I keep finding the same list of spyware (even after removing them "successfully")

Hello,

I am running SB 1.4 about once every week or ten days. I discovered that I keep getting a similar list of threats every time. Most interestingly:
I am able to remove them all (getting the green check mark), however if I run the scan again immediately after that I get the same list. I went through this loop three or four times once, i.e., finding the list of spyware, removing them, running the scan again immediately after that, to find again the same list.

Has anybody else experienced something like this? It took me a while to find this out because since I was running the scan on a weekly (or so) basis, the number of threats that I found (around 30) seemed to be reasonable. Until one day, since I kept finding the same number, it occurred to me to run the scan again.

Please let me know if there is any other info that I could provide to help track this problem.

Many thanks

Quote:

---

Originally Posted by astor

Please let me know if there is any other info that I could provide to help track this problem.

---

The next time that you run a scan or scan/fix/scan that shows "… a similar list of threats", right click on the results list, select "Copy results to clipboard" then paste those results to a new post in this thread. With that information maybe someone can help explain what is going on.

Thanks for answering. I just ran the scan again, and these are the results of the scan.

__________________________________________________________


Advertising.com: Tracking cookie (Firefox: default) (Cookie, nothing done)


Advertising.com: Tracking cookie (Firefox: default) (Cookie, nothing done)


Advertising.com: Tracking cookie (Firefox: default) (Cookie, nothing done)


Advertising.com: Tracking cookie (Firefox: default) (Cookie, nothing done)


Avenue A, Inc.: Tracking cookie (Firefox: default) (Cookie, nothing done)


BFast: Tracking cookie (Firefox: default) (Cookie, nothing done)


DoubleClick: Tracking cookie (Firefox: default) (Cookie, nothing done)


HitBox: Tracking cookie (Firefox: default) (Cookie, nothing done)


HitBox: Tracking cookie (Firefox: default) (Cookie, nothing done)


HitBox: Tracking cookie (Firefox: default) (Cookie, nothing done)


HitBox: Tracking cookie (Firefox: default) (Cookie, nothing done)


HitBox: Tracking cookie (Firefox: default) (Cookie, nothing done)


HitBox: Tracking cookie (Firefox: default) (Cookie, nothing done)


HitBox: Tracking cookie (Firefox: default) (Cookie, nothing done)


FastClick: Tracking cookie (Firefox: default) (Cookie, nothing done)


FastClick: Tracking cookie (Firefox: default) (Cookie, nothing done)


FastClick: Tracking cookie (Firefox: default) (Cookie, nothing done)


HitBox: Tracking cookie (Firefox: default) (Cookie, nothing done)


HitBox: Tracking cookie (Firefox: default) (Cookie, nothing done)


MediaPlex: Tracking cookie (Firefox: default) (Cookie, nothing done)


MediaPlex: Tracking cookie (Firefox: default) (Cookie, nothing done)


HitBox: Tracking cookie (Firefox: default) (Cookie, nothing done)


ValueClick: Tracking cookie (Firefox: default) (Cookie, nothing done)


ValueClick: Tracking cookie (Firefox: default) (Cookie, nothing done)


ValueClick: Tracking cookie (Firefox: default) (Cookie, nothing done)


Advertising.com: Tracking cookie (Firefox: default) (Cookie, nothing done)


WebTrends live: Tracking cookie (Firefox: default) (Cookie, nothing done)


WebTrends live: Tracking cookie (Firefox: default) (Cookie, nothing done)



--- Spybot - Search & Destroy version: 1.4 (build: 20050523) ---

2005-05-31 blindman.exe (1.0.0.1)
2005-05-31 SpybotSD.exe (1.4.0.3)
2005-05-31 TeaTimer.exe (1.4.0.2)
2004-04-27 unins000.exe (51.13.0.0)
2006-01-10 unins001.exe (51.41.0.0)
2005-05-31 Update.exe (1.4.0.0)
2005-05-31 advcheck.dll (1.0.2.0)
2005-05-31 aports.dll (2.1.0.0)
2005-05-31 borlndmm.dll (7.0.4.453)
2005-05-31 delphimm.dll (7.0.4.453)
2005-05-31 SDHelper.dll (1.4.0.0)
2005-05-31 Tools.dll (2.0.0.2)
2005-05-31 UnzDll.dll (1.73.1.1)
2005-05-31 ZipDll.dll (1.73.2.0)
2006-02-10 Includes\Cookies.sbi (*)
2006-02-10 Includes\Dialer.sbi (*)
2006-02-10 Includes\Hijackers.sbi (*)
2006-02-10 Includes\Keyloggers.sbi (*)
2004-11-29 Includes\LSP.sbi (*)
2006-02-10 Includes\Malware.sbi (*)
2004-08-11 Includes\plugin-ignore.ini
2006-02-10 Includes\PUPS.sbi (*)
2006-02-10 Includes\Revision.sbi (*)
2006-02-10 Includes\Security.sbi (*)
2006-02-10 Includes\Spybots.sbi (*)
2005-02-17 Includes\Tracks.uti
2006-02-10 Includes\Trojans.sbi (*)

All of the detections that you are repetitively finding seem to be tracking cookies. Tracking cookies are third-party cookies and track users cross domain (site to site) profiling the user's surfing habits. If any transaction occurs where the user gives any personal info, then the tracking becomes personally identifiable. While tracking cookies may not be as insidious as some other malware, they are definitely spies.

You can block all tracking cookies in your browser. The following article explains how to block them:

• Why do other anti-spyware applications detect so many more tracking cookies?
  http://www.safer-networking.org/en/faq/37.html

However there appears that some third-party cookies may not be blocked in Firefox by setting the options in the above article. Please see the comments by Zenobia in last post of the following thread:

• Avenue A
  http://forums.spybot.info/showthread.php?t=631

Thanks for the answer.

I understand that these are relatively harmless. However, if SB removes them, and I run SB immediately after that, why are they found again if in between I didn't even open Firefox? What brought them back to my computer if they browser is inactive? Or is it that they never left?

I am asking because a while ago I had a similar problem, SB started telling me that it found no threats, and I got the green check mark every time. I thought that it was highly unlikely that I didn't get any cookie or spyware for many weeks, while my computer was being heavily used. So I uninstalled and installed back SB and, sure enough, this time I found over a hundred results. It was as if some other program sitting between my computer and SB, telling it that everything was OK.

Thanks.
Daniel

Well, I'm pretty late to get to you upon this astor but the spybot version has immunize, use that to block it off so you won't get it again.

Hello,

I am sorry, but this is not correct.

The Immunization does not work for Firefox, it is only for the Internet Explorer. ActiveX isn't supported by Firefox, so there is no need for protection there.
Maybe in one of the coming versions there will be a bad download blocker for Firefox, but not at the moment.

Here is a thread in our forum that deals with the same problem:
http://forums.spybot.info/showthread.php?t=3008

If you don't have any other cookies you want to save in Firefox,you could click the Remove All Cookies button. This would be easiest, but don't do it if you have any cookies you want to keep.

If you do have other cookies in Firefox you want to keep, could remove the cookies manually from within Firefox. To do so go to Tools->Options->click the Cookies tab, then click the View Cookies button.
Looking off the Spybot report, scroll through the list to find the tracking cookie(s), then click on the tracking cookie with your mouse, and then click on the remove cookie(s) button.

Or you could try doing another scan with Spybot and see if it removes the tracking cookies this time (though it might not work, but you could try and see).

There's an article here, showing how to block third party cookies.
http://www.spybot.info/en/faq/37.html

It is also recommendable to use SpywareBlaster also, which has an option to Prevent ad/tracking cookies in firefox.
http://www.javacoolsoftware.com/spywareblaster.html

Best regards
Sandra
Team Spybot

oh yeah, i just found out, it reappear again. I guess the surest way is go to tools, options, privacy tab and add the website to the block list so that it will be constantly block the cookies you don't want. I mean if you remove cookies, they will eventually pop up again because its not block. Just head to Spybot and check the list and add in the sites to block list and you're fine