CoolWWWSearch or not?

[md usa spybot fan]

m3a7t9:

I am using Internet Explorer 7 and my current setting for "PrivDiscUiShown" is:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"PrivDiscUiShown"=dword:00000001

The detection that you posted indicated "!=W-0" which means "not equal to dword zero". My registry entry is "not equal to dword zero" and I did not get a detection using Spybot 1.5.2.20. I changed the registry entry to dword:00000000 and still no detection.

It seems as of the old software reacts diferently than the current version using the same rule set.

I would just leave the registry entry as is.

[m3a7t9]

md, many thanks for your reply, I will do as you recommend. If you think it is now ok for me to do a disk image I will be very relieved, it's overdue.

[md usa spybot fan]

m3a7t9:

If your system is clean, by all means back it up. Even if the system was not 100% clean, having a dirty backup is better than not having one at all.

[m3a7t9]

many thanks for all help on this issue. Have a good week.

[caterwaul]

m3a7t9:

Spybot is detecting that you (or something) set "Do Not Show This Message Again" on the "Privacy" Dialog Box in Interner Explorer. See:

• The "Privacy" Dialog Box Is Not Displayed After You Select the "Do Not Show This Message Again" Option
  http://support.microsoft.com/kb/298599

That is interesting since I do use IE6 and I am using SB1.3 and am getting a CoolWWWSearch.hjg Spyware found at that exact location in my registry, in fact 3 different locations actually (one of which is this specific setting you mentioned here). Each time SB1.3 tells me it is "fixed" but each time the next scan tells me that the problem remains for all 3 registry settings.

HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet\ Settings\PrivDiscUiShown!=W=0

HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\
Advanced\HideFleExt!=W-1

HKEY_USERS\.DEFAULT\Software\Policies\Microsoft\InternetExplorer\
Control Panel\Homepage!=W=0

There is speculation on this board as to what Spybot does to fix these registry settings.

What Spybot does is change each setting to "" after the first "=" sign in the registry for all three.

What is also interesting in regards to the registry setting related to the "do not show" I have been using IE6 for many years and long ago set that setting to "do not show" but I have been getting that message box again now asking me this same question again. I am sure this is because SB1.3 is setting the values to "" and because the registry is not set to the "W=0" any longer I then get the message again.

Scans take so long for me (over 2 hours) so I have always done subsequent scans after a boot and assumed that the boot was responsible for re-inserting the Spyware.

I am now running another scan to see what the settings are for each registry setting directly following the last scan (still another 1½ hours to go).

There has been suggestions that users like myself should upgrade to minimally 1.5.2.

I cannot successfully do this on my WIN98SE since no matter what I do the teatimer will not successfully close (exit) when I shut down thus my OS crashes with a blue screen error because teatimer has this problem that is somehow related to my system (link below). I have no problem closing (exiting) teatimer manually but for some reason teatimer cannot close (exit) when the OP system tries to close (exit) teatimer through my 98SE (see link below for details). It is possible this is a combination and/or regarding my 98SE or my limited (96 RAM) resources.

http://forums.spybot.info/showthread.php?t=29644

Thus since I have to stay with SB1.3 I have a question: Will this problem remain with SB1.3? or will newer updates on the database fix this?

[wyrmrider]

you do know not to FIX and REMOVE anything with 1.3
RIGHT
someone else will come along about the removal of 1.3

should this be a new thread???
and not in THIS forum
you may get more response
perhaps continue your other thread although I do not remember that the T-timer issue was addressed
did you try turning off t-timer in Mode>advanced?

[caterwaul]

EConsidering that older versions are now not supported I think the answer to my question (see prior post) is "this will not be fixed" (for older versions). (I take it this is the forum w/ the 15 min limit for editing).

To address the "false positive" CoolWWWSearch:

If the user doesn't "repair" using SB1.3 (in my case I "fixed" so many times I can't tell which one has the original setting since each subsequent time I "fixed" the settings just remained "") each of those settings will still be set back to the correct setting when the user "resets" the values using the specific application relative to the registry setting:

HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet\ Settings\PrivDiscUiShown!=W=0

Will be set back from the "" setting that SB1.3 set it at for "fix" to whatever whatever setting the user chooses after launching IE6 - either "W=0" if the user clicks on "do not show" or "W=1" if the user doesn't.

HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\
Advanced\HideFleExt!=W-1

Will be set after the user "resets" the "hidden files" setting in Windows Explorer. The setting will show whatever it was last to get the registry setting correct the user can set the "radio button" to the another setting and then back to what they had originally (which will then have the correct registry setting that matches the "View>Folder Options>View tab setting" for Windows Explorer.

HKEY_USERS\.DEFAULT\Software\Policies\Microsoft\InternetExplorer\
Control Panel\Homepage!=W=0

Same principle as above.

There are MANY other "false positives" in SB1.3 (I will post a separate entry on this in the "False Positives" forum).

[caterwaul]

you do know not to FIX and REMOVE anything with 1.3
RIGHT
someone else will come along about the removal of 1.3

should this be a new thread???
and not in THIS forum
you may get more response
perhaps continue your other thread although I do not remember that the T-timer issue was addressed
did you try turning off t-timer in Mode>advanced?

Thanks for asking. Yes all of this was covered (if you notice I had a link to the (old) topic thread that was in the correct forum in my post above). I removed everything possible in multiple ways. Yes as I posted (above and in the original thread) I can "turn off" t-timer with no problem it is when I "shutdown" that the 98SE OS has a problem "shutting down" teatimer) which causes the crash (every time). I could always have to "remember" to "turn off" teatimer when ever I did a reboot or shutdown to avoid the problem but that is a real nuisance and clearly should not be necessary anyway.

[md usa spybot fan]

caterwaul:

re: false positives in Spybot 1.3.

I trust that you are aware that false positives in Spybot 1.3 cause by resent detection rules designed for later releases, cause major problems for users running Spybot 1.3 under Windows XP. Fixing those false positives cause the users to no longer be able to log onto their systems.

I suggest that you attempt to update to Spybot 1.6 (or at lease Spybot 1.5.2) and if that does not work for you that you, I strongly recommend you consider just abandoning using Spybot on your Windows 98SE system.

Using Spybot 1.3 with resent detection rule update presents a risk that I believe that you should not subject yourself to.

[Zenobia]

Perhaps I missed something,but I wonder if,since your problems seem related to teatimer,if you could just update to Spybot 1.6 (or at least Spybot 1.5.2) and then just run Spybot as a scanner only,and not use teatimer at all?Not the best solution,I know,but better than nothing.