CWS Shredder won't remove a found item.HELP.

[lodx]

Hi All,
I have cws shredder and on running it picks up Variant 21: CWS.Qttasks
It lists it as removed when I run FIX but when I run a scan again it picks it up as found again??
I then run fix and it lists as removed again so on and so on ad infinitum.
Is there a fault with program or is there a possiblility the variant is re-installing or there is more than one.
Any help appreciated to ease my aching brain.

[Budfred]

CWShredder is having a tougher time fixing a number of CWS variants these days... They are more complex and I think it is a lower priority for the company that owns it now...

It would be a good idea to run some other scans and post a HJT log... If you don't know which scans to run, I can give you some ideas... Be sure to detail what you have actually done to get more assistance...

[lodx]

Hi Bud,
I have read on another site that CWS Shredder may be throwing out a false positive here.
Below is relevant post:

October 27th, 2005, 12:16 PM
Peeved McAfee User (http://www.wilderssecurity.com/member.php?u=17770) http://www.wilderssecurity.com/images/statusicon/user_offline.gif vbmenu_register("postmenu_592963", true);
Infrequent Poster
Join Date: Jun 2004
Posts: 13


http://www.wilderssecurity.com/images/icons/icon1.gif Re: CWShredder FP's
CWShredder 2.18.0.1006 is identifying the following registry as CWS.Qttasks:

Code:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"

The executable qttask.exe is the Apple’s QuickTime tray icon and is not connected with CWS.Qttasks.

Certainly looks like a false positive to me!!!

[lodx]

Please see http://www.wilderssecurity.com/showthread.php?p=593098
for thread concerning this issue.

Hopefully that will be that.
I should have realised that the previous version did not pick it up.
Hope this will help any others getting same result with new version.

[Budfred]

Io,

That may be true and you can certainly proceed on that assumption... I would want to make sure with some other scans myself...