Jump to content

Possibility of FP in NCH Swift Sound


mona7865
 Share

Recommended Posts

Could someone please check whether this might be a FP? As far as I could find out, it seems to be related to NCH Swift Sound, which has been installed on my laptop for ages.

Malwarebytes' Anti-Malware 1.42

Database version: 3397

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

20/12/2009 17:24:26

mbam-log-2009-12-20 (17-24-18).txt

Scan type: Quick Scan

Objects scanned: 126494

Time elapsed: 7 minute(s), 56 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 1

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Switch (Switch.Dialer) -> No action taken. [689974844AD6B3951656E316BF39E090]

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

Heartfelt thanks.

Link to post
Share on other sites

  • Staff

Hi Mona,

Not that sure if this is a false positive. I know you are Dutch and the switch dialer is common in Belgium and the Netherlands, especially now with these holidays since there's a new version around that comes with "kerstgedichten generator". It could aldo be an older leftover (switch dialer is common in the Benelux for years and comes in many variants). Also see here

Anyway, an export of that key would help. I thought that Swift had an uninstaller with Swift in the name instead of switch.

Can you do me a favour and export that key please?

To do this, Open notepad and copy and paste next present in the quotebox in it:

regedit /e look.txt "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\switch"

start notepad look.txt

Save this as look.bat , choose to save as *all files and place it on your desktop.

It should look like this: bat.gif

Doubleclick on it and notepad should open. In case you run Vista, rightclick the look.bat and select to run as administrator.

Copy and paste the contents of it in your next reply.

Link to post
Share on other sites

I hope I did it right.

This is what I got from running fix.bat :

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\switch]

"DisplayName"="Switch"

"Publisher"="NCH Swift Sound"

"UninstallString"="C:\\Program Files\\NCH Swift Sound\\Switch\\uninst.exe"

As far as I know, I didn't get an update recently and I definitely didn't download this "kerstgedichten generator".

Hope this has been of help.

Link to post
Share on other sites

  • Staff

Hi Mona, you are right here. In your case, it's indeed a false positive. Looks like NCH Swift Sound uses the same uninstall key as the malicious switch dialer and it looks like more scanners are also detecting that one.

Please ignore that detection for now. This will be fixed in next update. Thank you for your co-operation :D

Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.