PDA

View Full Version : Spybot scan showing this (Can someone Help)



mudflap
2006-10-30, 21:20
The scan results show this:

HKEY_USERS\.DEFAULT\Software\new.net

marked in red but when I try to delete or quarantine it I fail.

Can someone help...

Best Regards Mudflap.

md usa spybot fan
2006-10-30, 21:32
It would be helpful if you posted the actual detection that you received as well as the version and update level of Spybot that you are running. The easies way to do that is:
Run another scan.
When the scan completes attempt to fix the problem.
After you attempt to fix the problem, right click on the results list and select "Copy results to clipboard".
Then paste those results (Ctrl+V) to a new post in this thread.

mudflap
2006-10-30, 22:07
Here's the results of the scan:

NewDotNet: User settings (Registry key, fixing failed)
HKEY_USERS\S-1-5-18\Software\new.net

NewDotNet: User settings (Registry key, fixing failed)
HKEY_USERS\.DEFAULT\Software\new.net


--- Spybot - Search && Destroy version: 1.3 ---
2006-10-27 Includes\Cookies.sbi
2006-10-13 Includes\Dialer.sbi
2006-10-13 Includes\Hijackers.sbi
2006-10-27 Includes\Keyloggers.sbi
2006-10-13 Includes\Malware.sbi
2006-10-27 Includes\Revision.sbi
2006-10-13 Includes\Security.sbi
2006-10-13 Includes\Spybots.sbi
2006-10-13 Includes\Trojans.sbi
2005-02-17 Includes\Tracks.uti
2004-11-29 Includes\LSP.sbi
2006-10-20 Includes\PUPS.sbi
2006-10-27 Includes\PUPSC.sbi
2006-10-27 Includes\TrojansC.sbi
2006-10-27 Includes\SpybotsC.sbi
2006-10-27 Includes\SecurityC.sbi
2006-10-27 Includes\MalwareC.sbi
2006-10-27 Includes\KeyloggersC.sbi
2006-10-27 Includes\HijackersC.sbi
2006-10-27 Includes\DialerC.sbi

md usa spybot fan
2006-10-30, 22:26
You are running Spybot-S&D 1.3 as I suspected from other posts concerning removal of new.net registry entries.

Unless you are running on a Windows 95 system, I suggest you try upgrading Spybot from Spybot-S&D 1.3 to Spybot-S&D 1.4 and that may solve the problem that you are having with the removal of the following detections:


NewDotNet: User settings (Registry key, fixing failed)
HKEY_USERS\S-1-5-18\Software\new.net

NewDotNet: User settings (Registry key, fixing failed)
HKEY_USERS\.DEFAULT\Software\new.net
********************

There are four (4) download sites for Spybot-S&D 1.4 here:
Mirror Selection – The home of Spybot–S&D!
http://www.safer-networking.org/en/mirrors/index.html

Uninstall Spybot-S&D 1.3: FAQ - Frequently Asked Questions
How to uninstall?
http://www.safer-networking.org/en/faq/27.htmlInstall Spybot-S&D 1.4:
Execute spybotsd14.exe download above.
Do not change the default installation path of:C:\Program Files\Spybot - Search & Destroy
Make sure that you update Sptbot-S&D 1.4 before running a scan.
********************

If upgrading to Spybot-S&D 1.4 fails to correct the problem, please post another reply to this thread and we'll try another solution.

********************

Note: If you upgrade from Spybot-S&D 1.3 to Spybot-S&D 1.4 and use TeaTimer be aware of the following:

There is currently a bug in TeaTimer 1.4. Portions of TeaTimer's popup dialog overlay the "Allow change" and "Deny change" buttons. On my system the very top edges of the "Allow change" button (on the left) and "Deny change" button (on the right) are showing and I am still able to select the options. I also can check "Remember this decision" since it is visible. If no portion of the "Allow change" and "Deny change" buttons are showing, you can answer TeaTimer's popup dialog (English language version) by pressing "A" on your keyboard for "Allow change" or "D" for "Deny change". Note: If you close the dialog without answering "Allow change" or "Deny change" the registry change is denied.

If you can't deal with the problem that way until it is fixed, you can:
Apply one of the workarounds found in the following pinned (Sticky) thread that fixes the pop-up dialog so the buttons are visible:
Solution to fix the pop-ups in TeaTimer
http://forums.spybot.info/showthread.php?t=122

There are three (3) fixes published in that thread. They are:


The ResHacker fix published by ElPiedra (http://forums.spybot.info/member.php?u=128) here:
http://forums.spybot.info/showpost.php?p=423&postcount=1
The murdo (http://forums.spybot.info/member.php?u=440) patch published here:
http://forums.spybot.info/showpost.php?p=775&postcount=9
Also republished by RuggeR29 (http://forums.spybot.info/member.php?u=7292) (which I have never tried) here:
http://www.fureyonline.com/downloads/patch.zip
The patch originally by SyreneD (http://forums.spybot.info/member.php?u=1735) that I published here:
http://forums.spybot.info/showpost.php?p=2670&postcount=38
Also republished by SyreneD (http://forums.spybot.info/member.php?u=1735) himself here:
http://forums.spybot.info/showpost.php?p=23575&postcount=125


Disable TeaTimer as follows:
Go into Spybot > Mode > Advanced Mode > Tools > Resident.
Uncheck the following:Resident "TeaTimer" (Protection of over-all system settings) Active.

********************

Notes about the patches (b. and c. above):
If you installed Spybot in the default location:
C:\Program Files\Spybot - Search & Destroy
The following patch (c.) defaults to that location:
The patch originally by SyreneD (http://forums.spybot.info/member.php?u=1735) that I published here:
http://forums.spybot.info/showpost.php?p=2670&postcount=38
Also republished by SyreneD (http://forums.spybot.info/member.php?u=1735) himself here:
http://forums.spybot.info/showpost.php?p=23575&postcount=125
If you use this patch (b.) you have to navigate to the correct location (See Note #1) unless you execute the patch from within the "C:\Program Files\Spybot - Search & Destroy" folder:
The murdo (http://forums.spybot.info/member.php?u=440) patch published here:
http://forums.spybot.info/showpost.php?p=775&postcount=9
Also republished by RuggeR29 (http://forums.spybot.info/member.php?u=7292) (which I have never tried) here:
http://www.fureyonline.com/downloads/patch.zip

Note# 1: To the right of the Target File (TeaTimer.exe) there is a button that looks like "[ . . . ]". Click on that button, navigate to the correct folder, click "Open" and then "Start".

mudflap
2006-10-31, 00:32
Thanks very much md usa spybot fan

After following the install outlined by you and doing a full scan I have deleted the problem and everything looks a ok

Best Regards Mudflap..........

:bigthumb: :bigthumb: :bigthumb: