SUPER long scan times????

[gigglepot]

Hello, wondering if I did something wrong. I got the prompt to download the new version of Spybot 2.4, so I did, all went well, did the updates and then started the scan, it now says 836 minutes left to completion and it keeps going up from there! This can't be, it's never taken more than 15 minutes or so with Spybot 1.6.2. Did I do something wrong when installing? Should I just go back to Spybot 1.6.2? What happens if I just stay with 1.6.2 and don't update the software at all? Please help, thank you.

[Zenobia]

How did the scan go?Did it take 836 minutes?That would be roughly 13 hours,I think.
I just started a scan to look at the times,and my estimated time was up to 100 minutes,then dropped back down,and is currently at 49 minutes.So,perhaps if you leave the scan run,it won't take quite as much time as is estimated. :)

[gigglepot]

It actually crashed and I didn't want to restart it in case it was something I was doing wrong. Did yours actually take 49 minutes in the end? The Spybot 1.6.2 never took that long. Is Spybot 2.4 a completely new software that is checking more than 1.6.2 did? The start-up page for it looks completely different, like I'm not with Spybot anymore. What happens if I just stay with 1.6.2 and don't update the software at all?

[anhoutwi]

How did the scan go?Did it take 836 minutes?That would be roughly 13 hours,I think.
I just started a scan to look at the times,and my estimated time was up to 100 minutes,then dropped back down,and is currently at 49 minutes.So,perhaps if you leave the scan run,it won't take quite as much time as is estimated. :)I have the same experiences as gigglepot. Scanning with the antivirus engine included takes ages. Scanning starts with 31 minutes and it increases all the time. Like most scanning applications, time measurement is absolutely inaccurate. I tried to let it keep on running, but after a few hours I quitted which resulted in a total freeze up of the system (Windows 10 Pro Technical Preview Build 10049). It seems duely impossible to install without the antivrus engine. I my opinion Spybot should have sticked to their strongpoints.

[Zenobia]

I actually stopped that scan,because I was looking at the estimated scan time to see what it was doing,so I don't know how long it would've taken.But my scan time is usually an hour or so.But no,I don't believe you did anything wrong.There isn't much for user action that would really make the scan time your fault,so no reason to worry about that. :)

If you wish to stay with Spybot 2.4,then you could try a scan in safe mode,to see if the time might be lower that way:
https://forums.spybot.info/showthread.php?3922-Spybot-Search-amp-Destroy-FAQs-and-Information&p=23629&viewfull=1#post23629

Or,if you would prefer to go back to Spybot 1.6.2,that is still available,it's down below under other downloads:
https://www.safer-networking.org/dl/

What happens if I just stay with 1.6.2 and don't update the software at all?
Nothing that I'm aware of,you would just have the older software.You can go back to it,and still get definition updates.I didn't see anything on safer-networking indicating that Spybot 1.6.2 will be unavailable.I didn't see the prompt for Spybot 2.4,but that prompt might be intended to let people be aware there is a newer version,unless it says otherwise.If you would like to go back to the old version,you could do so,and if or when Spybot 1.6.2 is discontinued,there likely would be an announcement or something shown somewhere,so it's up to you. :)

[gigglepot]

Sorry for not replying sooner, I didn't get a notification that you replied.
Thank you. I think I will run both scans, one on each of the softwares and see how long they each take. Maybe I'm totally out to lunch and the "number of minutes left" totally threw me off. I will let you know how it goes.
On another note, I noticed that after I installed Spybot 2.4, something in my registry changed because my screen saver that I used to use (Bubbles) no longer works. Every other screen saver works (Windows 7) but not the one I've always been using. How can I get that back? Would it come back all on its own if I uninstall Spybot 2.4?

[gigglepot]

Ok, so I ran both Spybot 1.6.2 and Spybot 2.4........I got totally different results! 1.6.2 only took 23 minutes and said "Congratulations, no immediate threats"! When I ran 2.4, it took 49 minutes and said I have 21 results found! Why such a difference? How did 2.4 pick up 21 results but 1.6.2 picked up nothing? Why does 2.4 take more than twice as long? And lastly, are there way more things that 2.4 is checking that is not included in 1.6.2? Maybe answers to these questions might help me figure out what to do. Thank you.

[Zenobia]

No problem.If you wish,you can set up notification/subscription here. :)
https://forums.spybot.info/profile.php?do=editoptions
It's under Messaging & Notification,down beside Default Thread Subscription mode.

Is that the default Bubbles screensaver that comes with Windows 7?Have you gotten any prompts from teatimer lately,if you use it?
No,the Bubbles screensaver won't come back on it's own if you uninstall Spybot 2.4.

The reason that Spybot 1.6 found nothing may be because Spybot 1.6.2 is probably not set to scan for tracks,and Spybot 2.4 is.You can tell if something Spybot found are tracks by looking under category in the results window.There's a picture here where everything found is either Tracks or Browser(results in the browser category are just browser related things like cache,and are not a threat):
https://www.safer-networking.org/wp-content/uploads/2012/11/SDScan.png
This is the explanation on tracks:
https://www.safer-networking.org/faq/usage-tracks/

No,as far as I'm aware Spybot 1.6 and Spybot 2.4 free edition scan for the same amount of antispyware related things during a scan.The Spybot Home or Pro editions check for more things because those include antivirus.
I'm not sure why the Spybot 2.4 takes longer,but some variation might be set-up,etc.,such as one scanning for tracks,or the other not.
Or,it's possible Spybot 2.4 takes longer just due to being different than Spybot 1.6. :)

[gigglepot]

Hello, yes it's the Bubbles screensaver that comes with Windows 7. I used it all the time and never had any issues until I installed the Spybot 2.4. I'm sorry, I don't know what Teatimer is. Can you please help me get back my bubbles? :confused:

[Zenobia]

Yes,I'll try. :)
Please rightclick your desktop,select Personalize,then click Screensaver.It should say Bubbles.When the new window opens,click Preview.Let me know if it shows the Bubbles.That won't fix it,but it will let me know where to look to fix it from here on out.

[gigglepot]

Hello, yes it shows the bubbles! So I hit "Apply" and "Ok", x out of it and then go back into it and it reverts back to "none", not bubbles. "None" was the screensaver I used when Bubbles wasn't working. I tried all the rest and they all stay, everything except Bubbles.

[Zenobia]

In that case,it would be best to look at one of Spybot's checks.logfiles,just in case,and go from there.That will be a logfile from the Spybot 2.4 scan,it will state the version at the bottom of the logfile. :)
Could you open Spybot-S&D Start Center,click System scan,over to the left click Show previous logs,open the Checks logfile with the date of when you did your scan(example:Checks.150418-1908),go to Edit,select all,then rightclick and copy,then paste the logfile here?

[gigglepot]

Hello, here is the logfile:

Search results from Spybot - Search & Destroy

5/19/2015 9:12:30 PM
Scan took 00:49:36.
21 items found.

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750] Text file (File, nothing done)
C:\Users\Owner\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\8URN8KTV\cc1.midasplayer.com\kingdom-profile.sol
Properties.size=65
Properties.md5=7D3A350F8793DF4B7DB70BDBE8035513
Properties.filedate=1431909528
Properties.filedatetext=2015-05-17 18:38:48

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750] Text file (File, nothing done)
C:\Users\Owner\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\8URN8KTV\guitartricks.postaffiliatepro.com\pap20.sol
Properties.size=98
Properties.md5=633549A0E43F4BA8CB3494B8960C176A
Properties.filedate=1431728537
Properties.filedatetext=2015-05-15 16:22:17

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750] Text file (File, nothing done)
C:\Users\Owner\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\8URN8KTV\s.delvenetworks.com\cachedPlayerConfiguration.sol
Properties.size=8621
Properties.md5=7C5955D35E56B1C8DFD5B2CD9996B416
Properties.filedate=1432088424
Properties.filedatetext=2015-05-19 20:20:24

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750] Text file (File, nothing done)
C:\Users\Owner\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\8URN8KTV\s.delvenetworks.com\com.conviva.livePass.sol
Properties.size=224
Properties.md5=23E62F805C51C09DD543340CB69D2572
Properties.filedate=1432088431
Properties.filedatetext=2015-05-19 20:20:30

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750] Text file (File, nothing done)
C:\Users\Owner\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\8URN8KTV\s.delvenetworks.com\EdgeQueryPluginData.sol
Properties.size=72
Properties.md5=8DB99CB777F687B260657C6B5624A86E
Properties.filedate=1432088425
Properties.filedatetext=2015-05-19 20:20:25

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750] Text file (File, nothing done)
C:\Users\Owner\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\8URN8KTV\s.delvenetworks.com\player.sol
Properties.size=74
Properties.md5=EFAE057141197E7F72BB105A46090FCC
Properties.filedate=1432088424
Properties.filedatetext=2015-05-19 20:20:24

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750] Text file (File, nothing done)
C:\Users\Owner\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\8URN8KTV\static1.dmcdn.net\com.dm.player.sol
Properties.size=281
Properties.md5=ACF88940D89C8BF2B8799789C011316D
Properties.filedate=1431985272
Properties.filedatetext=2015-05-18 15:41:11

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750] Text file (File, nothing done)
C:\Users\Owner\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\8URN8KTV\www.dailymotion.com\analytics.sol
Properties.size=419
Properties.md5=E6923E86ABEE8070FB79AD94F23324BA
Properties.filedate=1431985151
Properties.filedatetext=2015-05-18 15:39:10

Statcounter: [SBI $4E2AF2AC] Tracking cookie (Firefox: Owner (default)) (Browser: Cookie, nothing done)


MS Direct3D: [SBI $7FB7B83F] Most recent application (Registry Change, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Direct3D\MostRecentApplication\Name

MS Direct3D: [SBI $C2A44980] Most recent application (Registry Change, nothing done)
HKEY_USERS\S-1-5-21-179166284-1700762968-3849658672-1000\Software\Microsoft\Direct3D\MostRecentApplication\Name

MS DirectDraw: [SBI $EB49D5AF] Most recent application (Registry Change, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication\Name

MS DirectInput: [SBI $9A063C91] Most recent application (Registry Change, nothing done)
HKEY_USERS\S-1-5-21-179166284-1700762968-3849658672-1000\Software\Microsoft\DirectInput\MostRecentApplication\Name

MS DirectInput: [SBI $7B184199] Most recent application ID (Registry Change, nothing done)
HKEY_USERS\S-1-5-21-179166284-1700762968-3849658672-1000\Software\Microsoft\DirectInput\MostRecentApplication\Id

Windows.OpenWith: [SBI $F7204896] Open with list - .AVI extension (Registry Key, nothing done)
HKEY_USERS\S-1-5-21-179166284-1700762968-3849658672-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AVI\OpenWithList

Windows.OpenWith: [SBI $770C10CF] Open with list - .BLK extension (Registry Key, nothing done)
HKEY_USERS\S-1-5-21-179166284-1700762968-3849658672-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.BLK\OpenWithList

Windows Explorer: [SBI $D20DA0AD] Recent file global history (Registry Key, nothing done)
HKEY_USERS\S-1-5-21-179166284-1700762968-3849658672-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs

Cookie: [SBI $49804B54] Browser: Cookie (27) (Browser: Cookie, nothing done)


Cache: [SBI $49804B54] Browser: Cache (972) (Browser: Cache, nothing done)


History: [SBI $49804B54] Browser: History (74) (Browser: History, nothing done)


Cookie: [SBI $49804B54] Browser: Cookie (1166) (Browser: Cookie, nothing done)



--- Spybot - Search & Destroy version: 2.4.40.131 DLL (build: 20140425) ---

2014-06-24 blindman.exe (2.4.40.151)
2014-06-24 explorer.exe (2.4.40.181)
2014-06-24 SDBootCD.exe (2.4.40.109)
2014-06-24 SDCleaner.exe (2.4.40.110)
2014-06-24 SDDelFile.exe (2.4.40.94)
2013-06-18 SDDisableProxy.exe
2014-06-24 SDFiles.exe (2.4.40.135)
2014-06-24 SDFileScanHelper.exe (2.4.40.1)
2014-06-24 SDFSSvc.exe (2.4.40.217)
2014-06-24 SDHelp.exe (2.4.40.1)
2014-04-25 SDHookHelper.exe (2.3.39.2)
2014-04-25 SDHookInst32.exe (2.3.39.2)
2014-04-25 SDHookInst64.exe (2.3.39.2)
2014-06-24 SDImmunize.exe (2.4.40.130)
2014-06-24 SDLogReport.exe (2.4.40.107)
2014-06-24 SDOnAccess.exe (2.4.40.11)
2014-06-24 SDPESetup.exe (2.4.40.3)
2014-06-24 SDPEStart.exe (2.4.40.86)
2014-06-24 SDPhoneScan.exe (2.4.40.28)
2014-06-24 SDPRE.exe (2.4.40.22)
2014-06-24 SDPrepPos.exe (2.4.40.15)
2014-06-24 SDQuarantine.exe (2.4.40.103)
2014-06-24 SDRootAlyzer.exe (2.4.40.116)
2014-06-24 SDSBIEdit.exe (2.4.40.39)
2014-06-24 SDScan.exe (2.4.40.181)
2014-06-24 SDScript.exe (2.4.40.54)
2014-06-24 SDSettings.exe (2.4.40.139)
2014-06-24 SDShell.exe (2.4.40.2)
2014-06-24 SDShred.exe (2.4.40.108)
2014-06-24 SDSysRepair.exe (2.4.40.102)
2014-06-24 SDTools.exe (2.4.40.157)
2014-06-24 SDTray.exe (2.4.40.129)
2014-06-27 SDUpdate.exe (2.4.40.94)
2014-06-27 SDUpdSvc.exe (2.4.40.77)
2014-06-24 SDWelcome.exe (2.4.40.130)
2014-04-25 SDWSCSvc.exe (2.3.39.2)
2015-03-25 spybotsd2-install-av-update.exe (2.4.40.0)
2014-05-20 spybotsd2-install-bdcore-update.exe (2.3.39.0)
2014-07-31 spybotsd2-translation-esx.exe
2013-06-19 spybotsd2-translation-frx.exe
2015-03-25 spybotsd2-translation-hrx.exe
2014-08-25 spybotsd2-translation-hux2.exe
2014-10-01 spybotsd2-translation-nlx2.exe
2014-11-05 spybotsd2-translation-ukx.exe
2015-05-14 unins000.exe (51.1052.0.0)
1999-12-02 xcacls.exe
2012-08-23 borlndmm.dll (10.0.2288.42451)
2012-09-05 DelZip190.dll (1.9.0.107)
2012-09-10 libeay32.dll (1.0.0.4)
2012-09-10 libssl32.dll (1.0.0.4)
2014-04-25 NotificationSpreader.dll
2014-06-24 SDAdvancedCheckLibrary.dll (2.4.40.98)
2015-03-25 SDAV.dll
2014-06-24 SDECon32.dll (2.4.40.114)
2014-06-24 SDECon64.dll (2.3.39.113)
2014-06-24 SDEvents.dll (2.4.40.2)
2014-06-24 SDFileScanLibrary.dll (2.4.40.14)
2014-04-25 SDHook32.dll (2.3.39.2)
2014-04-25 SDHook64.dll (2.3.39.2)
2014-06-24 SDImmunizeLibrary.dll (2.4.40.2)
2014-06-24 SDLicense.dll (2.4.40.0)
2014-06-24 SDLists.dll (2.4.40.4)
2014-06-24 SDResources.dll (2.4.40.7)
2014-06-24 SDScanLibrary.dll (2.4.40.131)
2014-06-24 SDTasks.dll (2.4.40.15)
2014-06-24 SDWinLogon.dll (2.4.40.0)
2012-08-23 sqlite3.dll
2012-09-10 ssleay32.dll (1.0.0.4)
2014-06-24 Tools.dll (2.4.40.36)
2015-04-22 Includes\Adware-000.sbi (*)
2015-02-27 Includes\Adware-001.sbi (*)
2015-05-13 Includes\Adware-C.sbi (*)
2014-01-13 Includes\Adware.sbi (*)
2014-01-13 Includes\AdwareC.sbi (*)
2010-08-13 Includes\Cookies.sbi (*)
2014-11-14 Includes\Dialer-000.sbi (*)
2014-11-14 Includes\Dialer-001.sbi (*)
2014-01-08 Includes\Dialer-C.sbi (*)
2014-01-13 Includes\Dialer.sbi (*)
2014-01-13 Includes\DialerC.sbi (*)
2014-01-09 Includes\Fraud-000.sbi (*)
2014-01-09 Includes\Fraud-001.sbi (*)
2014-03-31 Includes\Fraud-002.sbi (*)
2014-01-09 Includes\Fraud-003.sbi (*)
2012-11-14 Includes\HeavyDuty.sbi (*)
2014-11-14 Includes\Hijackers-000.sbi (*)
2014-11-14 Includes\Hijackers-001.sbi (*)
2014-01-08 Includes\Hijackers-C.sbi (*)
2014-01-13 Includes\Hijackers.sbi (*)
2014-01-13 Includes\HijackersC.sbi (*)
2014-01-08 Includes\iPhone-000.sbi (*)
2014-01-08 Includes\iPhone.sbi (*)
2014-11-14 Includes\Keyloggers-000.sbi (*)
2014-09-24 Includes\Keyloggers-C.sbi (*)
2014-01-13 Includes\Keyloggers.sbi (*)
2014-01-13 Includes\KeyloggersC.sbi (*)
2014-11-14 Includes\Malware-000.sbi (*)
2014-11-14 Includes\Malware-001.sbi (*)
2014-11-14 Includes\Malware-002.sbi (*)
2014-11-14 Includes\Malware-003.sbi (*)
2014-11-14 Includes\Malware-004.sbi (*)
2014-11-14 Includes\Malware-005.sbi (*)
2014-02-26 Includes\Malware-006.sbi (*)
2014-01-09 Includes\Malware-007.sbi (*)
2015-05-13 Includes\Malware-C.sbi (*)
2014-01-13 Includes\Malware.sbi (*)
2013-12-23 Includes\MalwareC.sbi (*)
2014-11-14 Includes\PUPS-000.sbi (*)
2014-01-15 Includes\PUPS-001.sbi (*)
2014-01-15 Includes\PUPS-002.sbi (*)
2015-05-13 Includes\PUPS-C.sbi (*)
2012-11-14 Includes\PUPS.sbi (*)
2014-01-07 Includes\PUPSC.sbi (*)
2014-01-08 Includes\Security-000.sbi (*)
2014-01-08 Includes\Security-C.sbi (*)
2014-01-21 Includes\Security.sbi (*)
2014-01-21 Includes\SecurityC.sbi (*)
2014-11-14 Includes\Spyware-000.sbi (*)
2015-05-06 Includes\Spyware-001.sbi (*)
2015-01-14 Includes\Spyware-C.sbi (*)
2014-01-21 Includes\Spyware.sbi (*)
2014-01-21 Includes\SpywareC.sbi (*)
2011-06-07 Includes\Tracks.sbi (*)
2012-11-19 Includes\Tracks.uti (*)
2014-01-15 Includes\Trojans-000.sbi (*)
2014-01-15 Includes\Trojans-001.sbi (*)
2014-11-14 Includes\Trojans-002.sbi (*)
2014-01-15 Includes\Trojans-003.sbi (*)
2014-01-15 Includes\Trojans-004.sbi (*)
2014-03-19 Includes\Trojans-005.sbi (*)
2015-03-31 Includes\Trojans-006.sbi (*)
2014-01-15 Includes\Trojans-007.sbi (*)
2014-07-09 Includes\Trojans-008.sbi (*)
2014-07-09 Includes\Trojans-009.sbi (*)
2015-05-13 Includes\Trojans-C.sbi (*)
2014-01-15 Includes\Trojans-OG-000.sbi (*)
2014-01-15 Includes\Trojans-TD-000.sbi (*)
2014-01-15 Includes\Trojans-VM-000.sbi (*)
2014-01-15 Includes\Trojans-VM-001.sbi (*)
2014-01-15 Includes\Trojans-VM-002.sbi (*)
2014-01-15 Includes\Trojans-VM-003.sbi (*)
2014-01-15 Includes\Trojans-VM-004.sbi (*)
2014-01-15 Includes\Trojans-VM-005.sbi (*)
2014-01-15 Includes\Trojans-VM-006.sbi (*)
2014-01-15 Includes\Trojans-VM-007.sbi (*)
2014-01-15 Includes\Trojans-VM-008.sbi (*)
2014-01-15 Includes\Trojans-VM-009.sbi (*)
2014-01-15 Includes\Trojans-VM-010.sbi (*)
2014-01-15 Includes\Trojans-VM-011.sbi (*)
2014-01-15 Includes\Trojans-VM-012.sbi (*)
2014-01-15 Includes\Trojans-VM-013.sbi (*)
2014-01-15 Includes\Trojans-VM-014.sbi (*)
2014-01-15 Includes\Trojans-VM-015.sbi (*)
2014-01-15 Includes\Trojans-VM-016.sbi (*)
2014-01-15 Includes\Trojans-VM-017.sbi (*)
2014-01-15 Includes\Trojans-VM-018.sbi (*)
2014-01-15 Includes\Trojans-VM-019.sbi (*)
2014-01-15 Includes\Trojans-VM-020.sbi (*)
2014-01-15 Includes\Trojans-VM-021.sbi (*)
2014-01-15 Includes\Trojans-VM-022.sbi (*)
2014-01-15 Includes\Trojans-VM-023.sbi (*)
2014-01-15 Includes\Trojans-VM-024.sbi (*)
2014-01-15 Includes\Trojans-ZB-000.sbi (*)
2014-01-15 Includes\Trojans-ZL-000.sbi (*)
2014-01-09 Includes\Trojans.sbi (*)
2014-01-16 Includes\TrojansC-01.sbi (*)
2014-01-16 Includes\TrojansC-02.sbi (*)
2014-01-16 Includes\TrojansC-03.sbi (*)
2014-01-16 Includes\TrojansC-04.sbi (*)
2014-01-16 Includes\TrojansC-05.sbi (*)
2014-01-09 Includes\TrojansC.sbi (*)

[Zenobia]

Okay,there's nothing related to Bubbles.scr in your logfile,so that's good news.

Now,could you go to C:\Windows\System32,then scroll to make sure Bubbles.scr is in that location.Doubleclick it and the bubbles should appear for a couple seconds.This should work,since your preview worked,but it's to see that all is okay,and the file is in the right location.

Also,this is a Windows 7 computer?And it is yours,just to check that it's not something restricted by the IT department or something like that,though I believe in that case it would be greyed out,and you would not be able to select any screensavers. :)

[gigglepot]

Yes, the Bubbles screensaver is in that location, and when I double clicked it, bubbles came up.
Yes, it is a Windows 7 computer and it is a home computer, so there is no IT department.
Please let me know what to do next. Thanks!

[Zenobia]

Hmm,I wonder why it reverts to none when you set it,but it will run when you doubleclick the file,and when you preview.Plus it is only the one screensaver.That's baffling. :confused:
It should not be blocked by teatimer(if that is active),because when you preview bubbles.scr process would run.Unless teatimer is shutting it down after the process starts.Or another security program perhaps.Did the bubbles stay there when you doubleclicked the file for a bit,or did the bubbles appear,and then quickly stop without you moving the mouse or touchpad?

Also,could you open the Spybot 1.6 version,click Mode,then select Advanced Mode,then click Tools.Make sure that Resident is checkmarked in the right pane and then click Resident in the left pane.Let me know if there is a checkmark by Resident "teatimer." There's a picture available on this website. :)
http://images.malwarehelp.org/TTIMER/MHoTT004.gif

Also,for future reference,just in case,have you ever used regedit?

[gigglepot]

Hi, yes the bubbles stayed for a bit, until I closed it down (not just a few seconds).
Yes, Resident is check marked.
Yes, there is a check mark beside Resident "teatimer".
Yes, I've used regedit but only when someone was telling me what to do in there (I had an issue a little while ago and OCD from Spybot helped me out!).

[Zenobia]

Okay,the bubbles staying for a bit should mean it isn't teatimer.

If you feel relatively confident about it,I have a page you can follow to try to set Bubbles via the registry.However,if you're feeling a bit unsure about it then please don't,that's no problem,the registry can be tricky. :)
If you do decide to try setting Bubbles via the registry,then please follow this page to back up your registry first:
http://pcsupport.about.com/od/windows7/ht/backup-registry-windows-7.htm
Once that is done,then please scroll down this page to Option Three and follow the instructions to set Bubbles through the registry:
http://www.sevenforums.com/tutorials/2109-screen-saver-change.html
When you get to number 5,this is the full path that you need to type in:
C:\Windows\System32\Bubbles.scr
Continue right down until you get to number 9.
If you do use this method and have any problems with the instructions or any questions,please ask.

[gigglepot]

Hi, I actually had the courage to edit the registry but it still didn't work! No bubbles, after the minute is up, it just takes me to the password sign in page to access the computer. So I went back in to the registry to maybe try again and noticed the full path you told me to type in was missing! So I retyped it in, hit "OK" and exed out again. Went back in and it's not there......it's as if it won't save that path I keep typing in!

[Zenobia]

Don't worry,it's nothing you did wrong,it's just that for some reason,that registry change won't stay.
And in that case,I think it might be a good idea to look at a teatimer logfile,just in case. :)
Down beside your computer clock,you should see an icon with a padlock on it,like the one in this image when you click on it,beside the umbrella:
12205
Rightclick that icon and select Show log.Once notepad opens,go to Edit,select Select All,then rightclick somewhere within notepad and select Copy,then return here and in a reply rightclick and select Paste to show me the Teatimer logfile.

For the password login screen,if you would rather not have that then rightclick somewhere on your desktop,select Personalize,then Screensaver.If there is a checkmark beside "On resume,display login screen",then uncheck it,click Apply,then Ok.

[gigglepot]

Hi, here is the Teatimer logfile:

5/16/2015 7:13:38 AM Denied (based on user decision) value "FlashPlayerUpdate" (new data: "C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_17_0_0_169_Plugin.exe -update plugin") added in System Startup user entry!
05/17/2015 10:02:43 AM Denied (based on user decision) value "scrnsave.exe" (new data: "C:\Windows\system32\Bubbles.scr") added in Desktop settings!
05/17/2015 10:02:54 AM Denied (based on user blacklist) value "scrnsave.exe" (new data: "C:\Windows\system32\Bubbles.scr") added in Desktop settings!
05/17/2015 10:02:59 AM Denied (based on user blacklist) value "scrnsave.exe" (new data: "C:\Windows\system32\Bubbles.scr") added in Desktop settings!
05/17/2015 11:01:23 PM Denied (based on user blacklist) value "scrnsave.exe" (new data: "C:\Windows\system32\Bubbles.scr") added in Desktop settings!
05/18/2015 10:38:46 PM Denied (based on user blacklist) value "scrnsave.exe" (new data: "C:\Windows\system32\Bubbles.scr") added in Desktop settings!
05/19/2015 9:08:36 AM Denied (based on user blacklist) value "scrnsave.exe" (new data: "C:\Windows\system32\Bubbles.scr") added in Desktop settings!
05/19/2015 9:31:21 AM Denied (based on user blacklist) value "scrnsave.exe" (new data: "C:\Windows\system32\Bubbles.scr") added in Desktop settings!
05/19/2015 9:32:28 AM Denied (based on user decision) value "Sidebar" (new data: "C:\Program Files\Windows Sidebar\sidebar.exe /autoRun") added in System Startup user entry!
05/19/2015 9:33:52 AM Denied (based on user blacklist) value "scrnsave.exe" (new data: "C:\Windows\system32\Bubbles.scr") added in Desktop settings!
05/19/2015 9:40:12 AM Allowed (based on user decision) value "scrnsave.exe" (new data: "C:\Windows\system32\ssText3d.scr") added in Desktop settings!
05/19/2015 9:40:32 AM Denied (based on user blacklist) value "scrnsave.exe" (new data: "C:\Windows\system32\Bubbles.scr") changed in Desktop settings!
05/19/2015 9:41:12 AM Allowed (based on user decision) value "scrnsave.exe" (new data: "C:\Windows\system32\scrnsave.scr") changed in Desktop settings!
05/19/2015 9:41:18 AM Denied (based on user blacklist) value "scrnsave.exe" (new data: "C:\Windows\system32\Bubbles.scr") changed in Desktop settings!
05/19/2015 9:49:14 AM Allowed (based on user decision) value "scrnsave.exe" (new data: "") deleted in Desktop settings!
05/20/2015 6:49:57 AM Denied (based on user blacklist) value "scrnsave.exe" (new data: "C:\Windows\system32\Bubbles.scr") added in Desktop settings!
05/21/2015 12:38:14 PM Allowed (based on user decision) value "scrnsave.exe" (new data: "C:\Windows\system32\Ribbons.scr") added in Desktop settings!
05/21/2015 9:14:34 PM Allowed (based on user whitelist) value "scrnsave.exe" (new data: "") deleted in Desktop settings!
05/21/2015 11:16:33 PM Allowed (based on user decision) value "scrnsave.exe" (new data: "C:\Windows\system32\Ribbons.scr") added in Desktop settings!
05/22/2015 6:47:33 AM Allowed (based on user whitelist) value "scrnsave.exe" (new data: "") deleted in Desktop settings!
05/22/2015 8:42:06 PM Denied (based on user blacklist) value "scrnsave.exe" (new data: "C:\Windows\system32\Bubbles.scr") added in Desktop settings!
5/23/2015 7:07:19 AM Denied (based on user blacklist) value "FlashPlayerUpdate" (new data: "C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_17_0_0_169_Plugin.exe -update plugin") added in System Startup user entry!
5/23/2015 7:07:21 AM Denied (based on user blacklist) value "FlashPlayerUpdate" (new data: "C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_17_0_0_169_Plugin.exe -update plugin") added in System Startup user entry!
5/25/2015 6:20:01 PM Allowed (based on user decision) value "20150107" (new data: "C:\Program Files\AVAST Software\Avast\setup\emupdate\1e158860-ddb6-4c91-9dcb-5a032e286ccb.exe /check") added in System Startup global entry!
5/26/2015 6:38:39 AM Allowed (based on user decision) value "20150107" (new data: "") deleted in System Startup global entry!
5/27/2015 1:19:30 PM Allowed (based on user whitelist) value "scrnsave.exe" (new data: "") added in Desktop settings!
5/27/2015 1:20:13 PM Denied (based on user blacklist) value "scrnsave.exe" (new data: "C:\Windows\System32\Bubbles.scr") changed in Desktop settings!
05/27/2015 1:25:25 PM Denied (based on user blacklist) value "scrnsave.exe" (new data: "C:\Windows\system32\Bubbles.scr") changed in Desktop settings!
05/27/2015 1:28:25 PM Denied (based on user blacklist) value "scrnsave.exe" (new data: "C:\Windows\System32\Bubbles.scr") changed in Desktop settings!
05/27/2015 1:28:49 PM Denied (based on user blacklist) value "scrnsave.exe" (new data: "C:\Windows\System32\Bubbles.scr") changed in Desktop settings!
05/27/2015 1:52:11 PM Allowed (based on user whitelist) value "scrnsave.exe" (new data: "") deleted in Desktop settings!

[gigglepot]

Oh, I read some of the logfile and although I'm not sure what most of it means, I noticed it says "Bubbles screen saver added" so many times. I think this is because I usually have the screensaver on all day but then in the evening I take it off (just so I can see my emails as they come in from the comfort of my couch!) and then before bed I put it back to screensaver again.

[Zenobia]

That's it,actually.Bubbles is blacklisted.Well,that's easy enough. :)
Please follow this page to open the Black & White list for Teatimer:
https://www.safer-networking.org/faq/how-do-i-edit-the-blacklist-whitelist-in-resident-teatimer/
I think bubbles would be a registry change,so click on Blocked Registry Changes.Look through for scrnsave.exe and/or Bubbles.scr,and please click the X to all of those,if there is more than one.Check Blocked Processes,too,just in case,and remove any instances of scrnsave.exe and/or Bubbles.scr,,say Yes to any prompts,then click OK.

Rightclick somewhere on your desktop,select Personalize,then go in and set Bubbles as your screensaver,then click Apply.If a box comes up asking you to Allow or Deny a change,and it says scrnsave.exe or anything about Bubbles.scr,then that is teatimer.You should Allow the change,and it would be best to make sure that Remember this decision is not checked.Please let me know how it goes.

[gigglepot]

I can't find this part "Resident icon in the system tray Spybot-SD Resident" to right click and choose Settings. When I opened Spybot the little icon for Resident is on the left hand pane but I can't right click on it. Am I even in the right spot?

[Zenobia]

Nope,you aren't.You don't need to open Spybot,there will be a little blue and white thing with a tiny padlock on it down by your computer clock.There's an image of it available here. :)
http://support.moonpoint.com/security/spyware/spybot/teatimer/ResHacker/TeaTimer-Exit.jpg
If not visible,then click the little arrow pointing upwards,as shown here,and then Teatimer should be in the upper little window above Customize:
http://www.simplehelp.net/images/win7_tray/img01.png

[gigglepot]

Woooohoooo! It worked!!! Bubbles are back! Thank you so much!!!!! All done, you can now put "solved" on my original question. Thank you so much for helping me Zenobia! Love Spybot's customer service :o) :o) :o)

[Zenobia]

You're welcome,glad it worked. :)

Once you decide which version of Spybot you would like to keep,it might be best to uninstall the other one to avoid confusion.When/if you decide to do that,you can uninstall by going to Start,Control Panel,then clicking Uninstall a Program,and the versions of Spybot will be listed in there.

[gigglepot]

Thank you, I will do that. But is there anything major that I am missing out on if I just keep using Spybot 1.6.2? I just seem to like that version a lot better.

[Zenobia]

It's up to you.If you prefer Spybot 1.6.2,you can stick with that if you wish. :)
If you're curious about the newer Spybot,they're a couple years old,but there are some videos here:
https://www.youtube.com/user/SaferNetworking/videos