mikew_nt Posted May 27, 2010 This just appeared last night for the first time. Log included below. I updated the definitions to 4996/2808 and re-scanned this morning, I still get the exact same result. I have used the interface to submit a false positive report for each of the four files. I have not quarantined the files yet. Please note that I have "Scan For Tracking Cookies" UN-checked, so I have no idea why this would get reported in any case. Several things: - These files are not new, they have been on my system for some time, and just got flagged last night. False positive? - Since I have "Scan For Tracking Cookies" UN-checked, I don't know why they would show up anyway. Could the SAS admin please look at this problem and let me know what to do? SUPERAntiSpyware Scan Log https://www.superantispyware.com Generated 05/27/2010 at 00:28 AM Application Version : 4.38.1004 Core Rules Database Version : 4995 Trace Rules Database Version: 2807 Scan type : Quick Scan Total Scan Time : 00:27:39 Memory items scanned : 609 Memory threats detected : 0 Registry items scanned : 598 Registry threats detected : 0 File items scanned : 41934 File threats detected : 4 Adware.Flash Tracking Cookie C:\Users\walsh\AppData\Roaming\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\ADGQ5XQU\CONVOAD.TECHNORATIMEDIA.COM C:\Users\walsh\AppData\Roaming\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\ADGQ5XQU\IA.MEDIA-IMDB.COM C:\Users\walsh\AppData\Roaming\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\ADGQ5XQU\UDN.SPECIFICCLICK.NET C:\Users\walsh\AppData\Roaming\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\ADGQ5XQU\SECURE-US.IMRWORLDWIDE.COM Share this post Link to post Share on other sites
mikew_nt Posted May 27, 2010 Just updated to 4998/2810, and problem still there. SAS admin? Share this post Link to post Share on other sites
pinkbull Posted May 27, 2010 Sorry to intrude, but I got the same thing (log file pasted below). The complete scan from the previous night (May 25) was clean. The files have also been on my system for a long time (since 2009). I forgot to uncheck before clicking the "next" button so I got them removed. I am running on Vista SP2. Thanks. ======================================== SUPERAntiSpyware Scan Log https://www.superantispyware.com Generated 05/27/2010 at 02:17 AM Application Version : 4.37.1000 Core Rules Database Version : 4996 Trace Rules Database Version: 2808 Scan type : Complete Scan Total Scan Time : 01:47:32 Memory items scanned : 593 Memory threats detected : 0 Registry items scanned : 6822 Registry threats detected : 0 File items scanned : 124879 File threats detected : 3 Adware.Flash Tracking Cookie C:\Users\wle\AppData\Roaming\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\SL7LTM36\MSNTEST.SERVING-SYS.COM C:\Users\wle\AppData\Roaming\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\SL7LTM36\SERVING-SYS.COM C:\Users\wle\AppData\Roaming\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\SL7LTM36\VITAMINE.NETWORLDMEDIA.NET Share this post Link to post Share on other sites
Seth Posted May 27, 2010 Hi Mike and Pinkbull. It's being looked into, and we'll keep you posted. Share this post Link to post Share on other sites
anchor Posted May 27, 2010 Hi Mike and Pinkbull. It's being looked into, and we'll keep you posted. I got this too just now after doing a custom scan. I have left these flash tracking cookies in the quarantine and will deal with them once we hear from you as to what to do next. SUPERAntiSpyware Scan Log Generated 05/27/2010 at 09:16 PM Application Version : 4.24.1004 Core Rules Database Version : 4998 Trace Rules Database Version: 2810 Scan type : Custom Scan Total Scan Time : 00:21:27 Memory items scanned : 183 Memory threats detected : 0 Registry items scanned : 3140 Registry threats detected : 0 File items scanned : 3903 File threats detected : 249 Adware.Flash Tracking Cookie C:\WINDOWS\Application Data\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\NA2MGLU2\IA.MEDIA-IMDB.COM C:\WINDOWS\Application Data\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\NA2MGLU2\S0.2MDN.NET C:\WINDOWS\Application Data\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\NA2MGLU2\SECURE-US.IMRWORLDWIDE.COM Share this post Link to post Share on other sites
SUPERAntiSpy Posted May 27, 2010 We simply enabled our new Flash Cookie rules (most people don't know flash drops cookies as well) - we have had the request to clean them, as well as Firefox and Chrome cookies (next version). The can't "harm" your system, but can be used to track behavior and surfing habits by Flash Applications. Share this post Link to post Share on other sites
anchor Posted May 27, 2010 We simply enabled our new Flash Cookie rules (most people don't know flash drops cookies as well) - we have had the request to clean them, as well as Firefox and Chrome cookies (next version). The can't "harm" your system, but can be used to track behavior and surfing habits by Flash Applications. Can they be safely removed? I am still left with 58 folders that contain various web addresses .com and wonder if it's safe to remove them too. Share this post Link to post Share on other sites
Seth Posted May 27, 2010 Can they be safely removed? Yes. Share this post Link to post Share on other sites
Daveski17 Posted May 27, 2010 I've been using Chrome for a few days now (I installed it Monday) & I am half way through a full SAS scan & I have 27 'Flash Cookies'. I take it they are safe to remove with the 2 other cookies found? Share this post Link to post Share on other sites
Seth Posted May 27, 2010 I've been using Chrome for a few days now (I installed it Monday) & I am half way through a full SAS scan & I have 27 'Flash Cookies'. I take it they are safe to remove with the 2 other cookies found? Yes. http://www.ghacks.net/2007/05/04/flash-cookies-explained/ Share this post Link to post Share on other sites
Daveski17 Posted May 27, 2010 Yes. http://www.ghacks.net/2007/05/04/flash-cookies-explained/ OK thanks. Share this post Link to post Share on other sites
mikew_nt Posted May 28, 2010 OK, I appreciate the explanation, but for those of us that have UN-checked "Scan for tracking cookies", why are these still getting flagged? After too many reboots, and consideration of the minor privacy risk with most of the cookies associated with the sites I visit, I finally unchecked the option to scan for tracking cookies (as I did uncheck the option to automatically quarantine after too many false positives). Can these be reclassified by the SAS application to fit into the category controlled by "Scan for tracking cookies"? Share this post Link to post Share on other sites
Madeline Posted May 30, 2010 I've had some Adware.Flash Tracking Cookies found recently, so I let SAS remove and quarantine them. What I found a bit odd was that SAS said that I should restart my PC for the cookies to be removed properly. Why is that necessary just for a few tracking cookies? Thanks. Share this post Link to post Share on other sites
anchor Posted May 30, 2010 I've had some Adware.Flash Tracking Cookies found recently, so I let SAS remove and quarantine them. What I found a bit odd was that SAS said that I should restart my PC for the cookies to be removed properly. Why is that necessary just for a few tracking cookies? Thanks. Good question, I hope this gets answered. Share this post Link to post Share on other sites
Madeline Posted May 31, 2010 Having read the articles linked to by siliconman01 in this thread I think it's a good thing that SAS has removed these Flash Cookies and if it takes a restart to get the job done properly, that's fine by me too. Share this post Link to post Share on other sites
siliconman01 Posted May 31, 2010 Having read the articles linked to by siliconman01 in this thread I think it's a good thing that SAS has removed these Flash Cookies and if it takes a restart to get the job done properly, that's fine by me too. Installing freebie cleaning program CCleaner on your system will remove Flash Cookies for you when you run CCleaner...along with a lot of other temporary and junk files. It runs on XP, Vista, Windows 7 (32-bit and 64-bit on all OS). CCleaner can be run as frequently as you want to. I run it multiple times per day on my Win 7 x86 and Win 7 x64 computers. i DO NOT run the registry cleaner component of CCleaner...just the file cleaning component. http://www.piriform.com/ccleaner/builds (Download/install the SLIM version) User forum: http://forum.piriform.com/ Also ensure that your Flash Player is the latest version. http://get.adobe.com/flashplayer/?promoid=BUIGP Share this post Link to post Share on other sites
mikew_nt Posted June 1, 2010 SAS, My question still remains: if these are tracking cookies (and the title says they are), why are they being picked up when we have Scan for Tracking Cookies UNchecked? If these are malicious (and there are no reports that they are), it would seem to make sense to rename/recategorize them as something else. If they are indeed tracking cookies, then shouldn't their reporting be dependent on the checking/UNchecking of Scan for Tracking Cookies? This seems like a bug to me in SAS. It should be one of the two above, but right now this sure looks like a bug to me. Share this post Link to post Share on other sites
Madeline Posted June 1, 2010 @ siliconman01 Thanks for both your excellent advice and the links you posted in the other thread. Share this post Link to post Share on other sites
seth1212 Posted June 5, 2010 help - I keep getting error messages & keep rebooting computer - I run scan again & freakin cookies are back. How am I supposed to look for porn? Share this post Link to post Share on other sites
groucho43 Posted June 5, 2010 help - I keep getting error messages & keep rebooting computer - I run scan again & freakin cookies are back. How am I supposed to look for porn? Flash cookies a.k.a. Adware.Flash tracking cookies are a.k.a. Local Shared Objects and they are tracking cookies that you do not see in your Cookies folder: see Local Shared Objects Share this post Link to post Share on other sites
anchor Posted June 12, 2010 Did a scan this morning and 2 more Adware Flash tracking cookies were reported. IA.MEDIA-IMDB.COM and BROADCAST.PIXMEDIA.FR I take it it's safe to remove them, of course my system re-booted when I attempted to close SAS. Share this post Link to post Share on other sites
