View Full Version : Tracking cookies are red
Aren't at least some of these supposed to be green? When I expand the top six, all the entries are listed as cookies.
http://www.polisource.com/misc/spybot.gif
Also, when I check a box to the left of any one of the problems and click the gray bar to the right, it says "no information available." I'm afraid to "fix" the Microsoft entries because I don't know what they are.
md usa spybot fan
2007-10-27, 06:23
Please post a log of the actual detections you are getting so the we can see the entire detection. To do that:
Run another scan.
When the scan completes, right click on the results list, select "Copy results to clipboard".
Then paste (Ctrl+V) those results to a new post in this thread.
I did that and saved the file before I turned off the computer overnight, just in case it was needed. I wasn't sure it was safe to post. Here it is:
Microsoft.WindowsSecurityCenter.AntiVirusOverride: [SBI $3604910C] Settings (Registry change, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusOverride
Microsoft.WindowsSecurityCenter_disabled: [SBI $2E20C9A9] Settings (Registry change, nothing done)
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wscsvc\Start
Microsoft.Windows.IEFirewallBypass: [SBI $FFF24D3C] Settings (Registry value, nothing done)
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Program Files\Internet Explorer\IEXPLORE.EXE
Microsoft.Windows.IEFirewallBypass: [SBI $4F6FBB06] Settings (Registry value, nothing done)
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Program Files\Internet Explorer\IEXPLORE.EXE
HitBox: [SBI $4CDCC3D5] Tracking cookie (Internet Explorer: Owner) (Cookie, nothing done)
Advertising.com: [SBI $4CDCC3D5] Tracking cookie (Internet Explorer: Owner) (Cookie, nothing done)
HitBox: [SBI $4CDCC3D5] Tracking cookie (Internet Explorer: Owner) (Cookie, nothing done)
FastClick: [SBI $4CDCC3D5] Tracking cookie (Internet Explorer: Owner) (Cookie, nothing done)
Avenue A, Inc.: [SBI $4CDCC3D5] Tracking cookie (Internet Explorer: Owner) (Cookie, nothing done)
HitBox: [SBI $4CDCC3D5] Tracking cookie (Internet Explorer: Owner) (Cookie, nothing done)
Adviva: [SBI $4CDCC3D5] Tracking cookie (Internet Explorer: Owner) (Cookie, nothing done)
DoubleClick: [SBI $4CDCC3D5] Tracking cookie (Internet Explorer: Owner) (Cookie, nothing done)
Advertising.com: [SBI $4CDCC3D5] Tracking cookie (Opera 7+: Owner) (Cookie, nothing done)
Advertising.com: [SBI $4CDCC3D5] Tracking cookie (Opera 7+: Owner) (Cookie, nothing done)
Advertising.com: [SBI $4CDCC3D5] Tracking cookie (Opera 7+: Owner) (Cookie, nothing done)
Advertising.com: [SBI $4CDCC3D5] Tracking cookie (Opera 7+: Owner) (Cookie, nothing done)
Advertising.com: [SBI $4CDCC3D5] Tracking cookie (Opera 7+: Owner) (Cookie, nothing done)
Advertising.com: [SBI $4CDCC3D5] Tracking cookie (Opera 7+: Owner) (Cookie, nothing done)
Advertising.com: [SBI $4CDCC3D5] Tracking cookie (Opera 7+: Owner) (Cookie, nothing done)
Advertising.com: [SBI $4CDCC3D5] Tracking cookie (Opera 7+: Owner) (Cookie, nothing done)
Advertising.com: [SBI $4CDCC3D5] Tracking cookie (Opera 7+: Owner) (Cookie, nothing done)
HitBox: [SBI $4CDCC3D5] Tracking cookie (Opera 7+: Owner) (Cookie, nothing done)
HitBox: [SBI $4CDCC3D5] Tracking cookie (Opera 7+: Owner) (Cookie, nothing done)
Advertising.com: [SBI $4CDCC3D5] Tracking cookie (Mozilla: default) (Cookie, nothing done)
Advertising.com: [SBI $4CDCC3D5] Tracking cookie (Mozilla: default) (Cookie, nothing done)
Advertising.com: [SBI $4CDCC3D5] Tracking cookie (Mozilla: default) (Cookie, nothing done)
Advertising.com: [SBI $4CDCC3D5] Tracking cookie (Mozilla: default) (Cookie, nothing done)
Advertising.com: [SBI $4CDCC3D5] Tracking cookie (Mozilla: default) (Cookie, nothing done)
Avenue A, Inc.: [SBI $4CDCC3D5] Tracking cookie (Mozilla: default) (Cookie, nothing done)
DoubleClick: [SBI $4CDCC3D5] Tracking cookie (Mozilla: default) (Cookie, nothing done)
FastClick: [SBI $4CDCC3D5] Tracking cookie (Mozilla: default) (Cookie, nothing done)
--- Spybot - Search & Destroy version: 1.5 (build: 20070830) ---
2007-08-31 blindman.exe (1.0.0.6)
2007-08-31 SDMain.exe (1.0.0.4)
2007-08-31 SDUpdate.exe (1.0.6.4)
2007-08-31 SDWinSec.exe (1.0.0.8)
2007-08-31 SpybotSD.exe (1.5.1.15)
2007-08-31 TeaTimer.exe (1.5.0.9)
2007-10-05 unins000.exe (51.46.0.0)
2007-08-31 Update.exe (1.4.0.5)
2007-08-31 advcheck.dll (1.5.3.0)
2007-04-02 aports.dll (2.1.0.0)
2007-04-02 DelZip179.dll (1.79.5.3)
2007-08-31 SDHelper.dll (1.5.0.8)
2007-08-31 Tools.dll (2.1.2.0)
2007-10-24 Includes\Cookies.sbi (*)
2007-07-25 Includes\Dialer.sbi (*)
2007-10-24 Includes\DialerC.sbi (*)
2007-08-29 Includes\Hijackers.sbi (*)
2007-10-24 Includes\HijackersC.sbi (*)
2007-10-04 Includes\Keyloggers.sbi (*)
2007-10-24 Includes\KeyloggersC.sbi (*)
2007-10-24 Includes\Malware.sbi (*)
2007-10-24 Includes\MalwareC.sbi (*)
2007-10-24 Includes\PUPS.sbi (*)
2007-10-24 Includes\PUPSC.sbi (*)
2007-10-24 Includes\Revision.sbi (*)
2007-05-30 Includes\Security.sbi (*)
2007-10-24 Includes\SecurityC.sbi (*)
2007-10-24 Includes\Spybots.sbi (*)
2007-10-24 Includes\SpybotsC.sbi (*)
2007-08-21 Includes\Tracks.uti
2007-10-24 Includes\Trojans.sbi (*)
2007-10-24 Includes\TrojansC.sbi (*)
2008-12-24 Plugins\TCPIPAddress.dll
md usa spybot fan
2007-10-27, 17:40
Barry:
Third-party cookies, also referred to as Tracking Cookies, are cookies stored on your computer by a third-party not directly related to the web site you're currently viewing. The intention of this type of cookie is to profile the user's surfing habits by tracking your movement as you surf between sites. If any transaction occurs where the user gives any personal info, then the tracking becomes personally identifiable. While tracking cookies may not be as insidious as some types of malware, they are definitely spies.
The tracing cookies should be fixed.
In Internet Explorer you can block the storing of the same Tracking Cookies that Spybot detects by enabling Spybot's SDHelper Browser Helper Object (BHO). To do this go into Spybot-S&D > Mode > Advanced mode > Resident. Under the heading "Resident protection status" check the following: Resident "SDHelper" (Internet Explorer bad download blocker) active.
There is another way to prevent the storing of Tracking Cookies in Internet Explorer (even those not blocked by Spybot's resident BHO) as well as the storing of Tracking Cookies in other WEB browsers. See:
Why do other anti-spyware applications detect so many more tracking cookies?
http://www.safer-networking.org/index.php?page=faq&detail=37
_____________________
For this detection:
Microsoft.WindowsSecurityCenter.AntiVirusOverride: [SBI $3604910C] Settings (Registry change, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusOverride
I suggest that you go into Start > Control Panel > Security Center > look at the right hand side of the window and check the settings under "Virus Protection" (expanding if necessary). I believe that you have overridden the protections and that you will find a button labeled "Recommendations". If you click on the "Recommendations" button I believe that you will get a window that indicates something like:
I have an antivirus program that I'll monitor myself.
Note: with these setting Windows won't monitor your virus protection status and won't send you alerts if it is off or out of date.
_____________________
For this detection:
Microsoft.WindowsSecurityCenter_disabled: [SBI $2E20C9A9] Settings (Registry change, nothing done)
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wscsvc\Start
If you go to Start > Run > type "services.msc" (no quotes) in the Open box > and then click OK the windows Services application will start. If you scroll down in the right pane until you see Security Center and either double click on Security Center or right click on Security Center and choose Properties from the context menu, the Security Center Properties window will open. You will most likely find that:
The Startup type is Disabled (it is normally Automatic).
The Services Status is Stopped (it is normally Started).
_____________________
For these detections:
Microsoft.Windows.IEFirewallBypass: [SBI $FFF24D3C] Settings (Registry value, nothing done)
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Program Files\Internet Explorer\IEXPLORE.EXE
Microsoft.Windows.IEFirewallBypass: [SBI $4F6FBB06] Settings (Registry value, nothing done)
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Program Files\Internet Explorer\IEXPLORE.EXE
Those detections indicate that Internet Explorer authorized for the Windows Firewall. Normally Internet Explorer does not need to get authorized within the Windows Firewall for internet surfing. The Windows Firewall only works one way (Windows XP), it only block access from outside. By authorizing Internet Explorer within the Windows Firewall you are basically allowing Internet Explorer to accept incoming transmissions like a server would.
_____________________
What OS, anti-virus and firewall are you running?
The tracing cookies should be fixed.I fixed them, but I was surprised they were red because the tutorial says "The first thing you should know is to distinguish between the red entries, which represent spyware and similar threats, and the green entries, which are usage tracks....For the usage tracks (I hope you have followed that link to read what they are) [no, because I didn't see a link], removal is non-critical, but depends on your personal preferences." Unless there's a difference between tracking cookies and usage tracks, either the tutorial is wrong or the color codes in the problems list are wrong.
For this detection:
Microsoft.WindowsSecurityCenter.AntiVirusOverride: [SBI $3604910C] Settings (Registry change, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusOverride
I suggest that you go into Start > Control Panel > Security Center > look at the right hand side of the window and check the settings under "Virus Protection" (expanding if necessary). I believe that you have overridden the protections...There's no "virus protection" option - just internet options, automatic updates, and Windows firewall. The top says that the security center service hasn't been started or was stopped, so that probably explains it. I might have been annoyed by the popups and I already knew about my security situation (Norton with auto-updates and Windows Firewall only) so I disabled the security center service it or a service it requires (listed here (http://blogs.chron.com/helpline/archives/2006/07/security_center.html)). I'm OK with that for now. Probably a good catch by Spybot.
For these detections:
Microsoft.Windows.IEFirewallBypass: [SBI $FFF24D3C] Settings (Registry value, nothing done)
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Program Files\Internet Explorer\IEXPLORE.EXE
Microsoft.Windows.IEFirewallBypass: [SBI $4F6FBB06] Settings (Registry value, nothing done)
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Program Files\Internet Explorer\IEXPLORE.EXE
Those detections indicate that Internet Explorer authorized for the Windows Firewall. Normally Internet Explorer does not need to get authorized within the Windows Firewall for internet surfing. The Windows Firewall only works one way (Windows XP), it only block access from outside. By authorizing Internet Explorer within the Windows Firewall you are basically allowing Internet Explorer to accept incoming transmissions like a server would.I looked at the exceptions in Windows Firewall and IE isn't checked. I confirmed this in the registry.
For the key:
"HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\"
and value name:
"C:\Program Files\Internet Explorer\iexplore.exe"
the value data indicates that IE is disabled:
"C:\Program Files\Internet Explorer\iexplore.exe:*:Disabled:Internet Explorer"
and the same value and data exists for the key:
"HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\"
What OS, anti-virus and firewall are you running?Windows XP, Norton, Windows Firewall.
md usa spybot fan
2007-10-28, 08:01
There does appear to be a problem with the detection of Microsoft.Windows.IEFirewallBypass. I made another report of it in the following thread:
Possible Microsoft.Windows.IEFirewallBypass False Positive
http://forums.spybot.info/showthread.php?t=19551
Thanks for catching the problem.
Since you running Norton please read post #3 (http://forums.spybot.info/showpost.php?p=83603&postcount=3) in the following thread why you may be getting the "Microsoft.WindowsSecurityCenter_disabled" detection:
I need some help with Microsoft windows securitycenter_disabled
http://forums.spybot.info/showthread.php?t=13399
The fact that the Windows Security Center is disabled may also be the reason that "There's no "virus protection" option" in the Windows Security Center, although I have never encounter that situation before.
As far as the red tracking cookies go, they are red because they are picked up during the scan for spyware. They are not regular cookies that would be picked up and listed in green if you did a scan for Usage Tracking.