Hey all. New day, new problem!
I recently posted on here saying I was worried my bullguard antivirus was picking up suspected spyware/malware whenever I run LW and I was told it may be a "false positive" (not sure what exactly this means). I get it everytime I do a scan and it seems to be coming from LW. Anyways I will show you a log of what bullguard is saying:


Infected Files
__________________________________________________ _________

----[ Infected Registry Entries ]------------

Malware: magne2t
<System>=>HKEY_CLASSES_ROOT\MAGNET
<System>=>HKEY_CLASSES_ROOT\MAGNET\DEFAULTICON
<System>=>HKEY_CLASSES_ROOT\MAGNET\SHELL
<System>=>HKEY_CLASSES_ROOT\MAGNET\SHELL\OPEN
<System>=>HKEY_CLASSES_ROOT\MAGNET\SHELL\OPEN\COMM AND

Malware: magne3t
<System>=>HKEY_LOCAL_MACHINE\SOFTWARE\MAGNET
<System>=>HKEY_LOCAL_MACHINE\SOFTWARE\MAGNET\HANDL ERS
<System>=>HKEY_LOCAL_MACHINE\SOFTWARE\MAGNET\HANDL ERS\LIMEWIRE
<System>=>HKEY_LOCAL_MACHINE\SOFTWARE\MAGNET\HANDL ERS\LIMEWIRE\TYPE

__________________________________________________ _________

Results after ROUND 0
__________________________________________________ _________

Scan started: Sunday, March 11, 2007 13:03:35
Scan duration: 0 days, 00 hours, 43 minutes, 21 seconds
Infections solved: 0
Infections left: 9
Viruses left: 2

----[ Registry Entries Still Infected ]------------

Malware: magne2t
<System>=>HKEY_CLASSES_ROOT\MAGNET
<System>=>HKEY_CLASSES_ROOT\MAGNET\DEFAULTICON
<System>=>HKEY_CLASSES_ROOT\MAGNET\SHELL
<System>=>HKEY_CLASSES_ROOT\MAGNET\SHELL\OPEN
<System>=>HKEY_CLASSES_ROOT\MAGNET\SHELL\OPEN\COMM AND

Malware: magne3t
<System>=>HKEY_LOCAL_MACHINE\SOFTWARE\MAGNET
<System>=>HKEY_LOCAL_MACHINE\SOFTWARE\MAGNET\HANDL ERS
<System>=>HKEY_LOCAL_MACHINE\SOFTWARE\MAGNET\HANDL ERS\LIMEWIRE
<System>=>HKEY_LOCAL_MACHINE\SOFTWARE\MAGNET\HANDL ERS\LIMEWIRE\TYPE

__________________________________________________ _________

Results after ROUND 1
__________________________________________________ _________

Scan started: Sunday, March 11, 2007 14:03:56
Scan duration: 0 days, 00 hours, 00 minutes, 06 seconds
Infections solved: 0
Infections left: 9
Viruses left: 2

----[ Registry Entries Still Infected ]------------

Malware: magne2t
<System>=>HKEY_CLASSES_ROOT\MAGNET
<System>=>HKEY_CLASSES_ROOT\MAGNET\DEFAULTICON
<System>=>HKEY_CLASSES_ROOT\MAGNET\SHELL
<System>=>HKEY_CLASSES_ROOT\MAGNET\SHELL\OPEN
<System>=>HKEY_CLASSES_ROOT\MAGNET\SHELL\OPEN\COMM AND

Malware: magne3t
<System>=>HKEY_LOCAL_MACHINE\SOFTWARE\MAGNET
<System>=>HKEY_LOCAL_MACHINE\SOFTWARE\MAGNET\HANDL ERS
<System>=>HKEY_LOCAL_MACHINE\SOFTWARE\MAGNET\HANDL ERS\LIMEWIRE
<System>=>HKEY_LOCAL_MACHINE\SOFTWARE\MAGNET\HANDL ERS\LIMEWIRE\TYPE


Does this mean anything to anyone? Bullguard support told me this was being generated by limewire itself and I can adjust settings so it isn't no longer detected. Can anyone help. Thanks

It is not spyware or a Virus. Magnetic links are a search criteria

__________________










A little common sense goes a long way

Later Grandpa

ok. That may be the case then, however, why is it then Bullguard displays the message "spyware found!" after a system scan. If this magnet link/file is part of LW then why doesn't my antivirus simply ignore it if its safe? can I not change a setting in LW itself so that bullguard ignores them altogether?

It's possible that it could be a false positive. Some programs produce them now & again. See here :

http://www.viruslist.com/en/glossary?glossid=153654932


It seems at one time I used Trend-Micro's antispyware & it would say that Limewire was spyware, somewhat similar to what Bullguard is doing for you. I'm not farmiliar with Bullguard (got these instructions from their forums) but try this: look under Antivirus > Protection, put a checkmark under Exclude Specific Files then click on Add Path. If you get the option to Browse then go down the list until you see Limewire , or you may have to copy/paste the actual target which would be this:

C:\Program Files\LimeWire\LimeWire.exe

Sparky_05084

First of all, Tomvee has given you a good explanation of false positives, namely that some programs will wrongly identify certain parts of your P2P program as spyware.

Now I believe Anti-Virus and Anti-spyware apps give false positives because back in the dim and distant past P2P apps did contain spyware and adware as a means of generating funds (or advertising revenue) for their companies. Also there are some spyware out there that use some P2P coding as part of their make up.

The way to make sure that your Bullguard AV does not disable your LW is to read your AV log, as you have done, and identify the application (or parts of the application) that is being identified as spyware and get Bullguard to disregard those items in future scans.

I had a similar problem with Spybot identifying parts of my Windows XP SP2 update as spyware, until I got Spybot to exclude those SP2 bits from its scan.



UK Bob

Ok. Thanks you guys. I will probably not risk excluding LW from a scan ( i know how to do it) as it would mean that maybe Bullguard would ignore it completely, which of course is major risky. I want it to monitor Lw all the time, even if it means that pesky file keeps popping up now and then. Yes, you are probably right, it seems by asking Bullguard support, it is a false positive generated by a legitimate part of limewire i.e the magnet file. Im not worried about this but I wanted to be sure. I will keep you posted if I do get any more problems. Thanks again for your advices.