False positive: MS Application Compatibility Toolkit

  • Thread starter Thread starter Robin Walker
  • Start date Start date
R

Robin Walker

MSAS detects the following Registry entries as being the "TIB Porn Dialer":

HKEY_CLASSES_ROOT\AtlBrCon.AtlBrCon.1
HKEY_CLASSES_ROOT\AtlBrCon.AtlBrCon.1\CLSID
{0818D430-6247-11D1-ABEE-00D049C10000}
HKEY_CLASSES_ROOT\AtlBrCon.AtlBrCon.1 AtlBrCon Class
HKEY_CURRENT_USER\SOFTWARE\Classes\AtlBrCon.AtlBrCon.1
HKEY_CURRENT_USER\SOFTWARE\Classes\AtlBrCon.AtlBrCon.1\CLSID
{0818D430-6247-11D1-ABEE-00D049C10000}
HKEY_CURRENT_USER\SOFTWARE\Classes\AtlBrCon.AtlBrCon.1 AtlBrCon Class
HKEY_CURRENT_USER\SOFTWARE\Classes\AtlBrCon.AtlBrCon
HKEY_CURRENT_USER\SOFTWARE\Classes\AtlBrCon.AtlBrCon\CurVer
AtlBrCon.AtlBrCon.1
HKEY_CURRENT_USER\SOFTWARE\Classes\AtlBrCon.AtlBrCon AtlBrCon Class

In fact, these keys appear to have been created by the
Microsoft Windows Application Compatibility Toolkit v3.
 
Back
Top