Thanks for confirming that the files are the same. It looks like this is a
false positive, and, presumably, one fixed in later definitions, because I
haven't seen it.
What definition version was in place at the time of the detection, if you
remember?
I think the comparison is enough to prove your file safe (unless mine is
infected too--and I've had no alarms.) It is slightly puzzling that you get
an alarm for a file identical to mine--unless there is some other invisible
co-determinant in the detection. I hope that is the definition version
involved--i.e. this is a false positive now fixed.
--
FAQ for Microsoft Antispyware:
http://www.geocities.com/marfer_mvp/FAQ_MSantispy.htm
Hi, Bill, thanks for taking an interest. I am running XP
Pro Version 2002 with SP2.
I am an experienced computer user but new to SpyWare
progs. I am very careful which web sites I visit and
never download freeware. But I trust Microsoft and
downloaded and installed "Microsoft Anti SpyWare Beta 1" a
few days ago. A full scan found nothing and I was pleased
about that but not surprised. However running a scan a
couple of days later it came up with one item:- Detected
SpyWare on your System: "Specrem (RAT)". I did not remove
it but went to look at all detected locations, and right
enough SCRRUN.DLL is part of Windows XP OS in
Windows/System32/. It's on the XP install CD in a CAB
file. I guess it is a legitimate file; my question is why
does MS SpyWare Prog identify it as a "Severe threat"?
Looking at the file in tools, advanced tools, advanced
file analyser it appears to be the same as yours.
OK thanks for your time.
All The Best. Dave.
Detailed File Analysis
Display name: Microsoft (r) Script Runtime
Name: scrrun.dll
Description: Microsoft (r) Script Runtime
Publisher: Microsoft Corporation
Path: G:\WINDOWS\system32\scrrun.dll
Version: 5.6.0.8820
Size: 151552 bytes
Copyright: Copyright © Microsoft Corp. 2002
Create date: Thursday August 23, 2001
Access date: Thursday February 10, 2005
Modified date: Tuesday August 3, 2004
MD5: 214577b79cf59e2fc9addd9598c0aeb8
This file is a registered COM object
CLSID: {0CF774D0-F077-11D1-B1BC-00C04F86C324}
CLSID name: Microsoft (r) Script Runtime
CLSID ProgID: HTML.HostEncode
CLSID: {0CF774D1-F077-11D1-B1BC-00C04F86C324}
CLSID name: Microsoft (r) Script Runtime
CLSID ProgID: ASP.HostEncode
CLSID: {32DA2B15-CFED-11D1-B747-00C04FC2B085}
CLSID name: Microsoft (r) Script Runtime
CLSID ProgID: Scripting.Encoder
CLSID: {85131630-480C-11D2-B1F9-00C04F86C324}
CLSID name: Microsoft (r) Script Runtime
CLSID ProgID: JSFile.HostEncode
CLSID: {85131631-480C-11D2-B1F9-00C04F86C324}
CLSID name: Microsoft (r) Script Runtime
CLSID ProgID: VBSFile.HostEncode
CLSID: {EE09B103-97E0-11CF-978F-00A02463E06F}
CLSID name: Microsoft (r) Script Runtime
CLSID ProgID: Scripting.Dictionary
