S&D repeats

[FancyBamboo]

Every time I do a Search & Destroy, the same items appear in red. How can I eliminate these items permanently so they're "spying" in between times I run S&D?

[md usa spybot fan]

FancyBamboo:

Please post the actual detections you are getting. To do that:
Run another scan.
When the scan completes, right click on the results list, select "Copy results to clipboard".
Then paste those results to a new post in this thread.
Thanks

[FancyBamboo]

I "fixed" the problems late yesterday, so all my normal "problems" don't appear now. Here are those that do, all red:

advertising.com
avenue a, inc.
doubleclick
windows security center.antivirusdisablenotify
windows security center.firewalldisablenotify

Thanks for your consideration.

FancyBamboo

[md usa spybot fan]

Advertising.com, Avenue A, Inc. and DoubleClick are tracking cookies. I could tell you how to prevent them from reoccurring if you had provided the actual log as requested rather than summarize it, because I would have know what browser you are using (as well as the version of Spybot you are running and the update level).

The other two problems are due to setting within the Windows Security Center which may or not be a problem depending on what other security software you are running.

I would appreciate it if you would post the actual log as requested rather than summarize it. In addition please list the other anti-virus and/or anti-malware programs you are running (McAfee, Norton, etc.).

**************

If the problems that you are interested in are not in the current scan log, you can post an older log from a previous "Check for problems" or "Fix selected problems".

By default here are two Checks.yymmdd-hhmm logs produced during a scan. The second Checks.yymmdd-hhmm has the details of what the scan found. A Fixes.yymmdd-hhmm log is produced if you fix or attempt to fix something.

Two methods to copy that information:
Method 1:
Go into Spybot > Mode > Advanced mode > Tools > View Reports > View Pervious reports. Look for the Checks.yymmdd-hhmm.log file or Fixes.yymmdd-hhmm.log file that contains the detections that you like to me to help you with. Open it. To copy it to the Clipboard, right click on the listing and select Select All > Right click again and select Copy. Paste the contents of the Clipboard into a new post in this thread.
Method 2
The Checks.yymmdd-hhmm.log and Fixes.yymmdd-hhmm.log files are stored in the following folders:
Windows 95 or 98:
C:\Windows\Application Data\Spybot - Search & Destroy\Logs
Windows ME:
C:\Windows\All Users\Application Data\Spybot - Search & Destroy\Logs
Windows NT, 2000 or XP:
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Logs
Using Windows Explorer, navigate to the correct Checks.yymmdd-hhmm.log file or Fixes.yymmdd-hhmm.log. Double click on it and it should open with Notepad. To copy it to the Clipboard, right click on the listing and select Select All > Right click again and select Copy. Paste the contents of the Clipboard into a new post in this thread.

[FancyBamboo]

Here's a report "as requested." :blush: Thanks A LOT. Stefanie

--- Report generated: 2006-09-11 20:20 ---

Windows Security Center.AntiVirusDisableNotify: Settings (Registry change, fixed)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify!=dword:0

Windows Security Center.FirewallDisableNotify: Settings (Registry change, fixed)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify!=dword:0

FastClick: Tracking cookie (Internet Explorer: Stefanie Kott) (Cookie, fixed)


ValueClick: Tracking cookie (Internet Explorer: Stefanie Kott) (Cookie, fixed)


MediaPlex: Tracking cookie (Internet Explorer: Stefanie Kott) (Cookie, fixed)


Avenue A, Inc.: Tracking cookie (Internet Explorer: Stefanie Kott) (Cookie, fixed)


Advertising.com: Tracking cookie (Internet Explorer: Stefanie Kott) (Cookie, fixed)


FastClick: Tracking cookie (Internet Explorer: Stefanie Kott) (Cookie, fixed)


DoubleClick: Tracking cookie (Internet Explorer: Stefanie Kott) (Cookie, fixed)


Adviva: Tracking cookie (Internet Explorer: Stefanie Kott) (Cookie, fixed)


WebTrends live: Tracking cookie (Internet Explorer: Stefanie Kott) (Cookie, fixed)


HitBox: Tracking cookie (Internet Explorer: Stefanie Kott) (Cookie, fixed)


HitBox: Tracking cookie (Internet Explorer: Stefanie Kott) (Cookie, fixed)



--- Spybot - Search & Destroy version: 1.4 (build: 20050523) ---

2005-05-31 blindman.exe (1.0.0.1)
2005-05-31 SpybotSD.exe (1.4.0.3)
2005-05-31 TeaTimer.exe (1.4.0.2)
2006-08-16 unins000.exe (51.41.0.0)
2005-05-31 Update.exe (1.4.0.0)
2006-02-06 advcheck.dll (1.0.2.0)
2005-05-31 aports.dll (2.1.0.0)
2005-05-31 borlndmm.dll (7.0.4.453)
2005-05-31 delphimm.dll (7.0.4.453)
2005-05-31 SDHelper.dll (1.4.0.0)
2006-02-20 Tools.dll (2.0.0.2)
2005-05-31 UnzDll.dll (1.73.1.1)
2005-05-31 ZipDll.dll (1.73.2.0)
2006-09-08 Includes\Cookies.sbi (*)
2006-09-08 Includes\Dialer.sbi (*)
2006-09-08 Includes\Hijackers.sbi (*)
2006-09-08 Includes\Keyloggers.sbi (*)
2006-09-08 Includes\Malware.sbi (*)
2006-09-08 Includes\PUPS.sbi (*)
2006-09-08 Includes\Revision.sbi (*)
2006-09-08 Includes\Security.sbi (*)
2006-09-08 Includes\Spybots.sbi (*)
2005-02-17 Includes\Tracks.uti
2006-09-08 Includes\Trojans.sbi (*)

[FancyBamboo]

I'm running McAfee....

[md usa spybot fan]

Windows Security Center detections.


Windows Security Center.AntiVirusDisableNotify: Settings (Registry change, fixed)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify!=dword:0

Windows Security Center.FirewallDisableNotify: Settings (Registry change, fixed)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify!=dword:0
If you go into Start > Control Panel > Security Center > Resources (on the left hand side of the window – expand if necessary) > click "Change the way Security Center alerts me". This brings up an "Alert Setting" window.

There are three possible alerts:
Firewall
Alert me if my computer might be at risk because of my firewall settings
Automatic Updates
Alert me if my computer might be at risk because of my Automatic Updates settings
Virus Protection
Alert me if my computer might be at risk because of my virus protection software settings

I believe that you will find that the first and third items are unchecked.

When you installed McAfee SecurityCenter, you probably chose it as the default Security Center. When you do that McAfee SecurityCenter turns off these alerts in the Windows Security Center. If you reset the alerts, McAfee SecurityCenter will turn them off again when you re-boot the system as long as it is the default Security Center.

I personally have McAfee SecurityCenter and it is not set up to be the default Security Center. By allowing Windows Security Center to monitor both my firewall and anti-virus, I do not get the detections in Spybot and more importantly Windows Security Center notifies me immediately if either my firewall or anti-virus are disabled.

I have never found a way to stimulate McAfee SecurityCenter into allowing you to removing it as the default Security Center. However, if you ever have to reinstall McAfee SecurityCenter, I suggest that you consider not choosing it as the default Security Center. That way Windows will notify you if either McAfee anti-virus or your firewall are inactivated.

To prevent Spybot from detecting these problems, go into Spybot > Mode > Advanced mode > Settings > Ignore products. Click on the Security.sbi tab. Expand the width of the Product column so that you can see the entire text of the entries by grabbing the divider between the Product and Details columns and sliding it to the right.

Check the following entries:
Windows Security Center.AntiVirusDisableNotify
Windows Security Center.FirewallDisableNotify
Blocking Tracking Cookies.

In Internet Explorer you can block the same Tracking Cookies that Spybot detects by enabling Spybot's Browser Helper Object (BHO). To do this go into Spybot-S&D > Immunize. Look in the last section labeled "Permanently running bad download blocker for Internet Explorer". Check the following:Enable permanent blocking of bad addresses in Internet Explorer

There is another way to prevent the storing of Tracking Cookies in Internet Explorer (even those not blocked by Spybot's resident BHO) as well as the storing of Tracking Cookies in other WEB browsers. See:
Why do other anti-spyware applications detect so many more tracking cookies?
http://www.safer-networking.org/index.php?page=faq&detail=37

[FancyBamboo]

Thank you so much for such clear instructions. I've been able to make all the fixes. Just to let you know, tho, that Enable permanent blocking of bad addresses in Internet Explorer was already checked.

About McAfee. Interestingly enough, several times when I first boot, I've been offered the option to choose it as my default Security Center. Which means something is causing it to force me to make a choice.

I've chosen YES whenever that happens, because I had no idea what else to do. NOW if I get the chance, I won't check the box. But I don't know when or if I'll see that option again.

I'll let you know if I'm not okay in a few days, but all the fixes make lots of sense. Again, thanks.

May I ask: What are the best settings for someone (like me) who would like SpyBot to be forever alert?

Stefanie

[md usa spybot fan]

Stefanie:


About McAfee. Interestingly enough, several times when I first boot, I've been offered the option to choose it as my default Security Center. Which means something is causing it to force me to make a choice.

I've chosen YES whenever that happens, because I had no idea what else to do.
I think that it is a shame that the don't inform you up front that by choosing the McAfee SecurityCenter as the default Security Center that they are going to disable features of the Windows Security Center. In fact I can no longer find any information in the help facility of the latest rendition of the McAfee SecurityCenter about the option.

[FancyBamboo]

I think you'll find this interesting. I asked McAfee (Live Help) if I can disable McAfee as my default security center and got this response:

"McAfee SecurityCenter manages all the McAfee programs. This needs to be the default SecurityCenter to make sure you get the updates for McAfee, else the McAfee programs might not work properly. So I would recommend you please keep McAfee SecurityCenter as your default SecurityCenter."

Then I told him that at startup I am sometimes asked if I want to use McAfee as my default center and he said:

"It seems that you have not disabled the window SecurityCenter properly that's the reason you are facing this issue."

He told me how to fix it:

"Click on Start---> Click on Run----> type services.msc. In the resulting window scroll down to Security Center and double-click on it. In the "Startup type:" box use the arrow to scroll down to choose "Disabled" click Apply and reboot, or, click Apply and click the button that says Stop."

I did NOT do that, because I'd like to know your opinion. Should I do that fix?

(And thanks again for everything.)

[md usa spybot fan]

I personally recommend that you do not shutdown Windows Security Center.