Jump to content
mikew_nt

Adware.Flash Tracking Cookie

Recommended Posts

This just appeared last night for the first time. Log included below.

I updated the definitions to 4996/2808 and re-scanned this morning, I still get the exact same result.

I have used the interface to submit a false positive report for each of the four files.

I have not quarantined the files yet.

Please note that I have "Scan For Tracking Cookies" UN-checked, so I have no idea why this would get reported in any case.

Several things:

- These files are not new, they have been on my system for some time, and just got flagged last night. False positive?

- Since I have "Scan For Tracking Cookies" UN-checked, I don't know why they would show up anyway.

Could the SAS admin please look at this problem and let me know what to do?

SUPERAntiSpyware Scan Log

https://www.superantispyware.com

Generated 05/27/2010 at 00:28 AM

Application Version : 4.38.1004

Core Rules Database Version : 4995

Trace Rules Database Version: 2807

Scan type : Quick Scan

Total Scan Time : 00:27:39

Memory items scanned : 609

Memory threats detected : 0

Registry items scanned : 598

Registry threats detected : 0

File items scanned : 41934

File threats detected : 4

Adware.Flash Tracking Cookie

C:\Users\walsh\AppData\Roaming\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\ADGQ5XQU\CONVOAD.TECHNORATIMEDIA.COM

C:\Users\walsh\AppData\Roaming\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\ADGQ5XQU\IA.MEDIA-IMDB.COM

C:\Users\walsh\AppData\Roaming\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\ADGQ5XQU\UDN.SPECIFICCLICK.NET

C:\Users\walsh\AppData\Roaming\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\ADGQ5XQU\SECURE-US.IMRWORLDWIDE.COM

Share this post


Link to post
Share on other sites

Sorry to intrude, but I got the same thing (log file pasted below). The complete scan from the previous night (May 25) was clean. The files have also been on my system for a long time (since 2009). I forgot to uncheck before clicking the "next" button so I got them removed.

I am running on Vista SP2. Thanks.

========================================

SUPERAntiSpyware Scan Log

https://www.superantispyware.com

Generated 05/27/2010 at 02:17 AM

Application Version : 4.37.1000

Core Rules Database Version : 4996

Trace Rules Database Version: 2808

Scan type : Complete Scan

Total Scan Time : 01:47:32

Memory items scanned : 593

Memory threats detected : 0

Registry items scanned : 6822

Registry threats detected : 0

File items scanned : 124879

File threats detected : 3

Adware.Flash Tracking Cookie

C:\Users\wle\AppData\Roaming\MACROMEDIA\FLASH

PLAYER\#SHAREDOBJECTS\SL7LTM36\MSNTEST.SERVING-SYS.COM

C:\Users\wle\AppData\Roaming\MACROMEDIA\FLASH

PLAYER\#SHAREDOBJECTS\SL7LTM36\SERVING-SYS.COM

C:\Users\wle\AppData\Roaming\MACROMEDIA\FLASH

PLAYER\#SHAREDOBJECTS\SL7LTM36\VITAMINE.NETWORLDMEDIA.NET

Share this post


Link to post
Share on other sites

Hi Mike and Pinkbull.

It's being looked into, and we'll keep you posted.

Share this post


Link to post
Share on other sites

Hi Mike and Pinkbull.

It's being looked into, and we'll keep you posted.

I got this too just now after doing a custom scan.

I have left these flash tracking cookies in the quarantine and will deal with them once we hear from you as to what to do next.

SUPERAntiSpyware Scan Log

Generated 05/27/2010 at 09:16 PM

Application Version : 4.24.1004

Core Rules Database Version : 4998

Trace Rules Database Version: 2810

Scan type : Custom Scan

Total Scan Time : 00:21:27

Memory items scanned : 183

Memory threats detected : 0

Registry items scanned : 3140

Registry threats detected : 0

File items scanned : 3903

File threats detected : 249

Adware.Flash Tracking Cookie

C:\WINDOWS\Application Data\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\NA2MGLU2\IA.MEDIA-IMDB.COM

C:\WINDOWS\Application Data\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\NA2MGLU2\S0.2MDN.NET

C:\WINDOWS\Application Data\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\NA2MGLU2\SECURE-US.IMRWORLDWIDE.COM

Share this post


Link to post
Share on other sites

We simply enabled our new Flash Cookie rules (most people don't know flash drops cookies as well) - we have had the request to clean them, as well as Firefox and Chrome cookies (next version).

The can't "harm" your system, but can be used to track behavior and surfing habits by Flash Applications.

Share this post


Link to post
Share on other sites

We simply enabled our new Flash Cookie rules (most people don't know flash drops cookies as well) - we have had the request to clean them, as well as Firefox and Chrome cookies (next version).

The can't "harm" your system, but can be used to track behavior and surfing habits by Flash Applications.

Can they be safely removed?

I am still left with 58 folders that contain various web addresses .com and wonder if it's safe to remove them too.

Share this post


Link to post
Share on other sites

I've been using Chrome for a few days now (I installed it Monday) & I am half way through a full SAS scan & I have 27 'Flash Cookies'. I take it they are safe to remove with the 2 other cookies found?

Share this post


Link to post
Share on other sites

OK, I appreciate the explanation, but for those of us that have UN-checked "Scan for tracking cookies", why are these still getting flagged?

After too many reboots, and consideration of the minor privacy risk with most of the cookies associated with the sites I visit, I finally unchecked the option to scan for tracking cookies (as I did uncheck the option to automatically quarantine after too many false positives).

Can these be reclassified by the SAS application to fit into the category controlled by "Scan for tracking cookies"?

Share this post


Link to post
Share on other sites

I've had some Adware.Flash Tracking Cookies found recently, so I let SAS remove and quarantine them.

What I found a bit odd was that SAS said that I should restart my PC for the cookies to be removed properly. Why is that necessary just for a few tracking cookies? Thanks. :?

Share this post


Link to post
Share on other sites

I've had some Adware.Flash Tracking Cookies found recently, so I let SAS remove and quarantine them.

What I found a bit odd was that SAS said that I should restart my PC for the cookies to be removed properly. Why is that necessary just for a few tracking cookies? Thanks. :?

Good question, I hope this gets answered.

:rolleyes:

Share this post


Link to post
Share on other sites

Having read the articles linked to by siliconman01 in this thread I think it's a good thing that SAS has removed these Flash Cookies and if it takes a restart to get the job done properly, that's fine by me too.

Share this post


Link to post
Share on other sites

Having read the articles linked to by siliconman01 in this thread I think it's a good thing that SAS has removed these Flash Cookies and if it takes a restart to get the job done properly, that's fine by me too.

Installing freebie cleaning program CCleaner on your system will remove Flash Cookies for you when you run CCleaner...along with a lot of other temporary and junk files. It runs on XP, Vista, Windows 7 (32-bit and 64-bit on all OS). CCleaner can be run as frequently as you want to. I run it multiple times per day on my Win 7 x86 and Win 7 x64 computers. i DO NOT run the registry cleaner component of CCleaner...just the file cleaning component.

http://www.piriform.com/ccleaner/builds (Download/install the SLIM version)

User forum:

http://forum.piriform.com/

Also ensure that your Flash Player is the latest version.

http://get.adobe.com/flashplayer/?promoid=BUIGP

Share this post


Link to post
Share on other sites

SAS,

My question still remains: if these are tracking cookies (and the title says they are), why are they being picked up when we have Scan for Tracking Cookies UNchecked?

If these are malicious (and there are no reports that they are), it would seem to make sense to rename/recategorize them as something else.

If they are indeed tracking cookies, then shouldn't their reporting be dependent on the checking/UNchecking of Scan for Tracking Cookies?

This seems like a bug to me in SAS. It should be one of the two above, but right now this sure looks like a bug to me.

Share this post


Link to post
Share on other sites

@ siliconman01

Thanks for both your excellent advice and the links you posted in the other thread. :-)

Share this post


Link to post
Share on other sites
:-P help - I keep getting error messages & keep rebooting computer - I run scan again & freakin cookies are back. How am I supposed to look for porn?

Share this post


Link to post
Share on other sites

:-P help - I keep getting error messages & keep rebooting computer - I run scan again & freakin cookies are back. How am I supposed to look for porn?

Flash cookies a.k.a. Adware.Flash tracking cookies are a.k.a. Local Shared Objects and they are tracking cookies that you do not see in your Cookies folder: see Local Shared Objects

Share this post


Link to post
Share on other sites

Did a scan this morning and 2 more Adware Flash tracking cookies were reported.

IA.MEDIA-IMDB.COM

and

BROADCAST.PIXMEDIA.FR

I take it it's safe to remove them, of course my system re-booted when I attempted to close SAS.

Share this post


Link to post
Share on other sites
Guest
This topic is now closed to further replies.

×
×
  • Create New...