Avast WEBforum

Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: timarose on July 15, 2008, 04:57:42 AM

Title: Avast deleted my SpyStopper Pro exe file
Post by: timarose on July 15, 2008, 04:57:42 AM
Today I tried to Install SpyStopper Pro but Avast deleted the exe file before I could Install it. This needs fixed.

SpyStopper Pro 5.0

http://www.itcompany.com/spystop.htm


Help
Title: Re: Avast deleted my SpyStopper Pro exe file
Post by: Vladimyr on July 15, 2008, 05:10:14 AM
Hmm... Tried it myself just now. No problem at all except for WinPatrol alert.

At what point did avast! alert you and I'm curious as to why it was deleted and not quarantined?
Title: Re: Avast deleted my SpyStopper Pro exe file
Post by: leemar on July 15, 2008, 10:16:05 AM
yes, avast is not supposed to delete it, at default it will inform u (the user) what to do with the file infected. i think you should update your avast 4.8.
Title: Re: Avast deleted my SpyStopper Pro exe file
Post by: wyrmrider on July 15, 2008, 06:34:41 PM
There may be a good reason it gets flagged

http://www.spywarewarrior.com/viewtopic.php?t=28758

evidently spystopper pro is a licensed clone of SpyBlocker Pro

no recent info yet on Spyblocker Pro or Spystopper Pro

a user at spywarewarrior is going to test it so try the thread above tomorrow
also this link was posted

http://malwarebytes.org/forums/index.php?showtopic=1300&hl=
discusses programs from rebrandsoft and

http://itcompany.com/
hard to tell which is which

however i just checked and my system blocks the link in the first post
http://www.itcompany.com/spystop.htm
gotta be a reason
Title: Re: Avast deleted my SpyStopper Pro exe file
Post by: Vladimyr on July 16, 2008, 05:01:15 AM
however i just checked and my system blocks the link in the first post
http://www.itcompany.com/spystop.htm
gotta be a reason

Does avast! Web Shield block this on your system? 'cause it don't on mine!
Title: Re: Avast deleted my SpyStopper Pro exe file
Post by: wyrmrider on July 16, 2008, 05:09:17 AM
Host file is blocking
no idea if web shield does or not

one of the problems with re branded software is that the initial package may be ok
BUT
the rebrander - or "affiliate"
in this case -it something or other
may add their own packages,  to it
not saying that happened here - but it happens all the time

I'm not going to download to test
someone else be the guinea pig
perhaps someone at the Spywarewarrior site will- they are into that kind of thing and have disposable machines or VM to help
no way on a production machine

Title: Re: Avast deleted my SpyStopper Pro exe file
Post by: Vladimyr on July 16, 2008, 06:19:37 AM
Jotti (http://virusscan.jotti.org/) result below on file from from http://www.itcompany.com/spystop.htm and Softpedia (http://www.softpedia.com/get/Internet/Popup-Ad-Spyware-Blockers/SpyStopper-Pro.shtml)

I can't say if its any good but I've found no evidence to classify it as "rogueware", or to explain why avast! would "delete" it.

Title: Re: Avast deleted my SpyStopper Pro exe file
Post by: Maxx_original on July 16, 2008, 08:57:18 AM
i got the same results... i can't confirm the false detection, because the version available here is not detected (even after unpacking)...
Title: Re: Avast deleted my SpyStopper Pro exe file
Post by: timarose on July 16, 2008, 09:24:00 AM
I don't understand what happen. I had to disable AVAST to Install it and then it worked.
Title: Re: Avast deleted my SpyStopper Pro exe file
Post by: YoKenny on July 16, 2008, 12:35:10 PM
There may be a good reason it gets flagged

http://www.spywarewarrior.com/viewtopic.php?t=28758

evidently spystopper pro is a licensed clone of SpyBlocker Pro

no recent info yet on Spyblocker Pro or Spystopper Pro

a user at spywarewarrior is going to test it so try the thread above tomorrow
also this link was posted

http://malwarebytes.org/forums/index.php?showtopic=1300&hl=
discusses programs from rebrandsoft and

http://itcompany.com/
hard to tell which is which

however i just checked and my system blocks the link in the first post
http://www.itcompany.com/spystop.htm
gotta be a reason
MVPS HOSTS file blocks it:
http://www.mvps.org/winhelp2002/hosts.htm
Title: Re: Avast deleted my SpyStopper Pro exe file
Post by: wyrmrider on July 16, 2008, 04:09:46 PM
MVPS HOSTS blocks
gotta be a reason  :)

now that this piece of questionableware is installed how about a results report
hopefully it finds nothing
do not delete any hits but post them up here
let's check for false positives (and cookie hits) before hosing your system

why are you so insistent to have a program by
http://itcompany.com/
on your computer?

even ad-aware would be a better choice :)
and spybot search and destroy or superantispyware much better choices

just curious
Title: Re: Avast deleted my SpyStopper Pro exe file
Post by: Lisandro on July 16, 2008, 05:19:05 PM
why are you so insistent to have a program by
http://itcompany.com/
on your computer?
Users... do not go there...  :P
Title: Re: Avast deleted my SpyStopper Pro exe file
Post by: wyrmrider on July 16, 2008, 07:49:31 PM
those who are following the thread at Spywarewarrior
http://www.spywarewarrior.com/viewtopic.php?t=28758

"I installed SpyBlocker btw ...... it killed my machine Confused (had to restore the system to get it back up and running)"

both HPHOSTS and MVPS hosts block
an example of a good reason to keep a HOSTS file up to date

how ya doing timarose 
are you a malware researcher?
you may be now
keep in touch
your system may need a cleaning
Title: Re: Avast deleted my SpyStopper Pro exe file
Post by: wyrmrider on July 18, 2008, 06:21:42 AM
http://www.emsisoft.com/en/malware/?Adware.Win32.SpyStopper

Name: Adware.Win32.SpyStopper

Risklevel: Elevated Risk

dialogs from the thread

"So it's a clean file? Huh

Yes. As is Spystopper Pro"

something does not compute here
I tried to check IT on K9 but was blocked
Title: Re: Avast deleted my SpyStopper Pro exe file
Post by: Vladimyr on July 18, 2008, 08:51:02 AM
If SpyStopper Pro (ssp.exe) is adware then we are probably wise to avoid it, as we do Google, Yahoo toolbars and other adware.

However, this is about why or how avast! would unilaterally delete SpyStopper from timarose's PC when it is not identified as a threat at jotti (http://virusscan.jotti.org/) (which includes Emsisoft's own A-Squared), virustotal (http://www.virustotal.com/), or by SuperAntispyware, Spyware Terminator or Threatfire.
Title: Re: Avast deleted my SpyStopper Pro exe file
Post by: wyrmrider on July 18, 2008, 07:12:51 PM
Good point I'll try and keep on topic
I'll go back over the thread but we suspect that AVAST does this repeatedly we should be able to catch the behaviour in a log

I wonder if ad-aware finds it :)
however those spineless wonders would remove the find if anyone says BOO

that's IMHO BTW

I'm researching to see if the block by HOSTS providers is from ad serving or phoning home