Spybotsnd demands autocheck on reboot [Archive]

View Full Version : Spybotsnd demands autocheck on reboot

HarmlessOne

2006-07-27, 19:03

A line keeps being reinserted in my registry to run spybotsnd in autocheck mode even though I have completely removed Spybot from my PC. If I delete the registry key, I get one reboot without an error, but then the key has been replaced in the registry and the next reboot generates an error. Help!

Thanks,

Scott

spybotsandra

2006-07-28, 09:28

Hello,

Did you remove Spybot Search and Destroy correctly with the small fix?

In order to completely uninstall Spybot - Search & Destroy, please consider the following link:
http://www.safer-networking.org/en/faq/27.html

Best regards
Sandra
Team Spybot

HarmlessOne

2006-07-28, 14:46

Thanks for your post, Sandra.

Yes, I did as you suggested, multiple times. I have both run and "Merged" the very small fix into the registry. Still, the problem remains. What next?

HarmlessOne

2006-07-28, 14:55

Thank you for your reply.

1) I checked and there are no entries with SpyBot under the two keys you suggested.

2) I never installed TeaTimer, but I looked for it just in case. It does not appear to be present on my machine.

3) If by "autostart folder" you mean the "Start/All Programs/Startup" folder, then it is definitely not there.

4) I had already deleted the folder with the configuration file you mentioned, so it is not there either. I checked again just to make sure.

What else could be causing this problem? Thanks in advance for any further help.

Yours,
D. Scott Meadows

-----Original Message-----
From: Team Spybot [mailto:software@spybot.info]
Sent: Friday, July 28, 2006 9:44 AM
To: D. Scott Meadows
Subject: RE: [SBSD] totally removing spybot (Ticket: 634974421)

Hello Scott,

Do you have also deleted the autorun entries from Spybot-S&D here?

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]

[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]

Do you have disabled the TeaTimer? The TeaTimer can recreate registry entries if you don't allow the changes.

Could it be possible that you have Spybot-S&D in your "Autostart" folder?

Please also delete the file configuration.ini here:

* Windows 95 or 98: C:WindowsAplication DataSpybot - Search & Destroy
* Windows ME: C:WindowsAll UsersApplication DataSpybot - Search & Destroy
* Windows NT, 2000 or XP: C:Documents and SettingsAll UsersApplication DataSpybot - Search & Destroy

(Please note that the Application Data Folder is hidden. So if you can't find this folder please check your folder properties)

This file contains Settings for Spybot-S&D.

Best Regards,
Chi-Va
Team Spybot

---------------------------------------------------------
Spybot-Search&Destroy: http://www.spybot.info/ .........................................................
All incoming and outgoing mails are scanned
using an up-to-date anti-virus application.
---------------------------------------------------------

> --------------------------------------------------
> Original Message:
> --------------------------------------------------
>
> Hi Sandra,
>
> Yes, I used small fix. I went through the whole procedure twice. Still, my
> vexing little problem returns.
>
> Before you emailed me, I had grappled with this for hours. I know how to
> edit the registry (Run regedit), and so searched it electronically for the
> batch-file line that executes SpyBot on startup and deleted it (at first
> there were two lines like that). I did this after disabling AdAware which I
> had set to keep the registry from being modified in certain ways, and also
> after disabling my antivirus and firewall program (Windows OneCare) just to
> make sure my edits "took." I closed the registry and opened it again, double
> checking command lines to start SpyBot were gone. Yes, they were.
>
> Then I rebooted and the problem was solved--or so I thought. Upon the second
> reboot, those same lines were back in the registry again! Somehow, I have
> resident on my notebook PC some code that regenerates the autocheck commands
> in the registry without my wanting it to do that.
>
> I also tried reinstalling SpyBot and changing automation settings in the
> advanced mode, but all the settings were correct to preclude an autocheck
> upon reboot. Go figure.
>
> I'm really frustrated by this problem, so anything you can do to help will
> be much appreciated.
>
> Yours,
>
> Scott
>
> -----Original Message-----
> From: Team Spybot [mailto:software@spybot.info]
> Sent: Tuesday, July 25, 2006 6:23 AM
> To: D. Scott Meadows
> Subject: RE: [SBSD] totally removing spybot (Ticket: 634974421)
>
> Hello Scott,
>
> Did you use the small fix?
>
> It is important to use the 'very small fix'. This is how to use it:
> On our website please right-click the 'very small fix'-link and choose 'Save
> as'.
> The small fix will then be downloaded. Now you can execute it with a double
> click on its symbol.
> If this does not work, you can right click the small fix download and choose
> 'Merge'.
> Now all entries that belong to Spybot - Search & Destroy will be deleted
> from the registry.
>
> Best Regards,
> Sandra
> Team Spybot
>
> Please give us your feedback: this mail was
> helpful http://feedback.spybot.info/index.php?h=1OTY3MjU6NjM0OTc0NDIxOjI
> partly helpful
> http://feedback.spybot.info/index.php?h=1OTY3MjU6NjM0OTc0NDIxOjE
> not helpful
> http://feedback.spybot.info/index.php?h=1OTY3MjU6NjM0OTc0NDIxOjA
>
>
> ---------------------------------------------------------
> Spybot-Search&Destroy: http://www.spybot.info/
> .........................................................
> All incoming and outgoing mails are scanned
> using an up-to-date anti-virus application.
> ---------------------------------------------------------
>
>
> > --------------------------------------------------
> > Original Message:
> > --------------------------------------------------
> >
> > Hi Sandra,
> >
> > Following your directions did not resolve the problem. Sorry. Any
> > suggestions?
> >
> > Scott
> >
> > -----Original Message-----
> > From: Team Spybot [mailto:software@spybot.info]
> > Sent: Tuesday, July 25, 2006 5:35 AM
> > To: D.Scott Meadows
> > Subject: Re: [SBSD] totally removing spybot (Ticket: 634974421)
> >
> > Hello Scott,
> >
> > In order to completely uninstall Spybot-S&D please consider the
> following
> > link: http://www.safer-networking.org/en/faq/27.html
> > It is important to use the "very small fix".
> >
> > Best Regards,
> > Sandra
> > Team Spybot
> >
> > Please give us your feedback: this mail was
> > helpful http://feedback.spybot.info/index.php?h=1OTY2OTY6NjM0OTc0NDIxOjI
> > partly helpful
> > http://feedback.spybot.info/index.php?h=1OTY2OTY6NjM0OTc0NDIxOjE
> > not helpful
> http://feedback.spybot.info/index.php?h=1OTY2OTY6NjM0OTc0NDIxOjA
> >
> >
> > ---------------------------------------------------------
> > Spybot-Search&Destroy: http://www.spybot.info/
> > .........................................................
> > All incoming and outgoing mails are scanned
> > using an up-to-date anti-virus application.
> > ---------------------------------------------------------
> >
> >
> > > --------------------------------------------------
> > > Original Message:
> > > --------------------------------------------------
> > >
> > > I've uninstalled spybot (temporarily) but I still see spybot is
> trying
> > to run automatically when I reboot. Help, please.
> > >
> > >
> >
> >
>
>

md usa spybot fan

2006-07-28, 18:26

HarmlessOne:

A line keeps being reinserted in my registry to run spybotsnd in autocheck mode ... If I delete the registry key, ...
What is the registry key?

I personally am not familiar with Windows OneCare. Does Windows OneCare or any other anti-malware type programs that you may be running have a "Startup Monitor" that prevents the addition or deletion of startup entries (or in this case reestablishes startup entry if is deleted)?

HarmlessOne

2006-07-29, 01:21

By registry key I just meant a line in the registry.

Windows OneCare assured me their program could not be responsible for reinserting code like this into the registry.

Thanks for this feedback anyway.

Scott

HarmlessOne

2006-07-29, 02:54

bitman

2006-07-30, 16:23

I'm glad to report I solved the problem. Lavasoft's Ad-Watch addon to Ad-Aware was the program creating and inserting the registry key for some reason, after I had installed and uninstalled SpyBot.

I cleansed the registry, uninstalled Ad-Aware and Ad-Watch, and the reinstalled both, and the problem was completely solved.

By the way, I still appreciate both programs--SpyBot and Ad-Aware/Ad-Watch. Lifesavers, but this time I developed some kind of special problem.

Scott
Hi Scott,

Glad you found the problem, by your description in your email the interaction is fairly obvious.

I did this after disabling AdAware which I had set to keep the registry from being modified in certain ways,
Though you disabled AdAware, it will still remember the state of the registry from before it was shut down. When you re-eabled it after the next reboot, the AdAware registry watcher would detect the changes you made and return them to their previous settings.

I'm not a user of AdAware myself, but Spybot's Teatimer will do something very similar if you've told it to 'Remember' a registry setting, but at least it will continually warn that it is making this change by displaying a pop-up with the information. It sounds as if AdAware does this silently, which would create exactly this type of confusion if it's true.

Bitman