False Positive

[Billy B]

Malwarebytes' Anti-Malware 1.32

Database version: 1624

Windows 5.1.2600 Service Pack 2

1/6/2009 4:28:55 PM

mbam-log-2009-01-06 (16-28-39).txt

Scan type: Quick Scan

Objects scanned: 78125

Time elapsed: 6 minute(s), 6 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 1

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Spy Protector (Rogue.SpyProtector) -> No action taken.

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

[Raid]

It's not a false positive. It's just hitting on an old registry key left over.

[mart44]

Same alert here with with the paid version of Security Task Manager installed (includes Spy Protector).

Trying out Malwarebytes just happened to coincide with me updating Security Task Manager from version 1.7e to 1.7g. Before upgrading, Malwarebytes flagged the Registry entry as shown by Billy B. I let Malwarebytes remove it. On reboot, Malwarebytes gave the system a clean bill of health and Security Task Manager's Spy Protector still appeared to work. Checked this again after another reboot with the same result.

After the Security Task Manager upgrade, I did another scan with Malwarebytes. The Registry entry was back, so it seems certain that it comes in as part of Security Task Manager's Spy Protector. Security Task Manager has a reputation as being a good program. So could this indeed be a false positive?