autoclk.exe

  • Thread starter Thread starter JRosenfeld
  • Start date Start date
J

JRosenfeld

I had autoclk.exe in c:\Windows. The file properties do
not identify the company or the software that it might be
associated with, just autoclk MFC Application.

MSAS started flagging it with 5743 or 5745 (forget which)
as trojan.killreg and indeed there are lots of reports
from other sources connecting this file with that Trojan
(and its other name equivalents). However, I certainly
have none of the symptoms that are said to be associated
with it. NAV did not flag it.

Other posts indicate that it, by itself, is a (harmless if
useless) Windows utility

http://startup.iamnotageek.com/srch-autoclk.exe.html

I have never had it in the startups, however.

and one German site connects it with adsl modem software

http://www.wintotal.de/Spyware/index.php?Filter=A

although also stating that it is flagged as spyware by
many apps, but adds falsepositive? at the end of its
comment.

I do have an ADSL modem, but of different manufacture from
the one cited there.

I moved it out of C:\windows folder for a week or so, and
did not find anything asking for it, using the PC
normally. So now I've let MSAS delete it.

But I am wondering if it should be classed as a false
positive if just the file is present?

Comments appreciated.
 
I guess, now that I can see the initial message in this thread, which
arrived after the second one--that you don't have it around to check the new
defs.

I don't know the answer. I lean towards your thought that when this
detection finds this file alone, it is probably a false positive.
Still--it'd be nice to have an explanation for how that file came to be
present on your machine.

I'll have to remember to keep an eye out for this one--it will likely come
to be posted again at some point.

--
 
Yes, it was flagged by 5747 as well. That's when I decided
to let MSAS delete it, as in any case I did not seem to
need it (I don't have problems clicking the mouse :-))
 
I think I need a test case. It's possible that this discussion, in this
group, is sufficient, but I think it'd be better to have someone with a
legitimate autoclk.exe with a clear rationale for how it got on their syste
(i.e. URL for download of software that includes it)--and Microsoft
Antispyware detecting, and thus busting this software. That'd be something
replicable and clearly not right.

As it is now, it is sort of theoretical--it sounds like detecting
autoclk.exe by itself is bad, but we don't have any clear proof that
autoclk.exe is good.

--
 
Thank you for your continued interest.

I have done some more searching.

First I have identified the probable source of autoclk.exe
on my system. I found a second reference at castlecops:

http://castlecops.com/s7533-autoclk_exe.html

(why that did not come up on my first searches, I don't
know). It states:

Name autoclk
Command autoclk.exe
Status Y
Description Sagem Modem driver. Installed and required on
systems running Windows 98 or ME

I do have a Sagem USB ADSL F@st 800 modem. But I am not
running W98 or Me (I have XP SP2).

I've looked at the Sagem modem driver install files, but
unfortunately a good part of the install is in two
data.cab files that I can't open (Winzip reports cannot
open error 'not in the standard MS cab format, the
signature bytes are missing', Winrar reports error 'wrong
format or corrupted file')so I can't positively say that
this is the source of autoclk.exe on my system.
Autoclk.exe is not explicitly listed on the CD. The manual
for the modem makes no reference to it. Nevertheless that
seems a plausible explanation as to how the file got onto
my system and why why nothing untoward happened when I
moved and subsequently deleted autoclk.exe.

As for the Windows utility to which I had earlier found
reference, I finally found the site

http://autoclik.8m.com/ which describes the utility
mentioned in my first post.

I downloaded the .zip file from that site and found that
one of the files in it is autoclik.exe [note different
spelling, 'clik' instead of 'clk']. So I think that some
of the links in my original message have mixed the two up,
and this utility is a red herring.

The question remains: if this is a file included with
modem drivers, should it be flagged? I double checked in
MSAS history, and it definitely flagged
C:\Windows\autoclk.exe (without the i).
 
Oldfrog has just posted at Castlecops, confirming autoclk
is from Sagem modem
http://castlecops.com/t130993-
Autoclk_exe_False_Positive.html
-----Original Message-----
Thank you for your continued interest.

I have done some more searching.

First I have identified the probable source of autoclk.exe
on my system. I found a second reference at castlecops:

http://castlecops.com/s7533-autoclk_exe.html

(why that did not come up on my first searches, I don't
know). It states:

Name autoclk
Command autoclk.exe
Status Y
Description Sagem Modem driver. Installed and required on
systems running Windows 98 or ME

I do have a Sagem USB ADSL F@st 800 modem. But I am not
running W98 or Me (I have XP SP2).

I've looked at the Sagem modem driver install files, but
unfortunately a good part of the install is in two
data.cab files that I can't open (Winzip reports cannot
open error 'not in the standard MS cab format, the
signature bytes are missing', Winrar reports error 'wrong
format or corrupted file')so I can't positively say that
this is the source of autoclk.exe on my system.
Autoclk.exe is not explicitly listed on the CD. The manual
for the modem makes no reference to it. Nevertheless that
seems a plausible explanation as to how the file got onto
my system and why why nothing untoward happened when I
moved and subsequently deleted autoclk.exe.

As for the Windows utility to which I had earlier found
reference, I finally found the site

http://autoclik.8m.com/ which describes the utility
mentioned in my first post.

I downloaded the .zip file from that site and found that
one of the files in it is autoclik.exe [note different
spelling, 'clik' instead of 'clk']. So I think that some
of the links in my original message have mixed the two up,
and this utility is a red herring.

The question remains: if this is a file included with
modem drivers, should it be flagged? I double checked in
MSAS history, and it definitely flagged
C:\Windows\autoclk.exe (without the i).

-----Original Message-----
I think I need a test case. It's possible that this discussion, in this
group, is sufficient, but I think it'd be better to have someone with a
legitimate autoclk.exe with a clear rationale for how it got on their syste
(i.e. URL for download of software that includes it)--
Click to expand...
and
Microsoft
Antispyware detecting, and thus busting this software. That'd be something
replicable and clearly not right.

As it is now, it is sort of theoretical--it sounds like detecting
autoclk.exe by itself is bad, but we don't have any
Click to expand...
clear
proof that
autoclk.exe is good.

--
Click to expand...
Click to expand...
 
That's enough for me, and I think this thread is probably enough for
Microsoft.

Thanks for all the detail--I'll try to make sure that this gets some
attention if that isn't already under way, which it may well be.

--

JRosenfeld said:
Oldfrog has just posted at Castlecops, confirming autoclk
is from Sagem modem
http://castlecops.com/t130993-
Autoclk_exe_False_Positive.html
-----Original Message-----
Thank you for your continued interest.

I have done some more searching.

First I have identified the probable source of autoclk.exe
on my system. I found a second reference at castlecops:

http://castlecops.com/s7533-autoclk_exe.html

(why that did not come up on my first searches, I don't
know). It states:

Name autoclk
Command autoclk.exe
Status Y
Description Sagem Modem driver. Installed and required on
systems running Windows 98 or ME

I do have a Sagem USB ADSL F@st 800 modem. But I am not
running W98 or Me (I have XP SP2).

I've looked at the Sagem modem driver install files, but
unfortunately a good part of the install is in two
data.cab files that I can't open (Winzip reports cannot
open error 'not in the standard MS cab format, the
signature bytes are missing', Winrar reports error 'wrong
format or corrupted file')so I can't positively say that
this is the source of autoclk.exe on my system.
Autoclk.exe is not explicitly listed on the CD. The manual
for the modem makes no reference to it. Nevertheless that
seems a plausible explanation as to how the file got onto
my system and why why nothing untoward happened when I
moved and subsequently deleted autoclk.exe.

As for the Windows utility to which I had earlier found
reference, I finally found the site

http://autoclik.8m.com/ which describes the utility
mentioned in my first post.

I downloaded the .zip file from that site and found that
one of the files in it is autoclik.exe [note different
spelling, 'clik' instead of 'clk']. So I think that some
of the links in my original message have mixed the two up,
and this utility is a red herring.

The question remains: if this is a file included with
modem drivers, should it be flagged? I double checked in
MSAS history, and it definitely flagged
C:\Windows\autoclk.exe (without the i).

-----Original Message-----
I think I need a test case. It's possible that this discussion, in this
group, is sufficient, but I think it'd be better to have someone with a
legitimate autoclk.exe with a clear rationale for how it got on their syste
(i.e. URL for download of software that includes it)--
Click to expand...
and
Microsoft
Antispyware detecting, and thus busting this software. That'd be something
replicable and clearly not right.

As it is now, it is sort of theoretical--it sounds like detecting
autoclk.exe by itself is bad, but we don't have any
Click to expand...
clear
proof that
autoclk.exe is good.

--

Yes, it was flagged by 5747 as well. That's when I decided
to let MSAS delete it, as in any case I did not seem to
need it (I don't have problems clicking the mouse :-))
-----Original Message-----
I guess, now that I can see the initial message in this
thread, which
arrived after the second one--that you don't have it
around to check the new
defs.

I don't know the answer. I lean towards your thought
that when this
detection finds this file alone, it is probably a false
positive.
Still--it'd be nice to have an explanation for how that
file came to be
present on your machine.

I'll have to remember to keep an eye out for this one- -
it will likely come
to be posted again at some point.

--

in message

.
Click to expand...
Click to expand...
Click to expand...
 
Got this this morning from a fellow who lost connectivity
due to this:
"I then attempted to reinstall the modem software, at
which time I kept seeing autoclk.exe appearing in my task
manager. I scanned multiple times with MSAS and removed
the 'trojan' as it kept appearing, no wonder, as I kept
reinstalling the modem software."
This would seem to confirm the source of the file as the
Sagem modem software as provided by Tiscali. Additional
details at http://castlecops.com/t130993-
Autoclk_exe_False_Positive.html
-----Original Message-----
That's enough for me, and I think this thread is probably enough for
Microsoft.

Thanks for all the detail--I'll try to make sure that this gets some
attention if that isn't already under way, which it may well be.

--

Oldfrog has just posted at Castlecops, confirming autoclk
is from Sagem modem
http://castlecops.com/t130993-
Autoclk_exe_False_Positive.html
-----Original Message-----
Thank you for your continued interest.

I have done some more searching.

First I have identified the probable source of autoclk.exe
on my system. I found a second reference at castlecops:

http://castlecops.com/s7533-autoclk_exe.html

(why that did not come up on my first searches, I don't
know). It states:

Name autoclk
Command autoclk.exe
Status Y
Description Sagem Modem driver. Installed and required on
systems running Windows 98 or ME

I do have a Sagem USB ADSL F@st 800 modem. But I am not
running W98 or Me (I have XP SP2).

I've looked at the Sagem modem driver install files, but
unfortunately a good part of the install is in two
data.cab files that I can't open (Winzip reports cannot
open error 'not in the standard MS cab format, the
signature bytes are missing', Winrar reports error 'wrong
format or corrupted file')so I can't positively say that
this is the source of autoclk.exe on my system.
Autoclk.exe is not explicitly listed on the CD. The manual
for the modem makes no reference to it. Nevertheless that
seems a plausible explanation as to how the file got onto
my system and why why nothing untoward happened when I
moved and subsequently deleted autoclk.exe.

As for the Windows utility to which I had earlier found
reference, I finally found the site

http://autoclik.8m.com/ which describes the utility
mentioned in my first post.

I downloaded the .zip file from that site and found that
one of the files in it is autoclik.exe [note different
spelling, 'clik' instead of 'clk']. So I think that some
of the links in my original message have mixed the two up,
and this utility is a red herring.

The question remains: if this is a file included with
modem drivers, should it be flagged? I double checked in
MSAS history, and it definitely flagged
C:\Windows\autoclk.exe (without the i).


-----Original Message-----
I think I need a test case. It's possible that this
discussion, in this
group, is sufficient, but I think it'd be better to have
someone with a
legitimate autoclk.exe with a clear rationale for how it
got on their syste
(i.e. URL for download of software that includes it)-- and
Microsoft
Antispyware detecting, and thus busting this software.
That'd be something
replicable and clearly not right.

As it is now, it is sort of theoretical--it sounds like
detecting
autoclk.exe by itself is bad, but we don't have any clear
proof that
autoclk.exe is good.

--

in message
Yes, it was flagged by 5747 as well. That's when I
decided
to let MSAS delete it, as in any case I did not seem to
need it (I don't have problems clicking the mouse :- ))
-----Original Message-----
I guess, now that I can see the initial message in this
thread, which
arrived after the second one--that you don't have it
around to check the new
defs.

I don't know the answer. I lean towards your thought
that when this
detection finds this file alone, it is probably a false
positive.
Still--it'd be nice to have an explanation for how that
file came to be
present on your machine.

I'll have to remember to keep an eye out for this
Click to expand...
one-
-
it will likely come
to be posted again at some point.

--

"Bill Sanderson" <[email protected]>
wrote
in message
news:[email protected]
Click to expand...
so
f
t.
com...
Is this detection still present with 5747 definitions?
Thanks for
sticking with this issue and reminding us.

--

"JRosenfeld" <[email protected]>
wrote in message
Just to add one more reference to autoclk.exe not
being a
trojan by itself:

http://www.2-spyware.com/file-autoclk-exe.html

-----Original Message-----
I had autoclk.exe in c:\Windows. The file properties
do
not identify the company or the software that it
might
be
associated with, just autoclk MFC Application.

MSAS started flagging it with 5743 or 5745 (forget
which)
as trojan.killreg and indeed there are lots of
reports
from other sources connecting this file with that
Trojan
(and its other name equivalents). However, I
certainly
have none of the symptoms that are said to be
associated
with it. NAV did not flag it.

Other posts indicate that it, by itself, is a
(harmless
if
useless) Windows utility

http://startup.iamnotageek.com/srch- autoclk.exe.html

I have never had it in the startups, however.

and one German site connects it with adsl modem
software

http://www.wintotal.de/Spyware/index.php?Filter=A

although also stating that it is flagged as spyware
by
many apps, but adds falsepositive? at the end of its
comment.

I do have an ADSL modem, but of different manufacture
from
the one cited there.

I moved it out of C:\windows folder for a week or so,
and
did not find anything asking for it, using the PC
normally. So now I've let MSAS delete it.

But I am wondering if it should be classed as a false
positive if just the file is present?

Comments appreciated.




.





.



.

.
Click to expand...
Click to expand...


.
Click to expand...
 
Thanks! that's helpful to have posted--clear negative customer impact.
--

Oldfrog said:
Got this this morning from a fellow who lost connectivity
due to this:
"I then attempted to reinstall the modem software, at
which time I kept seeing autoclk.exe appearing in my task
manager. I scanned multiple times with MSAS and removed
the 'trojan' as it kept appearing, no wonder, as I kept
reinstalling the modem software."
This would seem to confirm the source of the file as the
Sagem modem software as provided by Tiscali. Additional
details at http://castlecops.com/t130993-
Autoclk_exe_False_Positive.html
-----Original Message-----
That's enough for me, and I think this thread is probably enough for
Microsoft.

Thanks for all the detail--I'll try to make sure that this gets some
attention if that isn't already under way, which it may well be.

--

Oldfrog has just posted at Castlecops, confirming autoclk
is from Sagem modem
http://castlecops.com/t130993-
Autoclk_exe_False_Positive.html

-----Original Message-----
Thank you for your continued interest.

I have done some more searching.

First I have identified the probable source of
autoclk.exe
on my system. I found a second reference at castlecops:

http://castlecops.com/s7533-autoclk_exe.html

(why that did not come up on my first searches, I don't
know). It states:

Name autoclk
Command autoclk.exe
Status Y
Description Sagem Modem driver. Installed and required on
systems running Windows 98 or ME

I do have a Sagem USB ADSL F@st 800 modem. But I am not
running W98 or Me (I have XP SP2).

I've looked at the Sagem modem driver install files, but
unfortunately a good part of the install is in two
data.cab files that I can't open (Winzip reports cannot
open error 'not in the standard MS cab format, the
signature bytes are missing', Winrar reports error 'wrong
format or corrupted file')so I can't positively say that
this is the source of autoclk.exe on my system.
Autoclk.exe is not explicitly listed on the CD. The
manual
for the modem makes no reference to it. Nevertheless that
seems a plausible explanation as to how the file got onto
my system and why why nothing untoward happened when I
moved and subsequently deleted autoclk.exe.

As for the Windows utility to which I had earlier found
reference, I finally found the site

http://autoclik.8m.com/ which describes the utility
mentioned in my first post.

I downloaded the .zip file from that site and found that
one of the files in it is autoclik.exe [note different
spelling, 'clik' instead of 'clk']. So I think that some
of the links in my original message have mixed the two
up,
and this utility is a red herring.

The question remains: if this is a file included with
modem drivers, should it be flagged? I double checked in
MSAS history, and it definitely flagged
C:\Windows\autoclk.exe (without the i).


-----Original Message-----
I think I need a test case. It's possible that this
discussion, in this
group, is sufficient, but I think it'd be better to have
someone with a
legitimate autoclk.exe with a clear rationale for how it
got on their syste
(i.e. URL for download of software that includes it)--
and
Microsoft
Antispyware detecting, and thus busting this software.
That'd be something
replicable and clearly not right.

As it is now, it is sort of theoretical--it sounds like
detecting
autoclk.exe by itself is bad, but we don't have any
clear
proof that
autoclk.exe is good.

--

in message
Yes, it was flagged by 5747 as well. That's when I
decided
to let MSAS delete it, as in any case I did not seem to
need it (I don't have problems clicking the mouse :- ))
-----Original Message-----
I guess, now that I can see the initial message in this
thread, which
arrived after the second one--that you don't have it
around to check the new
defs.

I don't know the answer. I lean towards your thought
that when this
detection finds this file alone, it is probably a false
positive.
Still--it'd be nice to have an explanation for how that
file came to be
present on your machine.

I'll have to remember to keep an eye out for this one-
-
it will likely come
to be posted again at some point.

--

"Bill Sanderson" <[email protected]>
wrote
in message
so
f
t.
com...
Is this detection still present with 5747
definitions?
Thanks for
sticking with this issue and reminding us.

--

"JRosenfeld" <[email protected]>
wrote in message
Just to add one more reference to autoclk.exe not
being a
trojan by itself:

http://www.2-spyware.com/file-autoclk-exe.html

-----Original Message-----
I had autoclk.exe in c:\Windows. The file
properties
do
not identify the company or the software that it
might
be
associated with, just autoclk MFC Application.

MSAS started flagging it with 5743 or 5745 (forget
which)
as trojan.killreg and indeed there are lots of
reports
from other sources connecting this file with that
Trojan
(and its other name equivalents). However, I
certainly
have none of the symptoms that are said to be
associated
with it. NAV did not flag it.

Other posts indicate that it, by itself, is a
(harmless
if
useless) Windows utility

http://startup.iamnotageek.com/srch- autoclk.exe.html

I have never had it in the startups, however.

and one German site connects it with adsl modem
software

http://www.wintotal.de/Spyware/index.php?Filter=A

although also stating that it is flagged as spyware
by
many apps, but adds falsepositive? at the end of its
comment.

I do have an ADSL modem, but of different
manufacture
from
the one cited there.

I moved it out of C:\windows folder for a week or
so,
and
did not find anything asking for it, using the PC
normally. So now I've let MSAS delete it.

But I am wondering if it should be classed as a
false
positive if just the file is present?

Comments appreciated.




.





.



.

.
Click to expand...


.
Click to expand...
Click to expand...
 
Back
Top