False Positive/Spybot Dummies/Alexa

Discussion in 'NOD32 version 2 Forum' started by aagfr, Dec 19, 2004.

Thread Status:
Not open for further replies.
Page 1 of 2
  1. aagfr

    aagfr Registered Member

    Joined:
    Apr 15, 2004
    Posts:
    56
    I was scanning with Giant AS and got a warning re a virus in the Spybot Dummies directory. Sure seems to be a false positive. I did a couple of online scans (KAV and DrWeb) and it came up negative.

    As a newcomer to NOD32, I have no idea what to do to stop the NOD32 warning windows from popping up; and generally, what is it that one is to do with a false positive, in addition to submitting it for analysis.
     

    Attached Files:

    aagfr, Dec 19, 2004
    #1
  2. Blackspear

    Blackspear Global Moderator

    Joined:
    Dec 2, 2002
    Posts:
    15,115
    Location:
    Gold Coast, Queensland, Australia
    With this issue can you please send an email with a zipped copy of the file to samples@nod32.com and place a link to this thread. If you do not hear from Eset within 3 days (allows for weekends), please advise us here...

    We would appreciate if you could keep us in the loop with your progress, as we all learn this way…

    Cheers :D
     
    Blackspear, Dec 19, 2004
    #2
  3. redwolfe_98

    redwolfe_98 Registered Member

    Joined:
    Feb 14, 2002
    Posts:
    582
    Location:
    South Carolina, USA
    i noticed it too when i ran a scan with nod32 after the latest updates, v.1.953.. i submitted the file to "samples@nod32.com".. here is the entry from my nod32 scanner log:

    C:\Program Files\Spybot - Search & Destroy\Dummies\dummy.related.htm - Win32/Adware.Alexa Application

    i noticed that there was a "Win32/Adware.Alexa" in the latest nod32 definition-updates..
     
    redwolfe_98, Dec 19, 2004
    #3
  4. Rainwalker

    Rainwalker Registered Member

    Joined:
    May 18, 2003
    Posts:
    2,720
    Location:
    USA
    Same here and latest Spybot beta also flaged it :doubt:
     
    Rainwalker, Dec 19, 2004
    #4
  5. Gauthreau

    Gauthreau Guest

    I had that pop up as well.

    Neil
     
    Gauthreau, Dec 19, 2004
    #5
  6. jon_fl

    jon_fl Registered Member

    Joined:
    Sep 4, 2004
    Posts:
    242
    I had the same thing on 2 computers. :eek:
     
    jon_fl, Dec 19, 2004
    #6
  7. Firstshot

    Firstshot Guest

    Firstshot, Dec 19, 2004
    #7
  8. SteelyDon

    SteelyDon Registered Member

    Joined:
    Jul 9, 2004
    Posts:
    81
    Location:
    Southern Ontario
    I got:

    c:\windows\web\related.htm-Win32/Adware.AlexaApplication

    c:comm/Spybot\Spybot-Search&Destroy\Dummies\dummy.related.htm-Win32/Adware.AlexaApplication
     
    SteelyDon, Dec 19, 2004
    #8
  9. Blackspear

    Blackspear Global Moderator

    Joined:
    Dec 2, 2002
    Posts:
    15,115
    Location:
    Gold Coast, Queensland, Australia
    Blackspear, Dec 19, 2004
    #9
  10. DonKid

    DonKid Registered Member

    Joined:
    Jun 27, 2004
    Posts:
    566
    Location:
    S?o Paulo, Brazil
    Same here.
     
    DonKid, Dec 20, 2004
    #10
  11. ellison64

    ellison64 Registered Member

    Joined:
    Oct 5, 2003
    Posts:
    2,587
    Ive just put the dummies folder in the exclusion area of AMON which allows a spybot scan without any trouble now.However a NOD32 scan picks it up again.Its a shame there isnt some sort of excluder (as there is in AMON)in nod32 settings for on demand scans.
    ellison
     
    ellison64, Dec 20, 2004
    #11
  12. Chiana

    Chiana Registered Member

    Joined:
    Oct 7, 2003
    Posts:
    90
    Location:
    Oz
    Add me to the list as well. Just scanned a client's pc and received same pop up msg from NOD.

    Chiana
     
    Chiana, Dec 20, 2004
    #12
  13. bigc73542

    bigc73542 Retired Moderator

    Joined:
    Sep 21, 2003
    Posts:
    23,934
    Location:
    SW. Oklahoma
    I must be lucky,I have not seen this pop up warning yet.
     
    bigc73542, Dec 20, 2004
    #13
  14. snowbound

    snowbound Retired Moderator

    Joined:
    Feb 18, 2003
    Posts:
    8,723
    Location:
    The Big Smoke
    Just got the latest update(NOD32 1.954 (20041221), did a scan, seems it's fixed now. ;)



    snowbound
     
    snowbound, Dec 20, 2004
    #14
  15. jon_fl

    jon_fl Registered Member

    Joined:
    Sep 4, 2004
    Posts:
    242
    And if you deleted the Dummies files? Is that a problem? :oops:
     
    jon_fl, Dec 20, 2004
    #15
  16. ronjor

    ronjor Global Moderator

    Joined:
    Jul 21, 2003
    Posts:
    164,145
    Location:
    Texas
    If those dummies files are part of Spybot, I would just reinstall Spybot to put it back the way it was before deleting the files. :)
     
    ronjor, Dec 20, 2004
    #16
  17. Chiana

    Chiana Registered Member

    Joined:
    Oct 7, 2003
    Posts:
    90
    Location:
    Oz

    Updated to NOD32 1.954, scanned client's pc and all is well. No more pop ups!

    Thanks to the Eset team :D

    Chiana
     
    Chiana, Dec 20, 2004
    #17
  18. jon_fl

    jon_fl Registered Member

    Joined:
    Sep 4, 2004
    Posts:
    242
    One of the files deleted was from Spybot, so I'll re-install Spybot. The other was "C:\Windows\$NtServicePack Uninstall$\related.htm.Win32/Adware.Alexa Application". Not much I can do about that. I don't think that's a problem though. Am I right? :doubt:
     
    jon_fl, Dec 21, 2004
    #18
  19. DonKid

    DonKid Registered Member

    Joined:
    Jun 27, 2004
    Posts:
    566
    Location:
    S?o Paulo, Brazil
    1.954, fixed my problem too :D
     
    DonKid, Dec 21, 2004
    #19
  20. aagfr

    aagfr Registered Member

    Joined:
    Apr 15, 2004
    Posts:
    56
    For the record, I had sent a zip of the subject file to sample@nod32.com @ 12:03 am on 12/19/04, and received this response @ 2am today. In my view, Eset responded to the problem and my sample submittal quickly and efficiently.
    Thanks.
     

    Attached Files:

    aagfr, Dec 21, 2004
    #20
  21. jon_fl

    jon_fl Registered Member

    Joined:
    Sep 4, 2004
    Posts:
    242
    Was "C:\Windows\$NtServicePack Uninstall$\related.htm.Win32/Adware.Alexa Application" safe to delete or do I need to re-install that file?
     
    jon_fl, Dec 21, 2004
    #21
  22. ronjor

    ronjor Global Moderator

    Joined:
    Jul 21, 2003
    Posts:
    164,145
    Location:
    Texas
    If you deleted that file, I would think the only way to get it back would be to reinstall the service pack. On my computer, it's 373 mbs.
    If you don't plan on uninstalling the service pack, it probably doesn't matter. If you try to uninstall the service pack, Windows won't find that info if it it is needed.

    If you are using XP, you could try a restore back to a time before that false positive was found.

    Best I can do.
     
    ronjor, Dec 21, 2004
    #22
  23. Gauthreau

    Gauthreau Guest

    If you are really concerned about the file, try running the system file checker in the command prompt of XP. Go to Start -> All Programs -> Accessories -> Command Prompt and enter sfc /scannow at the prompt. You will need to have the original XP install disk in the drive.

    I deleted the files NOD found as well and haven't noticed any problems yet. I figured I would just leave it. My system is pretty snappy right now :).

    Neil
     
    Gauthreau, Dec 21, 2004
    #23
  24. jon_fl

    jon_fl Registered Member

    Joined:
    Sep 4, 2004
    Posts:
    242
    Well, my computer is running fine. I guess I won't worry about it..
     
    jon_fl, Dec 21, 2004
    #24
  25. redwolfe_98

    redwolfe_98 Registered Member

    Joined:
    Feb 14, 2002
    Posts:
    582
    Location:
    South Carolina, USA
    jon_fl, i would not worry about that file in "$NtServicePack Uninstall$" being deleted.. that is just an uninstaller for some ms patch.. it is highly unlikely that you would ever run an uninstall for a ms patch.. however, in the future, i would not be so quick to delete files that are flagged as malware.. false positives do occur, occasionally..
     
    redwolfe_98, Dec 21, 2004
    #25
Page 1 of 2
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...