Scanning multiple accounts in XP

[techols]

I am using Spybot S&D 1.4 with Windows XP Media Edition, and have created Windows accounts for each of my family members (total of 4). My account is the computer administrator. If I scan from the admin account, does Spybot look at ALL user account areas?

[md usa spybot fan]

The entire system is scanned for most malware. However, because of restrictions in the Microsoft APIs (Application Program Interfaces) used by Spybot, the scan from one account does not include the Internet cache or cookies of other accounts.

[techols]

Thanks for the quick reply. I was hoping (and suspected) that was the case but I have some other tools that only look at the active user, and it is a pain to log in clean up each account separately. Just wanted to be sure.

[sillared]

This seems like a good thread to ask this question in...

So, I have multiple users under machines with xp pro and home... I install Spybot under one user, and it shows up under everybodies program files, which is good.. But, how do I get it to actively scan each users activities realtime like it does under the account that I installed Spybot under? Aka, theres no spybot icon in the taskbar? Can this be done without installing spybot repeatedly under each users account?

[md usa spybot fan]

sillared:

The startup entry for TeaTimer is normally stored in the HKEY_CURRENT_USER registry hive as follows:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="C:\\Program Files\\Spybot - Search & Destroy\\TeaTimer.exe"

Therefore TeaTimer must be activated individually for each user account where you want it to run. To activate TeaTimer in the other user accounts:

• Logon to that account.
• Go into Spybot > Mode > Advanced Mode > Tools > Resident
  • Check (if unchecked) the following:
    Resident "TeaTimer" (Protection of over-all system settings) Active.

[sillared]

Thanks man, that is all too easy!

[Electron1948]

I am using Spybot S&D 1.4 with Windows XP Media Edition, and have created Windows accounts for each of my family members (total of 4). My account is the computer administrator. If I scan from the admin account, does Spybot look at ALL user account areas?

It too wondered this. Today I've been cleaning an XP Home system for a friend. I ran SB as Administrator in Safe Mode - everything found was cleared. Then by chance I found that by running SB again, logged in as a user in normal mode, more infections were found. The system was not connected to any network during all this

I then ran SB while logged in as each user in turn and got the following results:

User 1: 123 infections
User 2: 78 infections
User 3: 65 infections

There were many common items between the three users but SB did managed to clear all items from all users.

Is this normal? I've always believed that running as Administrator cleared all accounts but plainly not under V1.4. Any suggestions anyone?

[md usa spybot fan]

Electron1948:

... Then by chance I found that by running SB again, logged in as a user in normal mode, more infections were found. ... Is this normal? I've always believed that running as Administrator cleared all accounts but plainly not under V1.4. Any suggestions anyone?

That depends on the nature of the "infections". As I tried to indicated:

The entire system is scanned for most malware. However, because of restrictions in the Microsoft APIs (Application Program Interfaces) used by Spybot, the scan from one account does not include the Internet cache or cookies of other accounts.

If you care to review the logs of various scans/fixes and see what the "infections" were and then ask specific questions concerning the particular detections that disturb you, there are a couple methods to do that.

Please note: By default here are two Checks.yymmdd-hhmm.log files produced during a scan. The second Checks.yymmdd-hhmm.log has the details of what the scan found. A Fixes.yymmdd-hhmm.log file is produced if you fix or attempt to fix something.

To review and/or post Checks.yymmdd-hhmm.log or Fixes.yymmdd-hhmm.log files:

• Method 1:
  
  • Go into Spybot > Mode > Advanced mode > Tools > View Reports > View Previous reports. Look for the Checks.yymmdd-hhmm.log or Fixes.yymmdd-hhmm.log file that contains the detections that you like help with. Open it. To copy it to the Clipboard, right click on the listing and select Select All > Right click again and select Copy. Paste (Ctrl+V) the contents of the Clipboard into a new post in this thread.
• Method 2
  
  • The Checks.yymmdd-hhmm.log and Fixes.yymmdd-hhmm.log files are stored in the following folders:
    
    • Windows 95 or 98:
      C:\Windows\Application Data\Spybot - Search & Destroy\Logs
    • Windows ME:
      C:\Windows\All Users\Application Data\Spybot - Search & Destroy\Logs
    • Windows NT, 2000 or XP:
      C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Logs
    • Windows Vista:
      C:\ProgramData\Spybot - Search & Destroy\Logs
  • Using Windows Explorer, navigate to the correct Checks.yymmdd-hhmm.log or Fixes.yymmdd-hhmm.log file. Double click on it and it should open with Notepad. To copy it to the Clipboard, right click on the listing and select Select All > Right click again and select Copy. Paste (Ctrl+V) the contents of the Clipboard into a new post in this thread.

[Electron1948]

Thanks md usa spybot fan,

I'll have to bear your response in mind for next time as the cleaned PC has gone back to the friend and it won't be easy to carry out the reviews you suggest.

You've provided some helpful input and I'm a big fan of SB and will continue to sing it's praises whenever possible.

Thanks,
Electron1948