Spyware Warrior

Sergei · Posted: Sun Sep 05, 2004 8:13 am Post subject: False positive in Spybot S&D 1.3?

Since upgrading to 1.3, Spybot has been telling me that I have CWS.Msconfig, a CoolWebSearch variant - even though CWShredder says it's not present.

Spybot tells me this:
CWS.Msconfig: IE context menu item (Registry key, nothing done)
HKEY_USERS\S-1-5-21-816525921-1941336622-2217370082-500\Software\Microsoft\Internet Explorer\MenuExt\Search

However, there is no such registry key.

Note that it doesn't always appear. I can scan with Spybot and find it, close Spybot without cleaning it, scan again and not find it. Also I have no symptoms of any system hijacking, and am well-protected. So I'm almost certain it's a false positive.

But what do I do now!?!

mikey · Posted: Mon Sep 06, 2004 7:20 am Post subject:

I don't know what to tell you as that key doesn't exist in any of our sys. (yes I realize the IDs vary) I can't imagine why it would detect sporadically either.

Are you using the beta defs or the beta 1.3.1 upgrade?
_________________
-
W2K/2K3/XP/2K8/Vista/W7/RHE/DEBIAN/SUSE

Spyware/Adware is NOT freeware, it costs all of us dearly.

Mikey's Stuff

Fiddler and friends...essential web diagnostic, forensic, & development tools.
-