans.
    ellison
     
  12. Chiana

    Chiana Registered Member

    Joined:
    Oct 7, 2003
    Posts:
    90
    Location:
    Oz
    Add me to the list as well. Just scanned a client's pc and received same pop up msg from NOD.

    Chiana
     
  13. bigc73542

    bigc73542 Retired Moderator

    Joined:
    Sep 21, 2003
    Posts:
    23,873
    Location:
    SW. Oklahoma
    I must be lucky,I have not seen this pop up warning yet.
     
  14. snowbound

    snowbound Retired Moderator

    Joined:
    Feb 18, 2003
    Posts:
    8,723
    Location:
    The Big Smoke
    Just got the latest update(NOD32 1.954 (20041221), did a scan, seems it's fixed now. ;)



    snowbound
     
  15. jon_fl

    jon_fl Registered Member

    Joined:
    Sep 4, 2004
    Posts:
    242
    And if you deleted the Dummies files? Is that a problem? :oops:
     
  16. ronjor

    ronjor Global Moderator

    Joined:
    Jul 21, 2003
    Posts:
    57,802
    Location:
    Texas
    If those dummies files are part of Spybot, I would just reinstall Spybot to put it back the way it was before deleting the files. :)
     
  17. Chiana

    Chiana Registered Member

    Joined:
    Oct 7, 2003
    Posts:
    90
    Location:
    Oz

    Updated to NOD32 1.954, scanned client's pc and all is well. No more pop ups!

    Thanks to the Eset team :D

    Chiana
     
  18. jon_fl

    jon_fl Registered Member

    Joined:
    Sep 4, 2004
    Posts:
    242
    One of the files deleted was from Spybot, so I'll re-install Spybot. The other was "C:\Windows\$NtServicePack Uninstall$\related.htm.Win32/Adware.Alexa Application". Not much I can do about that. I don't think that's a problem though. Am I right? :doubt:
     
  19. DonKid

    DonKid Registered Member

    Joined:
    Jun 27, 2004
    Posts:
    566
    Location:
    S?o Paulo, Brazil
    1.954, fixed my problem too :D
     
  20. aagfr

    aagfr Registered Member

    Joined:
    Apr 15, 2004
    Posts:
    56
    For the record, I had sent a zip of the subject file to sample@nod32.com @ 12:03 am on 12/19/04, and received this response @ 2am today. In my view, Eset responded to the problem and my sample submittal quickly and efficiently.
    Thanks.
     

    Attached Files:

  21. jon_fl

    jon_fl Registered Member

    Joined:
    Sep 4, 2004
    Posts:
    242
    Was "C:\Windows\$NtServicePack Uninstall$\related.htm.Win32/Adware.Alexa Application" safe to delete or do I need to re-install that file?
     
  22. ronjor

    ronjor Global Moderator

    Joined:
    Jul 21, 2003
    Posts:
    57,802
    Location:
    Texas
    If you deleted that file, I would think the only way to get it back would be to reinstall the service pack. On my computer, it's 373 mbs.
    If you don't plan on uninstalling the service pack, it probably doesn't matter. If you try to uninstall the service pack, Windows won't find that info if it it is needed.

    If you are using XP, you could try a restore back to a time before that false positive was found.

    Best I can do.
     
  23. Gauthreau

    Gauthreau Guest

    If you are really concerned about the file, try running the system file checker in the command prompt of XP. Go to Start -> All Programs -> Accessories -> Command Prompt and enter sfc /scannow at the prompt. You will need to have the original XP install disk in the drive.

    I deleted the files NOD found as well and haven't noticed any problems yet. I figured I would just leave it. My system is pretty snappy right now :).

    Neil
     
  24. jon_fl

    jon_fl Registered Member

    Joined:
    Sep 4, 2004
    Posts:
    242
    Well, my computer is running fine. I guess I won't worry about it..
     
  25. redwolfe_98

    redwolfe_98 Registered Member

    Joined:
    Feb 14, 2002
    Posts:
    581
    Location:
    South Carolina, USA
    jon_fl, i would not worry about that file in "$NtServicePack Uninstall$" being deleted.. that is just an uninstaller for some ms patch.. it is highly unlikely that you would ever run an uninstall for a ms patch.. however, in the future, i would not be so quick to delete files that are flagged as malware.. false positives do occur, occasionally..
     
Thread Status:
Not open for further replies.