Possible false positive - CommonName Toolbar/Browser Helper Object

[fp252]

Every time I do a full scan with SuperAntiSpyware (free edition) the following file threat is detected, even if I remove the threat and scan again:

CommonName Toolbar/Browser Helper Object
HKCR\CLSID\{00000000-0000-0000-0000-000000000000}
HKCR\CLSID\{00000000-0000-0000-0000-000000000000}\LocalServer32

The result appeared in the first scan after I installed SAS -- one week after I did a clean Windows XP reinstall. I am not completely sure if it's a false positive, but I'm pretty sure it is, since it is not detected by any of my other antivirus/antispyware programs.

Note that I also have Spybot Search & Destroy installed; I'm not sure if the Immunization tool's dummy files may be to blame.

[Seth]

Every time I do a full scan with SuperAntiSpyware (free edition) the following file threat is detected, even if I remove the threat and scan again:

CommonName Toolbar/Browser Helper Object
HKCR\CLSID\{00000000-0000-0000-0000-000000000000}
HKCR\CLSID\{00000000-0000-0000-0000-000000000000}\LocalServer32

The result appeared in the first scan after I installed SAS -- one week after I did a clean Windows XP reinstall. I am not completely sure if it's a false positive, but I'm pretty sure it is, since it is not detected by any of my other antivirus/antispyware programs.

Note that I also have Spybot Search & Destroy installed; I'm not sure if the Immunization tool's dummy files may be to blame.

They look like harmless null entries to me, and I agree that they're probably inserted by Spybot's registry protection.

Make sure you're scanning with the latest SAS definition files. If the entries still show up after the scan, select them and click on Report False Positive.

[fp252]

Update:

The scans lately still has been turning up with this reported threat, even after updating or setting the 'threat' to be removed.

However, I recently scanned with Spybot Search & Destroy, and the CommonName item appears in its scan as well. This appeared in a saved log:

CommonName: [sBI $A5CE4ECE] Class ID (Registry key, nothing done)
 HKEY_CLASSES_ROOT\CLSID\{00000000-0000-0000-0000-000000000000}

Well, that rules out the possibility that it's a Spybot dummy file... still seems like it's some other harmless file though.