fp252 Posted March 21, 2010 Every time I do a full scan with SuperAntiSpyware (free edition) the following file threat is detected, even if I remove the threat and scan again: CommonName Toolbar/Browser Helper Object HKCR\CLSID\{00000000-0000-0000-0000-000000000000} HKCR\CLSID\{00000000-0000-0000-0000-000000000000}\LocalServer32 The result appeared in the first scan after I installed SAS -- one week after I did a clean Windows XP reinstall. I am not completely sure if it's a false positive, but I'm pretty sure it is, since it is not detected by any of my other antivirus/antispyware programs. Note that I also have Spybot Search & Destroy installed; I'm not sure if the Immunization tool's dummy files may be to blame. Share this post Link to post Share on other sites
Seth Posted March 21, 2010 Every time I do a full scan with SuperAntiSpyware (free edition) the following file threat is detected, even if I remove the threat and scan again: CommonName Toolbar/Browser Helper Object HKCR\CLSID\{00000000-0000-0000-0000-000000000000} HKCR\CLSID\{00000000-0000-0000-0000-000000000000}\LocalServer32 The result appeared in the first scan after I installed SAS -- one week after I did a clean Windows XP reinstall. I am not completely sure if it's a false positive, but I'm pretty sure it is, since it is not detected by any of my other antivirus/antispyware programs. Note that I also have Spybot Search & Destroy installed; I'm not sure if the Immunization tool's dummy files may be to blame. They look like harmless null entries to me, and I agree that they're probably inserted by Spybot's registry protection. Make sure you're scanning with the latest SAS definition files. If the entries still show up after the scan, select them and click on Report False Positive. Share this post Link to post Share on other sites
fp252 Posted April 22, 2010 Update: The scans lately still has been turning up with this reported threat, even after updating or setting the 'threat' to be removed. However, I recently scanned with Spybot Search & Destroy, and the CommonName item appears in its scan as well. This appeared in a saved log: CommonName: [sBI $A5CE4ECE] Class ID (Registry key, nothing done) HKEY_CLASSES_ROOT\CLSID\{00000000-0000-0000-0000-000000000000} Well, that rules out the possibility that it's a Spybot dummy file... still seems like it's some other harmless file though. Share this post Link to post Share on other sites