It says that I have 1.6.2.46Originally Posted by Zenobia
Which version of Spybot do you have,would it be Spybot 2 or 2.1?
It says that I have 1.6.2.46Which version of Spybot do you have,would it be Spybot 2 or 2.1?
Alright,the reason I asked is because I saw this about sdcleaner in the forum a little while back.
http://forums.spybot.info/showthread...-Delta-Toolbar
But,since I don't see sdcleaner listed in salenai's logfile or anything I know to be the equivalent,I'd assume that doesn't apply to you or him,since you both have Spybot 1.6.2.
(unless there was something like sdcleaner.exe in Spybot 1.6.2 and it was called something else that I cannot remember.I'm not sure,so I'll just squint suspiciously at sdmain.exe since I can't quite remember what it was,and move on.No need to concern yourself with this,btw,I'm just rambling out loud a little.)
Anchor.hss is in the pups category,so I'll show you this page explaining those:
http://www.safer-networking.org/faq/pups/
If you've decided after reading the above that you would like to no longer have hotspot shield,then you might like to consider removing it from add/remove programs.
If the two entries are still found after that when you scan with Spybot,then you could ask for help in malware removal:
This is the before you post sticky topic:
http://forums.spybot.info/showthread...ng-Assistance)
And this is malware removal:
http://forums.spybot.info/forumdispl...alware-Removal
Thanks. I'll check it out.
Just to say, here are my findings today...
This Anchor.hss result also just appeared in my latest Spybot scan this morniing.
But are we sure it's not just a false positive? I ran a scan only a few days ago which was clear of it, and don't think I have downloaded anything except some Adobe updates since then. Also see below for new results that DON'T show it.
My Spybot version was only v1.3.6.50 but the updater only seems to look for new virus definitions, I had to go to the safer networking website to discover there was a v2 available.
Downloaded and installed v2.1.20-SR1
I just did a new scan with that, and it found LOTS of tracking cookies that v1.36.50 had missed, but "Anchor.hss" is no longer showing up in the results.
I then allowed Spybot to fix all the tracking cookies and after that I ran ANOTHER scan.
That one came up with ONE result, but when I click on "show results" the list is completely empty, so what is this single result that I can't see?
No,I don't believe the first two people before you is a case of a false positive.In salenai's case,though it is called Anchor.hss,the registry key indicated in his logfile is:
HKEY_USERS\S-1-5-21-3878205609-505246965-1532686573-1001\Software\Conduit
and while it is in a different location,there is a conduit registry key listed in the malware removal guide here:
http://forums.spybot.info/showthread...for-Anchor-Hss
So,it would most likely be as intended,unless a false positive crept into the malware removal guide.(I'm unsure why the anchor.hss pups detection shows up in older versions of Spybot,and not the new one,though.)
hookup indicated that they have hotspot shield installed,so it should be safe to assume their detection is not a false positive,either.
The detection on yours might be something else entirely,though.Your logfile would have to be looked at to tell.
Even though you uninstalled Spybot 1.3,I think your older logfiles should still be available unless you removed them yourself.
They would be at:
Windows 95 or 98: C:\Windows\Aplication Data\Spybot – Search & Destroy\
Windows ME: C:\Windows\All Users\Application Data\Spybot – Search & Destroy\
Windows NT, 2000 or XP: C:\Documents and Settings\All Users\Application Data\Spybot – Search & Destroy\
Windows Vista,7 or 8:Windows Vista: C:\ProgramData\Spybot – Search & Destroy\
If Application Data or Program Files(whichever applies to you) isn't visible,then please see here:
http://www.bleepingcomputer.com/tuto...es-in-windows/
They'd be available with the date of the time you did your scan in the name.For an example,it would look somewhat similar to this:
Checks.130626-0339.txt
If you think the Anchor.hss detection in your logfile may be a false positive,you follow this post:
http://forums.spybot.info/showthread...alse-Positives
Then you can ask about it in here:
http://forums.spybot.info/forumdispl...alse-Positives
As for the single result you could not see in the newer Spybot,it might be available in a checks logfile also.Since the name of the folder in application data/program data is Spybot - Search & Destroy,and not Spybot - Search & Destroy 2,I assume when an older version is uninstalled,logfiles from older versions stay in that folder.So while you are in that area looking for your logfile from Spybot 1.3,you can also look for the checks logfile from the date you did that scan and open it as well,and see if it shows you what was found.
Hi guys, I am back, the problem kept coming back, so I reinstalled windows.No,I don't believe the first two people before you is a case of a false positive.In salenai's case,though it is called Anchor.hss,the registry key indicated in his logfile is:
HKEY_USERS\S-1-5-21-3878205609-505246965-1532686573-1001\Software\Conduit
and while it is in a different location,there is a conduit registry key listed in the malware removal guide here:
http://forums.spybot.info/showthread...for-Anchor-Hss
So,it would most likely be as intended,unless a false positive crept into the malware removal guide.(I'm unsure why the anchor.hss pups detection shows up in older versions of Spybot,and not the new one,though.)
hookup indicated that they have hotspot shield installed,so it should be safe to assume their detection is not a false positive,either.
The detection on yours might be something else entirely,though.Your logfile would have to be looked at to tell.
Even though you uninstalled Spybot 1.3,I think your older logfiles should still be available unless you removed them yourself.
They would be at:
Windows 95 or 98: C:\Windows\Aplication Data\Spybot – Search & Destroy\
Windows ME: C:\Windows\All Users\Application Data\Spybot – Search & Destroy\
Windows NT, 2000 or XP: C:\Documents and Settings\All Users\Application Data\Spybot – Search & Destroy\
Windows Vista,7 or 8:Windows Vista: C:\ProgramData\Spybot – Search & Destroy\
If Application Data or Program Files(whichever applies to you) isn't visible,then please see here:
http://www.bleepingcomputer.com/tuto...es-in-windows/
They'd be available with the date of the time you did your scan in the name.For an example,it would look somewhat similar to this:
Checks.130626-0339.txt
If you think the Anchor.hss detection in your logfile may be a false positive,you follow this post:
http://forums.spybot.info/showthread...alse-Positives
Then you can ask about it in here:
http://forums.spybot.info/forumdispl...alse-Positives
As for the single result you could not see in the newer Spybot,it might be available in a checks logfile also.Since the name of the folder in application data/program data is Spybot - Search & Destroy,and not Spybot - Search & Destroy 2,I assume when an older version is uninstalled,logfiles from older versions stay in that folder.So while you are in that area looking for your logfile from Spybot 1.3,you can also look for the checks logfile from the date you did that scan and open it as well,and see if it shows you what was found.
I let it update and download all the service packs, I downloaded all the previously mentioned antivirus/antispyware/antimalware software, scanned my computer with everything, everything was clear. Then day or so later I found 2! anchor.hss entries! I deleted both through spybot, and I also managed to delete the register folders anchor.hss appeared in.
There was nothing to be found for a day or so. Then next day, I found another location, and at different place again, Hkeyusers, etc., not sure where exactly. But it was a different location than the previous ones.
ALSO I think I know what anchor.hss does. Before reinstallation, my system restored itself to previous point, like, it deleted my keyboard language change option, wallpaper, removed icons from my task bar and set them to default, also I had mozilla firefox set as default browsret, it removed that option, removed my set screen resolution.
This is why I decided to reinstall windows. It formatted C. Now, after reinstallation, and these found entries (that I mentioned in the first section of this post), it AGAIN restored system to previous state. Also, when it restored back to previous state this time, I received a message saying that vprotect application has stopped working.
Do you Zenobia or anyone else know how to deal with this problem?:/ I am getting really desperate now.
Thanks!
Last edited by salenai; 2013-07-03 at 01:31.
Welcome back.Sorry to hear of all your troubles,but that detection should not cause problems as serious as all that.Hotspot Shield is VPN software that is adware supported when it's the free version.
There is a wikipedia page about it here:
http://en.wikipedia.org/wiki/AnchorFree
vProtect should be related to AVG:
http://forums.avg.com/ww-en/avg-foru...show&id=185252
As you are getting the Anchor.HSS detection,and do not have hotspot shield installed,I think it would be best if you go to the false positives forums and see if they can find out what's up.
There is a sticky topic here to show what you need to give for info:
http://forums.spybot.info/showthread...alse-Positives
False positives:
http://forums.spybot.info/forumdispl...alse-Positives
Hello,
It seems like you are running an old version of Spybot - Search & Destroy.
This means it won't provide the protection that is actually available.
You will have to switch to Spybot - Search & Destroy 2 to get our full offer.
Please uninstall the older version of Spybot - Search & Destroy before installing the new version.
In order to uninstall Spybot-S&D, please consider the following link.
Then download the new version of Spybot - Search & Destroy.
You will find links to several download locations on our website.
Best regards
Sandra
Team Spybot
Alright,the reason I asked is because I saw this about sdcleaner in the forum a little while back.
http://forums.spybot.info/showthread...-Delta-Toolbar
But,since I don't see sdcleaner listed in salenai's logfile or anything I know to be the equivalent,I'd assume that doesn't apply to you or him,since you both have Spybot 1.6.2.
(unless there was something like sdcleaner.exe in Spybot 1.6.2 and it was called something else that I cannot remember.I'm not sure,so I'll just squint suspiciously at sdmain.exe since I can't quite remember what it was,and move on.No need to concern yourself with this,btw,I'm just rambling out loud a little.)
Anchor.hss is in the pups category,so I'll show you this page explaining those:
http://www.safer-networking.org/faq/pups/
If you've decided after reading the above that you would like to no longer have hotspot shield,then you might like to consider removing it from add/remove programs.
If the two entries are still found after that when you scan with Spybot,then you could ask for help in malware removal:
This is the before you post sticky topic:
http://forums.spybot.info/showthread...ng-Assistance)
And this is malware removal:
http://forums.spybot.info/forumdispl...alware-Removal
Today I went to Control Panel to uninstall Hotspot Shield. I had noticed that the icon for it on my desktop looked different for some reason. I clicked uninstall in CP and a window popped up saying that I had already uninstalled HSS, even though I had not done so previously. I deleted the icon in CP and ran another Spybot scan. This time the hss pup did not show up in the scan. Kind of strange considering that I did not knowingly uninstall Hotspot Shield. I guess I am cured or am I ?
Hello,
Seems like the problem is solved.
We also have issued more improved detection rules for Anchor.HSS with one of our latest updates.
Best regards
Sandra
Team Spybot
Posting Permissions
Reply With Quote