PDA

View Full Version : False Negatives???



MD in Philly
2007-09-29, 22:36
My first post, have used for years without any reason to visit here.

For the last several days when I run a search I get the notice, "Congratulations! You have no threats" (or something to that effect).

This has never happened to me before, let alone multiple times consecutively after quite a bit of searching on the web.

Are there such things as anti-spywaredetectors that hide problems, or has SpyBot S+D advanced to the point of blocking everything bad that is out there? :bigthumb: (At least for the moment).

Thanks

spybotsandra
2007-10-01, 10:10
Hello,

Would be nice to know wich version of Spybot you run and which updates.

To see which version number and/or updates of Spybot - Search & Destroy you are using please run Spybot-S&D and choose "Help" --> "About" in the menu bar.
There you can see which version you have and which updates are installed.
It should be version 1.5 and the updates from the 2007/09/26.

Further please run Spybot - Search & Destroy and switch to "Advanced mode" via the menu bar item "Mode" and select "Settings" --> "File Sets" in the left bar. There, please right-click somewhere into the list and choose "select all available checks".

Best regards
Sandra
Team Spybot

md usa spybot fan
2007-10-01, 17:03
Note: By selecting "Select all available checks" in File Sets you will activate the checking of usage tracks as well as spyware. Usage tracks are not normally checked by default. If you only want to ensure that you are checking for all for spyware but not check for usage tracks, select "Spyware check only" rather than "Select all available checks".

_______________________

Since you are trying to relate current scans with older scans, it may be helpful if you posted one of the results from an older scan where you were detecting the problems that you do not seem to be detecting now.

By default here are two Checks.yymmdd-hhmm.log files produced during a scan. The second Checks.yymmdd-hhmm.log has the details of what the scan found. A Fixes.yymmdd-hhmm.log file is produced if you fix or attempt to fix something.

There are two methods to copy and post the information from previous scans:
Method 1:
Go into Spybot > Mode > Advanced mode > Tools > View Reports > View Previous reports. Look for the Checks.yymmdd-hhmm.log or Fixes.yymmdd-hhmm.log file that contains the detections that you like help with. Open it. To copy it to the Clipboard, right click on the listing and select Select All > Right click again and select Copy. Paste (Ctrl+V) the contents of the Clipboard into a new post in this thread.
Method 2
The Checks.yymmdd-hhmm.log and Fixes.yymmdd-hhmm.log files are stored in the following folders:
Windows 95 or 98:
C:\Windows\Application Data\Spybot - Search & Destroy\Logs
Windows ME:
C:\Windows\All Users\Application Data\Spybot - Search & Destroy\Logs
Windows NT, 2000 or XP:
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Logs
Using Windows Explorer, navigate to the correct Checks.yymmdd-hhmm.log or Fixes.yymmdd-hhmm.log file. Double click on it and it should open with Notepad. To copy it to the Clipboard, right click on the listing and select Select All > Right click again and select Copy. Paste (Ctrl+V) the contents of the Clipboard into a new post in this thread.
___________________

Note: If the detections that you were getting in the past were all identified as an Internet Explorer "Tracking cookie", the most likely reason that you are no longer getting those detections is that you did one or more of the following:
Started using Spybot's immunization facility.
Enabled Spybot's resident SDHelper BHO facility.
Increased the security level within Internet Explorer to prevent the storing of third party cookies. See:
Why do other anti-spyware applications detect so many more tracking cookies?
http://www.safer-networking.org/index.php?page=faq&detail=37
If the detections that you were getting in the past were all identified "Tracking cookies" from other browsers besides Internet Explorer, the most likely reason that you are no longer getting those detections is that you did one or more of the following:
Started using Spybot's new 1.5 immunization facility which blocks tracking cookies from browsers other than Internet Explorer.
Started blocking the storing of third party cookies in your browser. See:
Why do other anti-spyware applications detect so many more tracking cookies?
http://www.safer-networking.org/index.php?page=faq&detail=37

MD in Philly
2007-10-01, 19:40
Thank you for your kind and thorough attention.

In accord with the instructions in the first reply, I found that I still had 1.4, though I had been updating it regularly.

I loaded 1.5 and scanned again. It did show one instance of "Avenue A", which I removed. I immunized, checked the immunization, then ran it again, and only found usage tracks (as I had activated that also). The tutorial explained that as well as the second reply, so no question there.

It has been a very long time since I have had anything show up other than tracking cookies. For the moment I will assume that the growing immunization listing outpaced the ability of the folks out there to create new ones.

Here is the record of one of the last fixes before I obtained the "no threats found" screen:

--- Report generated: 2007-08-26 13:47 ---

AdRevolver: Tracking cookie (Internet Explorer: Mike) (Cookie, fixed)
HitBox: Tracking cookie (Internet Explorer: Mike) (Cookie, fixed)
HitBox: Tracking cookie (Internet Explorer: Mike) (Cookie, fixed)
Zedo: Tracking cookie (Internet Explorer: Mike) (Cookie, fixed)
Advertising.com: Tracking cookie (Internet Explorer: Mike) (Cookie, fixed)
AdRevolver: Tracking cookie (Internet Explorer: Mike) (Cookie, fixed)
DoubleClick: Tracking cookie (Internet Explorer: Mike) (Cookie, fixed)
HitBox: Tracking cookie (Internet Explorer: Mike) (Cookie, fixed)
MediaPlex: Tracking cookie (Internet Explorer: Mike) (Cookie, fixed)
FastClick: Tracking cookie (Internet Explorer: Mike) (Cookie, fixed)
WebTrends live: Tracking cookie (Internet Explorer: Mike) (Cookie, fixed)

Thank you again.

md usa spybot fan
2007-10-01, 20:56
MD in Philly:

It sounds like you're all set now and understand why you may be getting the following message rather than the "Tracking cookie" detections you received in the past:


Congratulations!: No immediate threats were found.
Save surfing and if you have any further questions feel free to ask.

Regards,
md usa spybot fan