Zone Alarm false positive?

Question

My ZASS scan has just reported

FraudTool.Win32.SpyAway.ag in

Windows\System32\MSCOMCTL.OCX

and

ZS561401.CAB somewhere in the MSOCACHE directory tree.

Both these files are past their first birthday, so I'm guessing this is a false positive. I've browsed the web, and there's not much recent in English - it has been identified as an fp a number of times by different scanners, but I wondered if anyone could point me to a site/forum which might confirm that it's a flase positive again this time...

Spybot Search and Destroy

SuperAntiSpyware

Malwarebytes' Anti-Malware

all give the files a clean bill of health...

Answer 1

it's Malware / Adware

SpyAway is a rogue security program that provides no protection against adware or spywares. It shows false warnings.

Characteristics:

It shows you poor scan results.

Shows false results and warning messages.

Installation: Installed through EXE

Process: SpyAway.exe

click on this link for more info.

http://www.emsisoft.com/en/malware/?Adwa...

.

Answer 2

It looks like this was a fault in Zone Alarm's anti virus signatures.

It was corrected fairly quickly, but it would have been better if ZA could have put something up front immediately - rather than leaving you sweating.

It's second hand on a forum anyway...

Time to switch - BitDefender looks good...

Answer 3

ZS561401.CAB   is related to office 2003

FraudTool win32 informaion

http://www.sophos.org/security/analyses/...