a-squared finding Summit Software BasicScript files as spyware

I have been recieving the following results from a scan with a-squared anti-malware 2.0

C:\WINNT\system32\clsncx22.dll detected: Trace.File.Morpheus
C:\WINNT\system32\clsnol22.dll detected: Trace.File.Morpheus

I have been advised by a-squared support that these files are used by Morpheus P2P application and they should be removed. I have never installed Morpheus however, and told them so.

I would appreciate if you could give me some assurance that these files are not malicious. Thanks. 

These appear to be library files for BasicScript for Windows. BasicScript is a scripting language that is integrated into packaged applications by our customers, who develop the software that includes the BasicScript DLLs as part of their own product.

The first three letters -- 'cls' -- are used to identify which of our customers has a license to redistribute the BasicScript libaries. We'll do some research tomorrow when our office is open again (we are on Eastern time) and make an additional post to this forum.

If you could send your contact information to me privately via email (my address is billf@summsoft.com), that would enable us to contact you directly. This may prove useful if we require additional information from you about the DLLs you mention above.

 Best regards,

Bill Fisher

President, Summit Software Company

 

The filenames on those DLLs tell us that these dynamic link libraries were licensed for redistribution by a company known as Clearsand Corporation. I believe the company was originally known as Strata Inc. If I recall correctly, they developed some sort of multimedia authoring product. My guess is that you have their software installed on your system and that they installed our DLLs onto your system.

 To be sure, we'd have to examine the DLLs themselves. If you'd like to send them to us, feel free to do so. We'll verify that these are our DLLs after receiving them.

 Best regards,

Bill

Thanks for the advice Bill. I sent you a mail with both dll's attached for verification.

I googled Clearsand Corporation and discovered they make mediaforge authoring. As it happens I have a program called Cinemaforge 2.0 installed

Publisher's website:

http://www.mediaforge.com

CinemaForge is a video- and audio-conversion and hosting utility. The application supports Flash (SWF), Flash (FLV), Motion Pictures Group (MPEG), Audio Video Interleaved (AVI), Window Media Video (WMV), Real Video (RM), QuickTime (MOV), Advanced Streaming Format (ASF), and JPEG (thumbnails). You quickly can save and load presets. It has a nice ffmpeg GUI written in MediaForge. The application has support for deinterlace, duration, cropping, automatic thumbnails, and MediaForge Plaza publishing. You can build movies from still images, and it includes advanced alpha-channel transitions between slides.

Although I previously had error msgs when trying to launch this program and I cannot uninstall it, it doesn't seem to be malicious in any other way. If you can give an OK on the authenticity of the dll files I sent, then perhaps you could persuade a-squared support to remove this false positive since I don't have the technical know-how to convince them over on their forums.