S & D False alarm or do I have a spy?

MERRICKMERRICK In the studio or on a stage
edited December 2004 in Science & Tech
I've ran S & D a few times and I get the same alert (Pic 1). The thing is, It looks like it's a false alarm because I went into the registry and the settings are the same for all the other protected entries (?)


Then when I click to fix the problem I get this message:(pic 2)

So I allow S & D to do a scan on the reboot, when done, the screen colors are very weird, it says it's found 50 problems and there is a box that says "Wrong Parameters" or something like that which I can't get rid of without closing S & D in the running processes menu.


Any advice?

Comments

  • CrunchieCrunchie Mandurah. Western Australia. Member
    edited November 2004
    Download CWShredder from here and run it. Select the fix button & it will fix everything related to CoolWebSearch that is stored in it's database. Close ALL windows, including Internet Explorer, before running CWShredder. Reboot.

    To help prevent this from happening again, install the patches for the vulnerabilities that this hijacker exploits by going here for your critical updates.

    Reboot. Run Spybot again if CWShredder found anything and see if it still finds those entries.
  • MERRICKMERRICK In the studio or on a stage
    edited November 2004
    Did as you say, CWShredder found: CWS.HiddenDll. but spybot reported the same problems after reboot (though CW Shredder says all is now well).

    I'm still not convinced that this is a problem (?) since the S & D entries match the other reg immunizations form spyware-shooter, spyware blaster and S & D.

    As far as Microsoft patches, I don't do auto update. Do you have a link to where I can download patches? I'm current up to MS04-038.
  • LeonardoLeonardo Wake up and smell the glaciers Eagle River, Alaska Icrontian
    edited November 2004
    You don't have to do the MS updates automatically. At the MS updates page, just select the "Custom Install" link. You can then pick and choose the exact available updates you want to download and install.
  • MERRICKMERRICK In the studio or on a stage
    edited November 2004
    Thanks Leonardo, After doing a double check I see that I am up to date on the MS fixes. I wish Spyware-Shooter was around to confirm or refute my theory. I'll dig a little further but if anyone following this thread has the same S & D alert, please chime in!

    Peace!
  • CrunchieCrunchie Mandurah. Western Australia. Member
    edited November 2004
    Are those sites actually in your trusted sites zone? If they are, remove them and see if the problem persists.
  • TroganTrogan London, UK
    edited November 2004
    Hi, my SpyBt S&D shows that I have 6 CoolWWWSearch problems, but I think they are false. I've run CWShredder and that comes clean. The 2 pics mentioned by Merrick are the same as mine (accept the colour bit), I just ignore it now.
  • MERRICKMERRICK In the studio or on a stage
    edited November 2004
    Trogan_1000 wrote:
    Hi, my SpyBt S&D shows that I have 6 CoolWWWSearch problems, but I think they are false. I've run CWShredder and that comes clean. The 2 pics mentioned by Merrick are the same as mine (accept the colour bit), I just ignore it now.

    Thanks for the word I think I'm gonna ignore also.

    justlooking Not in my trusted sites zone, I think I'm going to chance it that it's a false alarmThe reg entries that S & D point to are the same DWORD configuration as the other immunized domains But if it really gets wierd (like more entries etc.) I'll remove 'em
  • NerdinaNerdina
    edited November 2004
    I've been having a similar problem with Spybot S&D: it tells me I have a backorifice problem, then tells me it can't be removed while the process is running, prompts me for a reboot and second scan. After all that, Spybot crashes at the end of the second scan. So, I am really worried.

    However, in a different forum that I went to to try to get answers, somebody posted this:
    ____________________
    its a bug, update to Spybot 1.3.1 TX < Name Removed for Poster's Privacy > 11/25 02:21:25

    ,theres also another two that will come up called CABROTOR and INTERFUN. It can be fixed if you update Spybots 1.3.1TX.

    www.majorgeeks.com/download4392.html
    Once you download it, install it on top of the previous version. Don't uninstall Spybot 1.3, it should now say "Spybot-Search & Destroy 1.3.1TX" once installed. That clears up those problems.

    Once it has been downloaded and installed,open Spybot,while connected to the internet and select "Search for Updates", select a server, and download all definition files. Post back results.
    _____________________

    But before I put yet another new thing on my computer, I thought I would check with all of you here. Is there REALLY a bug in Spybot and a new update to install? Any other ideas?
  • MERRICKMERRICK In the studio or on a stage
    edited November 2004
    If you look at that page again it says:
    Author: Patrick M. Kolla
    Since he is the author of Spybot it must be a good and compatible patch.

    Also:
    Downloaded: 52843 Times

    I think if it was bad it would be public knowledge by now. I'm downloading it as I post.
  • MERRICKMERRICK In the studio or on a stage
    edited December 2004
    Well I downloaded it and installed it but nothing changed. I still feel it's a safe download and I still think my issue is a false report anyway. But thanks for the CW Shredder reminder!!
Sign In or Register to comment.