tjvitale
2007-09-13, 20:20
I started using S-S&D yesterday and ran the standard routines, in advanced mode, following the tutorial.
Cleaned about 44 RED tracking cookies. As of yesterday IE History no longer has any information on where I have been. I use this valuable tool all the time (save 180 days) to return to sites I've already visited. The coincidence suggests that one of the deleted tracking cookies was being used by IE History. I tried a Restore but this had no effect. I have restarted several times, looking for changes. The older history information remains.
md usa spybot fan
2007-09-13, 22:55
Tjvitale:
I am not in a position to verify your observation that deleting "tracking cookies" also deleted Internet Explorer's (IE's) History of websites you have visited, This is because I have not received any detections of "tracking cookies" in years (let alone "44 RED tracking cookies" in one scan).
The reason that I do not receive detections of "tracking cookies" is because I do not allow the storing of third party cookies (tracking cookies), both through Spybot's BHO but also with settings within Internet Explorer (see Note #1 below).
_______________________
Please post the Fixes.yymmdd-hhmm log from the running of Spybot when you encountered the problem, so we can take a look at it ( note: by default here are two Checks.yymmdd-hhmm logs produced during a scan, the second Checks.yymmdd-hhmm has the details of what the scan found and a Fixes.yymmdd-hhmm log is produced if you fix or attempt to fix something).
There are two methods to copy and post that information from the Fixes.yymmdd-hhmm log:
Method 1:
Go into Spybot > Mode > Advanced mode > Tools > View Reports > View Previous reports. Look for the Fixes.yymmdd-hhmm.log file that was produced when you found and fixed the detection you are questioning. Open it. To copy it to the Clipboard, right click on the listing and select Select All > Right click again and select Copy. Paste (Ctrl+V) the contents of the Clipboard into a new post in this thread.
Method 2
The Fixes.yymmdd-hhmm.log files are stored in the following folders:
Windows 95 or 98:
C:\Windows\Application Data\Spybot - Search & Destroy\Logs
Windows ME:
C:\Windows\All Users\Application Data\Spybot - Search & Destroy\Logs
Windows NT, 2000 or XP:
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Logs
Using Windows Explorer, navigate to the correct Fixes.yymmdd-hhmm.log. Double click on it and it should open with Notepad. To copy it to the Clipboard, right click on the listing and select Select All > Right click again and select Copy. Paste (Ctrl+V) the contents of the Clipboard into a new post in this thread.
_______________________
Note #1:
In Internet Explorer you can block the same Tracking Cookies that Spybot detects by enabling Spybot's Browser Helper Object (BHO). To do this:
Go into Spybot > Mode > Advanced Mode > Tools > Resident
Check (if checked) the following:
Resident "SDHelper" (Internet Explorer bad download blocker) Active.
Exit Spybot.
There is another way to prevent the storing of Tracking Cookies in Internet Explorer (even those not blocked by Spybot's resident BHO) as well as the storing of Tracking Cookies in other WEB browsers. See:
Why do other anti-spyware applications detect so many more tracking cookies?
http://www.safer-networking.org/index.php?page=faq&detail=37
tjvitale
2007-09-13, 23:47
Many thanks for your reply.
Since first posting, I have used WinXP's System Restore function to go back to the day before I started using S-S&D. The lack of "new" IE History (logging of new entries in History) has not changed. I've also noticed that the "within website" memory (tracking) is not functional.
After the System Restore, it seems as though the deleted "tracking cookies" are permanently gone and can't be recovered. I could have done the WinXP restore wrong but I did it twice and allowed the Registry change.
Thanks Again.
-- Report generated: 2007-09-12 11:58 ---
Microsoft.Windows.Security.InternetExplorer: [SBI $A3433CBF] Settings (Registry change, fixed)
HKEY_USERS\S-1-5-21-2235205628-51897293-3146467998-1007\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\iexplore.exe
CasaleMedia: [SBI $4CDCC3D5] Tracking cookie (Internet Explorer: HP_Administrator) (Cookie, fixed)
Statcounter: [SBI $4CDCC3D5] Tracking cookie (Internet Explorer: HP_Administrator) (Cookie, fixed)
Winsoftware: [SBI $4CDCC3D5] Tracking cookie (Internet Explorer: HP_Administrator) (Cookie, fixed)
FastClick: [SBI $4CDCC3D5] Tracking cookie (Internet Explorer: HP_Administrator) (Cookie, fixed)
HitBox: [SBI $4CDCC3D5] Tracking cookie (Internet Explorer: HP_Administrator) (Cookie, fixed)
HitsLink: [SBI $4CDCC3D5] Tracking cookie (Internet Explorer: HP_Administrator) (Cookie, fixed)
BlueStreak: [SBI $4CDCC3D5] Tracking cookie (Internet Explorer: HP_Administrator) (Cookie, fixed)
WebTrends live: [SBI $4CDCC3D5] Tracking cookie (Internet Explorer: HP_Administrator) (Cookie, fixed)
AdRevolver: [SBI $4CDCC3D5] Tracking cookie (Internet Explorer: HP_Administrator) (Cookie, fixed)
SexTracker: [SBI $4CDCC3D5] Tracking cookie (Internet Explorer: HP_Administrator) (Cookie, fixed)
HitBox: [SBI $4CDCC3D5] Tracking cookie (Internet Explorer: HP_Administrator) (Cookie, fixed)
HitBox: [SBI $4CDCC3D5] Tracking cookie (Internet Explorer: HP_Administrator) (Cookie, fixed)
SexTracker: [SBI $4CDCC3D5] Tracking cookie (Internet Explorer: HP_Administrator) (Cookie, fixed)
MediaPlex: [SBI $4CDCC3D5] Tracking cookie (Internet Explorer: HP_Administrator) (Cookie, fixed)
HitBox: [SBI $4CDCC3D5] Tracking cookie (Internet Explorer: HP_Administrator) (Cookie, fixed)
AdRevolver: [SBI $4CDCC3D5] Tracking cookie (Internet Explorer: HP_Administrator) (Cookie, fixed)
TagASaurus: [SBI $4CDCC3D5] Tracking cookie (Internet Explorer: HP_Administrator) (Cookie, fixed)
HitBox: [SBI $4CDCC3D5] Tracking cookie (Internet Explorer: HP_Administrator) (Cookie, fixed)
Winsoftware: [SBI $4CDCC3D5] Tracking cookie (Internet Explorer: HP_Administrator) (Cookie, fixed)
Zedo: [SBI $4CDCC3D5] Tracking cookie (Internet Explorer: HP_Administrator) (Cookie, fixed)
Clickbank: [SBI $4CDCC3D5] Tracking cookie (Internet Explorer: HP_Administrator) (Cookie, fixed)
HitBox: [SBI $4CDCC3D5] Tracking cookie (Internet Explorer: HP_Administrator) (Cookie, fixed)
BurstMedia: [SBI $4CDCC3D5] Tracking cookie (Internet Explorer: HP_Administrator) (Cookie, fixed)
Advertising.com: [SBI $4CDCC3D5] Tracking cookie (Internet Explorer: HP_Administrator) (Cookie, fixed)
HitBox: [SBI $4CDCC3D5] Tracking cookie (Internet Explorer: HP_Administrator) (Cookie, fixed)
DoubleClick: [SBI $4CDCC3D5] Tracking cookie (Internet Explorer: HP_Administrator) (Cookie, fixed)
BurstMedia: [SBI $4CDCC3D5] Tracking cookie (Internet Explorer: HP_Administrator) (Cookie, fixed)
DirectTrack: [SBI $4CDCC3D5] Tracking cookie (Internet Explorer: HP_Administrator) (Cookie, fixed)
HitBox: [SBI $4CDCC3D5] Tracking cookie (Internet Explorer: HP_Administrator) (Cookie, fixed)
Winsoftware: [SBI $4CDCC3D5] Tracking cookie (Internet Explorer: HP_Administrator) (Cookie, fixed)
MediaPlex: [SBI $4CDCC3D5] Tracking cookie (Internet Explorer: HP_Administrator) (Cookie, fixed)
HitBox: [SBI $4CDCC3D5] Tracking cookie (Internet Explorer: HP_Administrator) (Cookie, fixed)
HitBox: [SBI $4CDCC3D5] Tracking cookie (Internet Explorer: HP_Administrator) (Cookie, fixed)
HitBox: [SBI $4CDCC3D5] Tracking cookie (Internet Explorer: HP_Administrator) (Cookie, fixed)
SexTracker: [SBI $4CDCC3D5] Tracking cookie (Internet Explorer: HP_Administrator) (Cookie, fixed)
HitBox: [SBI $4CDCC3D5] Tracking cookie (Internet Explorer: HP_Administrator) (Cookie, fixed)
HitBox: [SBI $4CDCC3D5] Tracking cookie (Internet Explorer: HP_Administrator) (Cookie, fixed)
HitsLink: [SBI $4CDCC3D5] Tracking cookie (Internet Explorer: HP_Administrator) (Cookie, fixed)
SexList: [SBI $4CDCC3D5] Tracking cookie (Internet Explorer: HP_Administrator) (Cookie, fixed)
HitBox: [SBI $4CDCC3D5] Tracking cookie (Internet Explorer: HP_Administrator) (Cookie, fixed)
--- Spybot - Search & Destroy version: 1.5 (build: 20070830) ---
2007-08-31 blindman.exe (1.0.0.6)
2007-08-31 SDMain.exe (1.0.0.4)
2007-08-31 SDUpdate.exe (1.0.6.4)
2007-08-31 SDWinSec.exe (1.0.0.8)
2007-08-31 SpybotSD.exe (1.5.1.15)
2007-08-31 TeaTimer.exe (1.5.0.9)
2007-09-12 unins000.exe (51.46.0.0)
2007-08-31 Update.exe (1.4.0.5)
2007-08-31 advcheck.dll (1.5.3.0)
2007-04-02 aports.dll (2.1.0.0)
2007-04-02 DelZip179.dll (1.79.5.3)
2007-08-31 SDHelper.dll (1.5.0.8)
2007-08-31 Tools.dll (2.1.2.0)
2007-09-12 Includes\Cookies.sbi (*)
2007-07-25 Includes\Dialer.sbi (*)
2007-09-12 Includes\DialerC.sbi (*)
2007-08-29 Includes\Hijackers.sbi (*)
2007-09-12 Includes\HijackersC.sbi (*)
2007-07-25 Includes\Keyloggers.sbi (*)
2007-09-12 Includes\KeyloggersC.sbi (*)
2004-11-29 Includes\LSP.sbi (*)
2007-09-12 Includes\Malware.sbi (*)
2007-09-12 Includes\MalwareC.sbi (*)
2007-09-05 Includes\PUPS.sbi (*)
2007-09-12 Includes\PUPSC.sbi (*)
2007-09-12 Includes\Revision.sbi (*)
2007-05-30 Includes\Security.sbi (*)
2007-09-12 Includes\SecurityC.sbi (*)
2007-09-12 Includes\Spybots.sbi (*)
2007-09-12 Includes\SpybotsC.sbi (*)
2007-08-21 Includes\Tracks.uti
2007-09-12 Includes\Trojans.sbi (*)
2007-09-12 Includes\TrojansC.sbi (*)
2008-12-24 Plugins\TCPIPAddress.dll
Cookies are just cookies. They're part of the Internet Explorer cache, as the history is. But removing a cookie will never remove any IE functionality - they're just single items on the cache and do not affect the cache in general.
The history in IE is instead linked in, e.g.
HKEY_CLASSES_ROOT\CLSID\{3C374A40-BAE4-11CF-BF7D-00AA006946EE}\
HKEY_CLASSES_ROOT\CLSID\{FF393560-C2A7-11CF-BFF4-444553540000}\
And other IDs, later probably also mentioned in an IE key. I don't see these in your fix list as well though.
And there are settings here for example:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Url History\
tjvitale
2007-09-14, 20:42
The reply suggests that S-S&D is not the source of the issue. Since I have used all the easy options, short or resetting IE back to factory specs, which would erase the existing history, support from Microsoft seems the next logical choice. Or, have I missed something.