Question about ewido scans not cleaning everything the first time

[SonyaM32]

Hi everyone
I just downloaded the latest ewido scan. I used my old one almost everyday. And the old one picked up alot of spyware too.
I have had to scan my computer 4 times already back to back and it keeps picking up new spyware etc: and it is cleaning all of them. But why doesn't it pick them all up the first or the second time? The first one it picked up like 35, then the second it picked up 23 then, 17 I know the numbers are getting lower, but why do I have to keep scanning? Does spyware get on your computer that fast?
In that case I guess I need to scan 30 times a day, lol
I start a new one imediatly after the previous just to see if it got everything, but it keeps comming up with more
Can someone explain this to me plz?

[TheQuest]

Hi, SonyaM32

Where do you been going to keep getting so many.

Try doing the scan in safe mode, so the is no interference. [anything in use]

Take Care,
TheQuest

[SDS909]

Sounds like you have a trojan downloader or something that is reinfesting each time it is cleaned.

I recommend running Safe'n'Sec in total lockdown mode, and only enabling required things. Then scan and clean everything up.

[SonyaM32]

Thanks TheQuest, and SDS909,
SD, how do I run Safe'n'Sec? Does that mean safe mode??
Also if I run in safe mode will it reinfest when I get back on the internet?
Also, last night I tried scanning with my Zone Alarm set to "stop all internet activity" and it didn't find any spyware. But when I get on the internet now it always finds 22. It cleans them, but it will find 22 again as soon as I do a new scan.
Thanks

[Franklin]

Could system restore have something to do with this?

[zcv]

Originally Posted by SonyaM32

But when I get on the internet now it always finds 22. It cleans them, but it will find 22 again as soon as I do a new scan.

Hello Sonya,

Did you pay attention to where it was?

Originally Posted by Franklin

Could system restore have something to do with this?

If it is in the SVI, System Restore's file, the location given will look something like this: \System Volume Information\_restore

To get rid of it:
Shut SR off: My Computer > Properties > System Retore tab > Check "Turn off System Restore on all drives".

Reboot.

Go back and re-enable SR - will create an initial restore point.

Regards - Charles

[SonyaM32]

Originally Posted by zcv

Hello Sonya,

Did you pay attention to where it was?

If it is in the SVI, System Restore's file, the location given will look something like this: \System Volume Information\_restore

To get rid of it:
Shut SR off: My Computer > Properties > System Retore tab > Check "Turn off System Restore on all drives".

Reboot.

Go back and re-enable SR - will create an initial restore point.

Regards - Charles

Hi I just posted the reports in this link. I don't know what happened to the 22, but the reports are over there.
http://www.wilderssecurity.com/showp...7&postcount=36

[SonyaM32]

Here they are. The first is the online scan. The second is the one from my computer.

ewido security suite online scanner
http://www.ewido.net
__________________________________________________


Name: TrojanDownloader.Swizzor.bo
Path: [340] C:\DOCUME~1\sonya\APPLIC~1\CASTID~1\DoesFour.exe
Risk: High

Name: Spyware.Cookie.Doubleclick
Path: :mozilla.26:C:\Documents and Settings\sonya\Application Data\Mozilla\Profiles\default\kle7cb79.slt\cookies.txt
Risk: Medium

ewido security suite - Scan report
---------------------------------------------------------

+ Created on: 8:28:49 PM, 7/27/2005
+ Report-Checksum: C7493FFD

+ Scan result:

[340] C:\DOCUME~1\sonya\APPLIC~1\CASTID~1\DoesFour.exe -> TrojanDownloader.Swizzor.bo : Cleaned with backup
[2376] C:\DOCUME~1\sonya\APPLIC~1\CASTID~1\DoesFour.exe -> TrojanDownloader.Swizzor.bo : Error during cleaning
:mozilla.26:C:\Documents and Settings\sonya\Application Data\Mozilla\Profiles\default\kle7cb79.slt\cookies.txt -> Spyware.Cookie.Doubleclick : Cleaned with backup


::Report End

[dan_maran]

Sonya, try running a temp file and registry cleaner like CCleaner then rescanning with ewido.
Read the help file for CCleaner as you can save some of the cookies you use such as here at wilders, and you can also clean out the registry also. If you look in the options, where all these setting are btw, you will note under advanced there is a check box to clean files older than 48hrs make sure you uncheck that. HTH

[zcv]

Hi Sonya,

As far as I can tell, the junk is in the browser cache, not in SR's restore file.

Did you run Ewido in safe mode? Tap the the F8 key on bootup and scan that way. Also as a good practice, adjust IE to clean out the Temporary Internet Folder on browser disconnect: IE tools > Internet options > advanced tab > scroll down to the security section and check "Empty temporary internet file folder when browser is closed".

Regards - Charles

[SonyaM32]

Thank you everyone! I cleaned with CCleaner, and cleared the cache in Java, and Mozilla, and no infections were found after that! Now I'm doing the online scan, and it found alot Thanks for all your help .

[SonyaM32]

Here's the ones from the online scan http://img.photobucket.com/albums/v6...am/kaioken.gif

I "removed infections" and am scanning again now Yesterday it only found 2. Now it's finding 21
__________________________________________________

ewido security suite online scanner
http://www.ewido.net
__________________________________________________


Name: Spyware.Cookie.Advertising
Path: :mozilla.7:C:\Documents and Settings\sonya\Application Data\Mozilla\Profiles\default\kle7cb79.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.Advertising
Path: :mozilla.8:C:\Documents and Settings\sonya\Application Data\Mozilla\Profiles\default\kle7cb79.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.Advertising
Path: :mozilla.9:C:\Documents and Settings\sonya\Application Data\Mozilla\Profiles\default\kle7cb79.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.Doubleclick
Path: :mozilla.10:C:\Documents and Settings\sonya\Application Data\Mozilla\Profiles\default\kle7cb79.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.Advertising
Path: :mozilla.11:C:\Documents and Settings\sonya\Application Data\Mozilla\Profiles\default\kle7cb79.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.Advertising
Path: :mozilla.12:C:\Documents and Settings\sonya\Application Data\Mozilla\Profiles\default\kle7cb79.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.Advertising
Path: :mozilla.13:C:\Documents and Settings\sonya\Application Data\Mozilla\Profiles\default\kle7cb79.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.Advertising
Path: :mozilla.14:C:\Documents and Settings\sonya\Application Data\Mozilla\Profiles\default\kle7cb79.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.Advertising
Path: :mozilla.15:C:\Documents and Settings\sonya\Application Data\Mozilla\Profiles\default\kle7cb79.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.Advertising
Path: :mozilla.16:C:\Documents and Settings\sonya\Application Data\Mozilla\Profiles\default\kle7cb79.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.Advertising
Path: :mozilla.17:C:\Documents and Settings\sonya\Application Data\Mozilla\Profiles\default\kle7cb79.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.Advertising
Path: :mozilla.18:C:\Documents and Settings\sonya\Application Data\Mozilla\Profiles\default\kle7cb79.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.Advertising
Path: :mozilla.19:C:\Documents and Settings\sonya\Application Data\Mozilla\Profiles\default\kle7cb79.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.Advertising
Path: :mozilla.20:C:\Documents and Settings\sonya\Application Data\Mozilla\Profiles\default\kle7cb79.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.Advertising
Path: :mozilla.21:C:\Documents and Settings\sonya\Application Data\Mozilla\Profiles\default\kle7cb79.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.Fastclick
Path: :mozilla.25:C:\Documents and Settings\sonya\Application Data\Mozilla\Profiles\default\kle7cb79.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.Fastclick
Path: :mozilla.26:C:\Documents and Settings\sonya\Application Data\Mozilla\Profiles\default\kle7cb79.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.Fastclick
Path: :mozilla.27:C:\Documents and Settings\sonya\Application Data\Mozilla\Profiles\default\kle7cb79.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.Tribalfusion
Path: :mozilla.28:C:\Documents and Settings\sonya\Application Data\Mozilla\Profiles\default\kle7cb79.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.Tribalfusion
Path: :mozilla.29:C:\Documents and Settings\sonya\Application Data\Mozilla\Profiles\default\kle7cb79.slt\cookies.txt
Risk: Medium

Name: Spyware.Cookie.Atdmt
Path: :mozilla.30:C:\Documents and Settings\sonya\Application Data\Mozilla\Profiles\default\kle7cb79.slt\cookies.txt
Risk: Medium

[SonyaM32]

Should I be running scans like all day? Not the same scan, but different ones throughout the day? Because I am online alot, and I will constantly run scans if it will help. I have NOD32, ewido, Spybot, Ad-Aware, CCleaner, CWShreader. Do any of these ever run in the background so it isn't nessesary to scan all the time? If so which ones run ? Thanks for answering my questions, I just don't want to loose my computer again, and like I lost my last one.
P.S. I just did another online scan and it found the same thing.
Thanks everyone

[dan_maran]

SonyaM32 - Those are just cookies, not anything really bad, just run a quick CClean and then they should be gone, if you still have trouble post a screen of your ccleaner options pages. There is no need to do constant scans you are simply picking up those cookies by surfing around.

You can block most of those site simply by using a host file, a good tutorial is located at MVP's.org

[solarpowered candle]

Are you using firefox? If you set your cookies to
allow sites to set cookies
for the irriginating site only
keep cookies untill I close firefox
and use "adblock" extension you shouldnt have any .
If you do need to put any sites in "exceptions" you can add them.

[SonyaM32]

Originally Posted by likuidkewl

SonyaM32 - Those are just cookies, not anything really bad, just run a quick CClean and then they should be gone, if you still have trouble post a screen of your ccleaner options pages. There is no need to do constant scans you are simply picking up those cookies by surfing around.

You can block most of those site simply by using a host file, a good tutorial is located at MVP's.org

Thanks

[SonyaM32]

Originally Posted by solarpowered candle

Are you using firefox? If you set your cookies to
allow sites to set cookies
for the irriginating site only
keep cookies untill I close firefox
and use "adblock" extension you shouldnt have any .
If you do need to put any sites in "exceptions" you can add them.

I use Mozilla. Not Firefox. I will check to see if set to allow sites to set cookies. I will be back to let you know sometime today Thanks

[SonyaM32]

Originally Posted by solarpowered candle

Are you using firefox? If you set your cookies to
allow sites to set cookies
for the irriginating site only
keep cookies untill I close firefox
and use "adblock" extension you shouldnt have any .
If you do need to put any sites in "exceptions" you can add them.

It is set to accept default cookie permissions. Do I need to change it?

[dan_maran]

If you utilize the hosts file option, you will not need to really worry about cookies as these sites are blocked from your computer period, in essence anyhting that has say servedby.com in it will automatically be denied access to your computer and will never make it through. But if you choose to not use it, you may set your browser to accept only original cookies/ reject third party cookies. HTH

[solarpowered candle]

Hi Sonya

The host file that likuidkewl suggested is certainly a good option for you . However Its real good to use these experiences to learn how to gain greater security. I would also take the time to learn about the settings in your browser and how you can manage them to attain greater privacy. To set your cookie s in mozilla > Edit > Preferences > To the left under" category "choose >Privacy
and Security > Cookies > Allow Cookies for the originating web site only >

Under "Cookie lifetime policy" > accept Cookies for the current session only

Under "manage cookies and sites" > Cookie manager > Cookiie sites ( this is where you can add sites you are fine with cookies . ie under manage sites that can store cookies type in www.wilderssecurity.com > allow. >ok

also you may choose to under "privacy and settings > Pop Up windows > Block Unrequested windows. Also tick > desplay an icon in the task bar . ( read the bit below that on how to allow some sites , if you require pop ups to function )

There are more options available and your help manual will give you a great insite into this . Its worth the meandering through so that you are real comfortable with your browser.
the above should be a good start . there are more good options that maybe any one who does use mozilla will be able to suggest ( I use firefox so the settings a slightly diffirent)

[SonyaM32]

Thanks likuidkewl and solarpowered
I set the settings like stated above
Thanks again