Strange Spyware Detection on .ico file (Watchful Eye Key Logger)

[Guest]

Hi,

I have a strange problem here,
I have a .NET Application developed with Visual Studio 2003 and distributed
by Visual Studio .NET Setup package that has an icon (app.ico) in the project
used for add/remove programs icon (AddRemoveProgramsIcon property in the
project properties).
The app.ico file is extracted from the windows system -> you can view it
from here : http://ogamer.ogameciyiz.biz/app.ico
When i create the setup (contains only app.ico, set for
AddRemoveProgramsIcon) and install it Windows installer setup, installer
creates a folder here C:\Documents and Settings\(Your Username)\Application
Data\Microsoft\Installer, an executable file with the app.ico icon in it.
When you scan that folder or try to execute that file on a computer that
Microsoft AntiSpyWare is installed it warns you with this message : "Warning,
Watchful Eye Key Logger is trying to Install!"

Screenshots are available at http://ogamer.ogameciyiz.biz/antispyware1.jpg
and http://ogamer.ogameciyiz.biz/antispyware2.jpg

You can simply test it by downloading the setup project and its release
build from http://ogamer.ogameciyiz.biz/Setup1.rar

Moreover, if you just download http://ogamer.ogameciyiz.biz/app.ico ,save as
on desktop and rename app.ico to app.exe and scan the file with antispyware
it warns you with watchful eye etc..
app.ico is just a simple icon file

Now i have changed the icon file and my package works well with Microsoft
AntiSpyware Beta 1, but my users may distrust to the program, please give
some feedback.

Thanks

~
A Software Developer from Turkey
MCAD.NET

 

[Bill Sanderson]

http://www.microsoft.com/athome/security/spyware/software/isv/forms.mspx

Use the False Positive form at the above link.

Thanks for reporting this--to the above link. Such false positives are a
problem for all antispyware vendors. I will say that Microsoft seems to do
a pretty good job of fixing these when they are clearly brought to their
attention.

 

[Guest]

I have sent the form now,
Thank you

http://www.microsoft.com/athome/security/spyware/software/isv/forms.mspx

Use the False Positive form at the above link.

Thanks for reporting this--to the above link. Such false positives are a
problem for all antispyware vendors. I will say that Microsoft seems to do
a pretty good job of fixing these when they are clearly brought to their
attention.

 

[Bill Sanderson]

You might let us know how this gets resolved--it's good to know what happens
in these cases--it encourages others in the same situation--thanks!

--

 

[Guest]

Problem is solved with definitions file version 5801.
Thanks again.

 

[Bill Sanderson]

Terrific--thanks for maintaining the feedback loop--this exchange will get
read and save a number of similar postings.