Spybot Search & Destroy Help Options

[wardtn]

I have used Spyot Search & Destroy on my old Win98 machine and now my XP home computer. Since using it with XP, there is a peculiarity that I've just lived with, but I'd really like to solve it.

Often when installing different software, a window pops up indicating it belongs to Spybot, and it indicates that a change is about to be written to the registry. There appear to be two buttons to select...but the dialog box that popped up doesn't fully draw the buttons. I can see the top edge of the buttons, and just a little of the sides, but that is it. I can't tell which button is "Yes, allow this change" and which is no. I think the left one is yes, because I have selected it and then another dialog box pops up near the sys tray on the lower right corner of the screen saying the user allowed 'such and such' a change to the registry.

I'd really like to know what the heck I am really doing here! Has anyone encountered this. Or, does anyone know a forum or a place to get some feedback?

[dmccunney]

Often when installing different software, a window pops up indicating it belongs to Spybot, and it indicates that a change is about to be written to the registry. There appear to be two buttons to select...but the dialog box that popped up doesn't fully draw the buttons. I can see the top edge of the buttons, and just a little of the sides, but that is it. I can't tell which button is "Yes, allow this change" and which is no. I think the left one is yes, because I have selected it and then another dialog box pops up near the sys tray on the lower right corner of the screen saying the user allowed 'such and such' a change to the registry.

Did you install Spybot's Teatimer utility?

If so, uninstall it. Teatimer attempts to protect you by popping up a box when something wants to modify the registry.

Issue 1) Lots of things update the registry. Teatimer can get really intrusive and annoying.

Issue 2) You probably don't know enough to properly answer Teatimer's questions. The registry is constantly being updates by processes, and unless you know every one of them, you won't know what to allow/disallow.
______
Dennis

[wardtn]

Well, I know that 3 to 4 minutes is the proper steeping time for black tea, 4 to 5 for some green teas, and at least 5 for most herb teas...other than that, you are right! I don't know enough to make informed decisions. I will look and see if I can uninstall Teatimer...If it is included in the 'standard' install of Spybot, then it is probably in there.

Oh, and lately, my favorte bagged tea is Typhoo tea! And I'm a rebel...steeping my black tea for at least 5 minutes, maybe more! I never said I was proper!

This post brought to you by Typhoo Tea...
http://www.typhoo.com/

This post has been edited by wardtn: Aug 1 2006, 03:15 PM

[dmccunney]

...other than that, you are right! I don't know enough to make informed decisions. I will look and see if I can uninstall Teatimer...If it is included in the 'standard' install of Spybot, then it is probably in there.

It's an optional install, offered when you install Spybot. You have to specifically say yes to it.

You may also be encountering Microsoft's bundled anti-spyware tool, which pops up messages like that. I turned it off. I don't use Internet Explorer, and don't get spyware in the first place.
______
Dennis

[wardtn]

I don't use IE either...although there have been a few instances where it has been run...some apps ask to look for an update on the internet and by default use IE. But as a rule, I don't use it...Firefox all the time for me. But everytime (or at least 4 out of 5) I run Spybot S&D, there are several items to remove.

One thing I noticed recently was the "Immunize" option in Spybot. I hadn't paid attention to this. Running it recently sped up the time it takes to do a scan with Spybot.

Oh, and I found out how to disable Teatimer. When I did, I got a Security message...I'm guessing from Windows bundled security? Anyway, we will see how things go.

BTW, I recently installed BSafe as my security suite. It's firewall is enabled. I noticed the Windows Security firewall was also enabled. Should I turn off one of these? There was a message in the Windows Security saying there is a danger of having 2 firewalls running simultaneously. So I disabled the Windows firewall and kept the BSafe firewall enabled.

[genoahous]

BTW, I recently installed BSafe as my security suite. It's firewall is enabled. I noticed the Windows Security firewall was also enabled. Should I turn off one of these? There was a message in the Windows Security saying there is a danger of having 2 firewalls running simultaneously. So I disabled the Windows firewall and kept the BSafe firewall enabled.

Yes that's correct, best to only have one SW firewall turned on. And XP SP2 firewall is kinda lame, so it should be to turned off.

[dmccunney]

BTW, I recently installed BSafe as my security suite. It's firewall is enabled. I noticed the Windows Security firewall was also enabled. Should I turn off one of these? There was a message in the Windows Security saying there is a danger of having 2 firewalls running simultaneously. So I disabled the Windows firewall and kept the BSafe firewall enabled.

Yes that's correct, best to only have one SW firewall turned on. And XP SP2 firewall is kinda lame, so it should be to turned off.

A friend of mine is a network admin. I was bemused a while back to spend a bit of time using her laptop. "Do you really have four firewalls active simultaneously?"

Yeah, she did: Zone Alarm, SPF, Black Ice Defender, and another I'm forgetting. I was impressed by the fact she'd gotten them all to work at once, but thought then (and still think) she was way overdoing it.

Agreed on the XP firewall. It's better than nothing, but if you have an alternative, use it. I put SPF on my company laptop and turned of the XP product.
______
Dennis

[genoahous]

FWIW:

I have Norton (NSW & NIS) installed on my XP SP2 machines. Spybot gives me three (or four?) hits on the registry values stating Firewall, AV, and ??? checking are turned off.

These Spybot "warnings" can usually be ignored. But pay them heed if you DON'T know what caused them. Spyware (etc.) might also turn these XP SP2 registry entries off.

[dmccunney]

I don't use IE either...although there have been a few instances where it has been run...some apps ask to look for an update on the internet and by default use IE. But as a rule, I don't use it...Firefox all the time for me. But everytime (or at least 4 out of 5) I run Spybot S&D, there are several items to remove.

At a guess, they are all "tracking" cookies. Remove them, but they're a nuisance rather than a threat, and not worth worrying about.

I recommend a layered approach. Install LAvasoft's Ad-Aware SE, Spyboy, and Javacool software's Spyware Blaster. Run Ad-Aware first, then run Spybot. Ad-Aware finds more than Spybot, but Spybot finds a few things Ad-Aware doesn't. And if you only run one, run Ad Aware.

One thing I noticed recently was the "Immunize" option in Spybot. I hadn't paid attention to this. Running it recently sped up the time it takes to do a scan with Spybot.

"Immunize" blacklists a bunch of known adware/spyware/malware sites, by preventing your machine from accessing them. It does so by altering registry settings. This protection is IE specific, but may help in the cases you mention where some other program is hard-coded to call IE instead of obeying the default browser setting in Windows.

Oh, and I found out how to disable Teatimer. When I did, I got a Security message...I'm guessing from Windows bundled security? Anyway, we will see how things go.

I don't know where else it could come from. But Teatiemer is an optional seperate component. You should be able to uninstall it through the Add/Remove Programs applet in Control Panel.

BTW, I recently installed BSafe as my security suite. It's firewall is enabled. I noticed the Windows Security firewall was also enabled. Should I turn off one of these? There was a message in the Windows Security saying there is a danger of having 2 firewalls running simultaneously. So I disabled the Windows firewall and kept the BSafe firewall enabled.

The danger with two firewalls enabled is unintended side effects, and getting blocked from getting to things. It's possible to run more than one, but not recommended unless you are a tech that likes to fiddle with this stuff.
______
Dennis

[wardtn]

I recommend a layered approach. Install LAvasoft's Ad-Aware SE, Spyboy, and Javacool software's Spyware Blaster. Run Ad-Aware first, then run Spybot. Ad-Aware finds more than Spybot, but Spybot finds a few things Ad-Aware doesn't. And if you only run one, run Ad Aware.

I typically do this...Ad-Aware first then Spybot. I haven't heard about Spyware Blaster, I should look into it. (did you mean 'Spybot' when you typed Spyboy? If not, sounds like a gaming platform

It's possible to run more than one, but not recommended unless you are a tech that likes to fiddle with this stuff.

Actually I play the guitar...

[dmccunney]

I recommend a layered approach. Install Lavasoft's Ad-Aware SE, Spyboy, and Javacool software's Spyware Blaster. Run Ad-Aware first, then run Spybot. Ad-Aware finds more than Spybot, but Spybot finds a few things Ad-Aware doesn't. And if you only run one, run Ad Aware.

I typically do this...Ad-Aware first then Spybot. I haven't heard about Spyware Blaster, I should look into it. (did you mean 'Spybot' when you typed Spyboy? If not, sounds like a gaming platform

I did indeed mean Spybot. I was posting from the office, and LXP was in one of the current sluggish states.
______
Dennis

[wardtn]

Lately I've had trouble with my Windows Security shield turning 'red' on me and saying I don't have Virus Protection. I tell it I have a third party Virus protection program (Bsafe) and that I will monitor this need from this point forward thank you very much! That worked when I first did it after having BSafe installed. But lately the red shield has been rearing it's ugly head pretty often. I'm thinking "why can't it remember that I told it I was 'covered'?"

Running Spybot tonight I noticed one item it found that I haven't seen before. It was called:

Microsoft.WindowsSecurityCenter.AntiVirusOverride

Sounds suspicious!

[pamd]

Ward,

Please don't take my word for it until you hear a couple of confirmations, but I would have zapped it appeared in Spybot. In fact, I've always zapped anything that Spybot or Ad-Aware turned up, without questioning them much. I've never had a problem with doing that, as far as I know.

[genoahous]

Running Spybot tonight I noticed one item it found that I haven't seen before. It was called:

Microsoft.WindowsSecurityCenter.AntiVirusOverride

Sounds suspicious!

I see four messages like that after I installed Norton NIS (my AV solution), and ignore them.

I suspect these are due to NAV turning off WinXP SP2 Security Center stuff (the way Security Center alerts user). In fact on my system, with NAV, the Resource "Change the way Security Center alerts me" is grayed out.

So I think it's okay, but again I'm not real certain.

This post has been edited by genoahous: Oct 3 2006, 01:29 AM

[toddtmw]

Microsoft.WindowsSecurityCenter.AntiVirusOverride

The almighty Google doesn't even find this! Did you miss a period or something when you typed it in here.

If you typed if corredctly, congratulations, you officially stumped Google! (At least until this thread is indexed and then searching for that string will lead people here...)

-Todd

[genoahous]

Follow up. What I get on my system is:

• Microsoft.WindowsSecurityCenter_disabled
  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wscsvc\Start!=W=2
• Microsoft.WindowsSecurityCenter.AntiVirusDisableNotify
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify!=dword:0
• Microsoft.WindowsSecurityCenter.FirewallDisableNotify
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify!=dword:0
• Microsoft.WindowsSecurityCenter.UpdateDisableNotify
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify!=dword:0

There seems to be a display problem in Spybot, or it's displaying what value SHOULD be, as search of my registry shows the values are different. I see one for the DisableNotify values, and four for the wscsvc value.

[dontmindmehehe]

Hi there - I have the info you would like. The little boxes that pop-up after a download/installation are security measures asking your permission to either Allow/Accept the installation, or if you want to Deny the installation. The one on the left is Allow/Accept, and the one on the right is to Deny the installation. Sometimes there are a few to a lot of those - depending; I get lots of them when I'm making repair changes from a program where I'm selecting multiple choices, too.

I find this tool very helpful.. because if you have a last second change of mind you can Deny it, or you may not even know you've downloaded something or made any changes and that little things keeps YOU updated. I know that little window box appears and it is hard to make out; don't know why they haven't upgraded that little quirk. If you want comfirmation of this I'm sure you can e-mail an administrator at Spy-bot.

[font=Tahoma][size=7]