Possibility of FP in NCH Swift Sound

[mona7865]

Could someone please check whether this might be a FP? As far as I could find out, it seems to be related to NCH Swift Sound, which has been installed on my laptop for ages.

Malwarebytes' Anti-Malware 1.42

Database version: 3397

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

20/12/2009 17:24:26

mbam-log-2009-12-20 (17-24-18).txt

Scan type: Quick Scan

Objects scanned: 126494

Time elapsed: 7 minute(s), 56 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 1

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Switch (Switch.Dialer) -> No action taken. [689974844AD6B3951656E316BF39E090]

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

Heartfelt thanks.

[miekiemoes]

Hi Mona,

Not that sure if this is a false positive. I know you are Dutch and the switch dialer is common in Belgium and the Netherlands, especially now with these holidays since there's a new version around that comes with "kerstgedichten generator". It could aldo be an older leftover (switch dialer is common in the Benelux for years and comes in many variants). Also see here

Anyway, an export of that key would help. I thought that Swift had an uninstaller with Swift in the name instead of switch.

Can you do me a favour and export that key please?

To do this, Open notepad and copy and paste next present in the quotebox in it:

regedit /e look.txt "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\switch"

start notepad look.txt

Save this as look.bat , choose to save as *all files and place it on your desktop.

It should look like this:

Doubleclick on it and notepad should open. In case you run Vista, rightclick the look.bat and select to run as administrator.

Copy and paste the contents of it in your next reply.

[mona7865]

I hope I did it right.

This is what I got from running fix.bat :

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\switch]

"DisplayName"="Switch"

"Publisher"="NCH Swift Sound"

"UninstallString"="C:\\Program Files\\NCH Swift Sound\\Switch\\uninst.exe"

As far as I know, I didn't get an update recently and I definitely didn't download this "kerstgedichten generator".

Hope this has been of help.

[miekiemoes]

Hi Mona, you are right here. In your case, it's indeed a false positive. Looks like NCH Swift Sound uses the same uninstall key as the malicious switch dialer and it looks like more scanners are also detecting that one.

Please ignore that detection for now. This will be fixed in next update. Thank you for your co-operation

[mona7865]

Thank you very much! You've set my mind at rest.

Have a nice evening and please take care as it's very dangerous outside now.

[miekiemoes]

You're most welcome