False positive

[Hubird]

If you download "Windows Enabler" from http://www.angelfire.com/falcon/speedload/index.html
extract it to the desktop then attempt to move it to the root of C:\ spyware doctor pops up a box saying "Malicious Action Blocked", it wrongly detects "Windows Enabler" as a "Dollarrevenue" trojan.

[AChen]

Hi Hubird,

Thanks for the info. I have escalated this to the Malware Research Centre for further analysis. Will get back to you shortly.

[AChen]

We have just run a test and could not recreate this issue with Windows enabler. After extracting the files and running a scan, it came out clean.

Could you please run a scan instead of letting SD's OnGuard detect this. If the scan detects files from Windows enabler, could you get a screenshot and post it on this thread and we'll go from there.

[Hubird]

Will run a full scan and let you know what happens, I can run it and copy it to the desktop without any warnings but as soon as I try to move it to C:\ spyware doctor kicks in. Here is a copy of the log entry for the event:

Threat Name - Trojan.Dollarrevenue
Details - Spyware Doctor has blocked an application attempting to read from a file.
Risk Level - High
Infection - C:\windows_enabler\Windows Enabler.exe

[Hubird]

Full scan and scanning just the windows_enabler folder did not come up with anything, however moving the folder still cause the .exe files to be deleted and the message to pop up.

[AChen]

Full scan and scanning just the windows_enabler folder did not come up with anything, however moving the folder still cause the .exe files to be deleted and the message to pop up.

Could you please send us the File that SD's OnGuard is detecting. Please see PM :)