"Deny change" option greyed out after BHO shows up uninvited

Printable View

2013-07-15, 00:11
joestrike

"Deny change" option greyed out after BHO shows up uninvited

Okay, I'm a first time poster, came here for help with something that just happened a minute ago:

My computer stopped dead, went black so I started it up again. When it came back there was a Spybot-S&D box onscreen:

"Spybot S&D has detected an important registry entry that has been changed

Category: Browser Helper Object
Change: Value detected

Entry: {F9E4A054-E981-4BC3-83A3-76A1AE736170... [numbers appear to continue inside the box]

[greyed out] Old data:
[greyed out] New data:

[checkbox] Remember this decision.
[Allow change] [?] [Info] and the final box which is greyed out: [Deny change]

Not only is this last option greyed out, there's no 'X' in the upper right corner of the Spybot S&D box to cancel the box.

Anybody have any suggestions? I"m sure as hell not going to click on "Allow Change," at least not right now.

UPDATE:

My son just came over, opened the Task Manager and did an "End Process" that got rid of the Spybot S&D box that wouldn't close. Am I out of the woods with this thing now?

Thanx much!
2013-07-15, 03:10
Zenobia

If the Change would happen to be Value Deleted,instead of Value Detected,then this ought to apply:
http://forums.spybot.info/showthread...l=1#post251592

The first part of the numbers,if that is all of them,come up as this:
http://www.systemlookup.com/CLSID/56...IE_64_dll.html

Your teatimer logfile should show what was going on for sure,if you'd like to post it here. :)
Right click on the TeaTimer (Spybot-SD Resident) system tray icon and select Show Log.Highlight the portion of the log that you want to copy.
Right click and select Copy.Paste it here.
2013-07-19, 01:13
joestrike

I think this is the info you're asking for

Quote:

Originally Posted by Zenobia

If the Change would happen to be Value Deleted,instead of Value Detected,then this ought to apply:
http://forums.spybot.info/showthread...l=1#post251592

The first part of the numbers,if that is all of them,come up as this:
http://www.systemlookup.com/CLSID/56...IE_64_dll.html

Your teatimer logfile should show what was going on for sure,if you'd like to post it here. :)
Right click on the TeaTimer (Spybot-SD Resident) system tray icon and select Show Log.Highlight the portion of the log that you want to copy.
Right click and select Copy.Paste it here.

This is what I found in that log:

7/14/2013 11:25:41 AM Denied (based on user decision) value "{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}" (new data: "") added in Browser Helper Object!

It's there several dozen times, with the timestamp sometimes seconds apart, sometimes hours. The most recent one is from this morning at 11:28am

Think I said already that I can get the window to go away by going to Task Manager and selecting End Process, but whatever it is still shows up everytime I turn on my computer.

By the way, thanks so much for helping me on this.

-Joe
2013-07-19, 08:27
Zenobia

You're welcome. :)
Yes,that bho does match this:
http://www.systemlookup.com/CLSID/56...IE_64_dll.html
Is there a program called Hotspot Shield listed in your add/remove programs?Is that a program you're familiar with and knowingly installed?
2013-07-31, 13:59
joestrike

Quote:

Originally Posted by Zenobia

You're welcome. :)
Yes,that bho does match this:
http://www.systemlookup.com/CLSID/56...IE_64_dll.html
Is there a program called Hotspot Shield listed in your add/remove programs?Is that a program you're familiar with and knowingly installed?

(Sorry for my delay in responding; I've been on the road with a different laptop for the last week or so.) I don't see that program in my list of installed programs; would it be there under a different name?
2013-07-31, 16:51
Zenobia
No problem. :)
No,I don't believe Hotspot Shield goes by anything else.

Okay,I don't see this bho listed here,but Spybot does detect Anchor.hss in the Pups category,which is related to hotspot shield:

Quote:

Threat Details:

Categories:

pups

Description:
Anchor.Hss installs a tool which allows the user to surf the Internet anonymously and encrypt the data which is sent during the connection. But on every web page visited, there are banners shown and the user has to click on a banner sometimes.

http://forums.spybot.info/showthread...for-Anchor-Hss
This is what the Pups category is defined as:
http://www.safer-networking.org/faq/pups/

Since Hotspot shield is not a program you knowingly installed or use,you could run a scan with Spybot,and it might detect the bho (along with anything else related to Anchor.hss) and remove it for you,if you prefer that it be gone.
This is how to post a logfile if you have any questions about any of the results:
Produce a short log (showing items flagged)
- Open SpyBot.
- Check for problems.
- When the scan completes, right click on the results list, select "Copy results to clipboard".
- Paste (Ctrl+V) those results into a new post.