Re: SPR/Madtol.C program

From: David H. Lipman (DLipman~nospam~_at_Verizon.Net)
Date: 07/19/05 

Date: Mon, 18 Jul 2005 23:05:03 -0400

From: "Kayman" <Kayman@discussions.microsoft.com>

| Thanks Dave.
| Some new developments.
| I clicked on Spyware Doctor and prior loading the AntiVir warning sign
| popped up again. Like several times before the number (following"MC") has
| changed, this time to "2C". I immediately clicked Start=>Run and typed
| C:\DOCUME~1\PATTAY~1\LOCALS~1\TEMP\MC2C.TMP into the space provided for.
| For the first time this file showed up!
| I accessed VirusTotal, attached the file but was unable to send off the
| message. Without my doing, the computer then behaved somewhat erratic, making
| several "clicking" sounds in quick repetitions (identical sounds/noises when
| using the mouse). A window popped up displaying a message that it the message
| could not be send (these are not the exact words as the window disappeared
| very quickly). Many more of the AntiVir warning signs and New Message signs
| from Outlook Express popped up in quick successions and for a short while my
| computer "froze". Again, without my doing the, message to scan@ virustotal
| was saved in the Outlook Express Outbox but without attachment.
| I again clicked Start=>Run and typed
| C:\DOCUME~1\PATTAY~1\LOCALS~1\TEMP\MC2C.TMP into the space provided for but
| this time the file has disappeared.
|
| Also, while the AntiVir warning sign is showing it seems to be the dominant
| display on my desktop - it always will stay on top - for example when opening
| VirusTotal or click Start=>Run these applications can not be moved on the top
| of the Warning sign but stay underneath.
|
| Coming back to your response. If this is a False Positive declaration,
| should I just leave everything as is and ignore the AntiVir Warning sign?
| Or is there anything else I could do like deleting the AntiVir and Spyware
| Doctor Programms and the files I had sent to VirusTotal?
| Is a False Positive declaration something I should be concerned with and if
| so, is there a program commercially available for removing this?
| If you wish I could send you a screenshot which shows the AntiVir Warning
| sign.
| I also wish to confirm that none of the 20 Anti Virus vendors found any
| viruses in the files sent to VirusTotal.
| Best regards,

If none of the AV vendors found anything on a file declared to have the SPR/Madtol.C, and is
what not a zero byte file than I strongly think it is a False Poistive declaration.

I am waiting for another poster to send his file(s) to Virus Total. If he too finds a
report where "where no virus found" is indicated for all the AV vendors, then AntiVir has a
definite False Positive declaration problem. That poster also noted the file flagged was a
.TMP file ( mc22.tmp ). Not unlike your file. 

-- 
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm
Loading