Legit files identified as Trojan Hoster

[whatmeworry]

Yesterday, I downloaded the free version of SAS and ran a full scan. SAS identified a few tracking cookies, which didn't surprise or concern me, but it also identified something called Trojan Hoster, which consisted of two files:

Trojan.Hoster

C:\WINDOWS\SYSTEM32\ESCLICWD.DLL

C:\WINDOWS\SYSTEM32\ESCSIRIBBON.DLL

I was surprised, since I had just run a full scan with Malwarebytes Anti-Malware Pro, and it hadn't turned up Trojan Hoster. I wrote to the Malwarebytes forum to ask why SAS had found this and MBAM had not. They had me upload the files to them. They examined them and reported that these were not malicious files but were part of a program called StampIt. That made sense to me, since I own StampIt (http://www.stampitnet.com/) and it had been acting VERY strangely yesterday. After the Malwarebytes tech support told me that the files I sent them were part of StampIt, I understood why the program had been acting strangely--SAS had removed two of its files. I'm writing to let you know, so you can adjust your database.

[whatmeworry]

Thanks for your response. I updated the definitions to the most recent, ran another scan which again flagged "Trojan Hoster," and submitted a False Positive report, as you instructed.

[miross11]

We are the developer of StampIt for Word http://www.stampitnet.com. We will provide any of our files for review upon request made to support.stampit@stampitnet.com. The files to which you refer are licensing (ESCLicWD.DLL) and Word 2007 menu (ESCIRIBBON.DLL) libraries.

-------------------------

Enhancement Software, LPP

323-850-1362