General discussion

Locked

SpyBot partially disabled

By Borg7of9 ·
On April 30/05 my browser was hijacked, CW shredder reported no coolsearch hijacks, Using Hijackthis, removed all spyware entries ( had a clean log ) so was easy to compare. However, on every re-boot new entries would occur.

Spybot, would scan and find a few entries, but the first entry was a weird warning sign, with German writing, and from this point on I noticed that even though I used Spybot to immunize, it now reported only about 900 entries instead of the over 2000, I would fix it, re-boot, but would go back to only 900 ( aprox) entries.
Also now I can not block pages silently, this option seems to be disabled.

I managed to remove I think all the spyware, as after hijack, I manually hunted down files and references in the registry, and with a floppy boot, was able to deleted associated files.

I googled and searched all over and can find no info, this appears to be a new one, does anyone have any information? Or similar experiences?

Even though my system is now fine, I still need to fix my spybot, and am afraid, as it seems that
every time I tried to update syybot, it was part of the problem, like the spyware attacked the spybot

Any comments appreciated

This conversation is currently closed to new comments.

7 total posts (Page 1 of 1)  
| Thread display: Collapse - | Expand +

All Comments

Collapse -

by dustyD In reply to SpyBot partially disabled

Seems like you have done a pretty thorough job of cleaning, although most sites recommend turning off system restore before cleaning a system.
As far as Spybot being broken, remove it and reinstall. If you are having issues with it not finding enough spyware, run Adaware also.
I have moved over to CounterSpy, even though it is not free. (19.95 for 1 client) It has been rated very good and beats the others in spyware recognized and removed.

Collapse -

by OTL In reply to SpyBot partially disabled

Was seeing the same problem with Win ME and subscribed. Tried stopping system restore and running spybot, restarted system restore and now it runs all the way through without the German error message. Error message indicates the last spyware it was scanning for (ZWax) is when the error occurred.

Collapse -

by Borg7of9 In reply to SpyBot partially disabled

The OS is Win98, so there is no system restore to worry about. I am quite happy with Spybot, and if a spyware targets and attacks a program like Spybot or Adaware or any other, well it could happen to any of them. I am interested in figuring out how it did it. and yes of course if I dlete it and re-install it, it should work fine.

Collapse -

by Bob.Nance In reply to SpyBot partially disabled

Reboot into safe mode.

Uninstall SpyBot

Reboot into safe mode.

Install and run spybot while in safe mode

Install and run adaware while in safe mode

reboot and see if it worked.

There is a nasty spyware app out there that runs three copies of itself in memory, each with a different semi-random name. If you kill one, the others notice and re-launch it. If you delete the executable, it will be re-written within 10 seconds. If you change the registry, it will be re-botched in the same time span. You cannot kill any of this with anti-spyware software as long as any of the processes are running.

Use safe mode.

-Bob

Collapse -

by Borg7of9 In reply to SpyBot partially disabled

Hi Bob, well I removed the spyware, but it was exactly how you described it. I will however, now remove and re-insatll my spybot software as you have suggested.

If anyone know the name of the spyware, or has any more info on it, please post here.

I would like to know the name of it, and also at what point spybot and adaware have updates against it.

Also if anyone has technical info on it as well.
:)

Collapse -

by spysafari In reply to SpyBot partially disabled

The answer for this antispyware behaviour is CounterSpy.

Collapse -

by btljooz In reply to SpyBot partially disabled

Sounds to me like you have a worm or some other such infestation. That would explain the new entries on reboot.

As for all the other stuff you mention. I can only suggest that you uninstall and clean ALL files related to Spybot from your drive and then do a CLEAN re-install of the program and QUICKLY update it.

Back to Security Forum
7 total posts (Page 1 of 1)  

Related Discussions

Related Forums