Question about Spybot and Spyblaster

Hi,
I am new to this forum. I have been using Spybot and Spyblaster for awhile now and this is really the first time I have had any problems, if it is a problem at all!
Just recently when I run Spybot two entries have been appearing everytime.
One is ChaosSoft and the other is SearchForIt. I do have a free screensaver from ChaosSoft, the Matrix, but I have been using this screensaver for about a year and it has never shown up before. When I remove the entry for SearchForIt, an item in SpyBlaster becomes unchecked. I did recieve updates for Spybot recently, were these two added with the update?
Does my Matrix screensaver have spyware?
After I have these two entries "fixed", I can run it again and they are back!
Any suggestions from anyone?

Peace
Sam

 

Hey Sam,

The SearchForIt Spybot false positive was addressed the other day in the below thread. As for ChaosSoft ....I am not yet familar with it in respect to Spybot.

This thread---> SearchForIt

Edit
ChaosSoft was indeed added to Spybot's recent definition update.

Spybot's recent updates---> Spybot's Update History

 

Thanks, I read all the posts, I feel much better now!
One last thing, should I click ignore these items?

Peace
Sam

 

I would recommend ignoring the SearchForIt False positive until Spybot releases a fix.... but....would ask you to post a little more info of what Spybot is reporting concerning ChaosSoft. Is it reporting a reg key, file location....etc....and if you can post the actual entry it would be helpful.

 

OK, I put another screensaver on, and nothing came up. Then I put back on my Matrix screensaver and ran Spybot again and ChaosSoft showed up again.
Actually I have noticed in the last few days that the settings on the Matrix screensaver have been changing by themselves!
Anyway here is what it shows:

ChaosSoft: Settings (Registry key, nothing done)
HKEY_USERS\S-1-5-21-515967899-1957994488-320666883-1004\Software\ChaosSoft

SearchForIt: Settings (Registry key, nothing done)
HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\activex compatibility\{c109664b-ceb1-420b-b353-d55a561536dd}


--- Spybot - Search && Destroy version: 1.3 ---
2004-08-11 Includes\Cookies.sbi
2004-08-30 Includes\Dialer.sbi
2004-08-30 Includes\Hijackers.sbi
2004-08-20 Includes\Keyloggers.sbi
2004-05-12 Includes\LSP.sbi
2004-08-30 Includes\Malware.sbi
2004-08-12 Includes\Revision.sbi
2004-08-11 Includes\Security.sbi
2004-08-30 Includes\Spybots.sbi
2004-08-30 Includes\Tracks.uti
2004-08-30 Includes\Trojans.sbi

Sam

 

"been using this screensaver for about a year"
Hmmm....well I downloaded the screen saver but I was not required to actually install it but if I right clicked the Matrix Code Emulator.scr file....there was an install selection. Do you recall when you got it did you right click the file and select install ?

After checking the file out a bit....I right clicked the file and selected the install and it does create a ChaosSoft reg entry in the installed section of the Software reg key but it's simply the settings one can use concerning the screensaver. What I did notice in the creation of the reg key was the one of the key names it applied....00000000-0000-0000-0000-000000000000....which is also used by one of the CoolWebSearch variants. However....by monitoring the install....I did not see anything other than a legit screen saver. Of course....what you have and what I have may be 2 different things.

 

No, I don't remember if I right clicked to install! The one I have is Matrix Code Emulator v. 1.5.
Do you think I should get rid of it? It's my favorite!!!!


Sam

 

Bubba and Sam -

I too, have just run into the SearchForIt Toolbar conflict between Spybot - Search and Destroy and SpywareBlaster. I saw it first on the Spybot - Search and Destroy scan and immunized it. I had updated my Spybot signature files just prior to running the scan. It was shown as a registry entry, identical to the one found by Sam's Spybot scan.

Then I checked SpywareBlaster after first updating it's signature files. SpywareBlaster indicated one unprotected item under Internet Explorer. When I scanned down the list to see what it was, it turned out to be the SearchForIt Toolbar. I checked it and added it to the protected items. Then I went back to Spybot Search and Destroy, did another scan and found that the SearchForIt Toolbar registry entry was back!

I don't know if the SearchForIt Toolbar came to me with something I've installed since my last scans a week ago, or if it's just a bug that came with my Spybot - Search and destroy signature update.

All I'd like to know is, which application is in error? Should I leave the registry entry in Spybot, or should I leave the item unprotected in Spyware Blaster?

Puzzled - Strawface

 

Strawface,
I have chosen to keep it checked in Spyblaster and ingnore it in Spybot!
Seems it came with the updates and it is a false positive!

Peace
Sam

 

@ Sam,
I have the same version as you and have ran it thru the ringer and IMO it's more of false positive on Spybot's part for picking up on just the ChaosSoft entry that I watched with a reg monitor while Spybot was scanning.

@ Strawface,

As was mentioned earlier and in the link I provided....IF....spybot is picking up\reporting the below reg key....it can be ignored because it's a legit entry made by SpywareBlaster and a screwup on Spybot's part that will probably be fixed in an upcoming definition update.

SearchForIt: Settings (Registry key, nothing done)
HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\activex compatibility\{c109664b-ceb1-420b-b353-d55a561536dd}

 

Thank you very much Bubba for your time!

Peace
Sam

 

Your very Welcome Sam....and if you see your Firewall asking if you want to let ChaosSoft or Matrix out to play....we'll be glad to take a look at that

You do use a Firewall don't you ?

 

Sam and Bubba-
Thanks for your rapid feedback. I thought I looked at all your original info, Bubba, but I missed the link you included. I apologize and will have to scour the threads more thorougnly in the future.

Oops! - Strawface