CastleCops, Internet Crime Fighters
Need help? Click here to register for free! Absolutely zero advertisements on this site!

Donation/Premium
spacer
block bottom
Security Central
spacer
· Home
· PIRT/Fried Phish
· MIRT
· SIRT
· Deutsch
· Wiki
· Newsletter
· O16/ActiveX
· CLSID List
· Contest2007
· Downloads
· Feedback (send)
· Forums
· HijackThis
· Hijacktrend
· LSPs
· My Downloads
· O18
· O20
· O21
· O22
· O23
· O9
· Premium
· Private Messages
· Proxomitron
· Reviews
· Search
· StartupList
· Stories Archive
· Submit News
· WsIRT
· Your Account
· Acceptable Use Policy
block bottom
spacer spacer

[DONE]Webroot detected but didn't remove

 
Post new topic   Reply to topic       All -> FavForums -> Rootkit Revelations [del.icio.us!] [digg it!] [reddit!]
View previous topic :: View next topic  
Author Message
RiBiNiN

Blue Angel
Staff Writer
Staff Writer

Joined: May 04, 2006
Posts: 463

Blue Security Premium Team F@H

PostPosted: Sat Jul 15, 2006 6:04 pm    Post subject: Webroot detected but didn't remove
Reply with quote

The file shown in this picture http://www.websplasher.com/images/P6210059_S8.jpg could not be removed. I opened a ticket and they replied that it might be a false positive and could be a real Microsoft file. They didn't sound all that definite, and even so, I am not really a "trust it if it comes from Microsoft" guy. I have IE7 installed, and my guess it is associated with that but don't know for sure.

Is this ok to not get too worked up about?


_________________
Websplasher website design. Design with a splash.
Back to top
View users profile Send private message Visit posters website
negster22

Security Expert
Premium Member

Joined: Mar 10, 2004
Posts: 5394

Moderators MVP Premium RootKit Detection Hosts Rootkit Experts Security Experts SRT

PostPosted: Sat Jul 15, 2006 7:02 pm    Post subject:
Reply with quote

Rest easy, RiBiNiN - that is a confirmed false positive related to IE7's anti-phishing filter. Smile

Please read here at the bottom of the post:
http://forums.pcpitstop.com/lofiversion/index.php/t117632.html

Quote:
The "Potentially rootkit-masked files", that SpySweeper finds, is indeed the super-hidden folder which is made by the new Anti/Phishing-filter of IE 7.
Even if SpySweeper is able to remove the folder ...\temporary internetfiles\antiphishing\..., IE7 will make a new one ...
So, by all means, this is a False Positive.


_________________
Negster22 - MS MVP - Consumer Security 2006-2008 image
Back to top
View users profile Send private message Visit posters website
RiBiNiN

Blue Angel
Staff Writer
Staff Writer

Joined: May 04, 2006
Posts: 463

Blue Security Premium Team F@H

PostPosted: Sat Jul 15, 2006 7:43 pm    Post subject:
Reply with quote

Thanks negster22, I appreciate the quick answer.

You can't be too careful these days.


_________________
Websplasher website design. Design with a splash.
Back to top
View users profile Send private message Visit posters website
negster22

Security Expert
Premium Member

Joined: Mar 10, 2004
Posts: 5394

Moderators MVP Premium RootKit Detection Hosts Rootkit Experts Security Experts SRT

PostPosted: Mon Jul 17, 2006 1:10 am    Post subject:
Reply with quote

Your welcome, RiBiNiN.

Quote:
You can't be too careful these days.

True, until a false positive is confirmed, there is no way of knowing it's not the real thing, so I can well understand your concern.


_________________
Negster22 - MS MVP - Consumer Security 2006-2008 image
Back to top
View users profile Send private message Visit posters website
Display posts from previous:   
Post new topic   Reply to topic       All -> FavForums -> Rootkit Revelations All times are GMT
Page 1 of 1

 
Quick Reply:
Username: 

Quote the last message
Attach signature (signatures can be changed in profile)
 
You can post new topics in this forum
You can reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum


Powered by phpBB © 2001 phpBB Group
spacer spacer