[RESOLVED] UPDATECHECKER.EXE

[gypsy63]

Using:
Windows 7 Premium--64 bit
SuperAntiSpyware--Professional
Malwarebites--free
Avast--free

For the last 2 mornings every time I turn on my computer, SuperAntiSpyware always tells me I have a Trojan. It listed as: SYSWOW64\C2\UPDATECHECKER.EXE

I have checked this file with all my other security ware and none of them seem to think anything is wrong with this file. The only reason I have hesitated about doing anything with this file is because I suspect it has something to do with C-Net's TechTracker. I have use TechTracker for years with no problems. It keeps track of all the software I download from C-Net and lets me know whenever they are out of date and needs to be updated--also provides me with the ability to download the updates right from the TechTracker. I have used C-Net for over 10 years to download most of my programs and have never received any thing nasty from them--considered a safe site to download from. Once a long time ago C-net warned that when you downloaded something from their site that your security ware would tell you that their downloader was a virus/Trojan but that it was not. So it was only after I updated some of my software, using TechTracker, that I started getting a notice from SuperAntiSpyware that I had a Trojan. So do you know if this really is a Trojan, or if it probably has something to do with the TechTracker, and thus, would not really be harmful?
Thanks,
Sheila

[fink]

I would upload it here.. https://www.virustotal.com/en/ to be multiscanned. My initial inclination is that it's a false positive but see what these scans say and let us know.

You can copy/paste the address of the results page so we can see first hand.

[gypsy63]

Fink: It said that this file had already been scanned before 2 weeks ago. Sounds as if someone else had this same question about this file. Here are the results it said, but if you think I should rescan the file let me know. Here is those results from 2 weeks ago: (link to the page)

https://www.virustotal.com/en/file/2...b5db/analysis/

[fink]

I don't think there's any need to rescan it. It does indeed look like a false positive though so if Superantispyware has an easy method to report it you may want to do so.. otherwise you can just ignore the warning or if there's an option to whitelist or permanently ignore the file within Superantispyware then do that.

EDIT- there is a built-in false positive reporter at the end of the scan so you can use that..

http://forums.superantispyware.com/i...lse-positives/

[gypsy63]

Fink: I went back and scanned the file with SAS so that I could report it, and this time its results were negative! I had not changed anything, so didn't understand why suddenly SAS had changed its mind about this file! So just to check something out, I re-booted my computer to see if it would pop back up again with a warning. It usually does this when I first turn on the computer for the day. But after I rebooted, it did not show me this warning again Have no idea what changed for SAS to no longer warn me about this file--so I had nothing to report to the link that you provided for the SAS site.
Sheila

[fink]

They probably updated their data file after others sent in false positive reports so new scans no longer see it as a threat.

I'd say you're good to go

[gypsy63]

Fink: Thanks for your advise and help. I also save the site that you provided a link for checking out a file. From now on if I have a question about a file, I will use that site if I have conflicting results from my security ware. This is good to have for a backup for checking a suspicious file. If that site ever shows me a negative result from a file, I will come back here and post the problem. For now, I will post this as resolved and keep my fingers crossed that I don't get that warning tomorrow morning! (or I will be back!)
Grateful for your help,
Sheila

[fink]

You're welcome. Even if for some reason Superantispyware does suddenly start flagging that file again I would just submit it as a false positive and continue to dismiss the warning.. although I doubt it will at this point.