Question about Spybot and Spyblaster

Discussion in 'SpywareBlaster & Other Forum' started by usplusfour, Sep 2, 2004.

Thread Status:
Not open for further replies.
  1. usplusfour

    usplusfour Registered Member

    Joined:
    Sep 2, 2004
    Posts:
    6
    Hi,
    I am new to this forum. I have been using Spybot and Spyblaster for awhile now and this is really the first time I have had any problems, if it is a problem at all!
    Just recently when I run Spybot two entries have been appearing everytime.
    One is ChaosSoft and the other is SearchForIt. I do have a free screensaver from ChaosSoft, the Matrix, but I have been using this screensaver for about a year and it has never shown up before. When I remove the entry for SearchForIt, an item in SpyBlaster becomes unchecked. I did recieve updates for Spybot recently, were these two added with the update?
    Does my Matrix screensaver have spyware?
    After I have these two entries "fixed", I can run it again and they are back!
    Any suggestions from anyone?

    Peace
    Sam
     
  2. Bubba

    Bubba Updates Team

    Joined:
    Apr 15, 2002
    Posts:
    11,271
    Hey Sam,

    The SearchForIt Spybot false positive was addressed the other day in the below thread. As for ChaosSoft ....I am not yet familar with it in respect to Spybot.

    This thread---> SearchForIt

    Edit
    ChaosSoft was indeed added to Spybot's recent definition update.

    Spybot's recent updates---> Spybot's Update History
     
  3. usplusfour

    usplusfour Registered Member

    Joined:
    Sep 2, 2004
    Posts:
    6
    Thanks, I read all the posts, I feel much better now!
    One last thing, should I click ignore these items?

    Peace
    Sam
     
  4. Bubba

    Bubba Updates Team

    Joined:
    Apr 15, 2002
    Posts:
    11,271
    I would recommend ignoring the SearchForIt False positive until Spybot releases a fix.... but....would ask you to post a little more info of what Spybot is reporting concerning ChaosSoft. Is it reporting a reg key, file location....etc....and if you can post the actual entry it would be helpful.
     
  5. usplusfour

    usplusfour Registered Member

    Joined:
    Sep 2, 2004
    Posts:
    6
    OK, I put another screensaver on, and nothing came up. Then I put back on my Matrix screensaver and ran Spybot again and ChaosSoft showed up again.
    Actually I have noticed in the last few days that the settings on the Matrix screensaver have been changing by themselves!
    Anyway here is what it shows:

    ChaosSoft: Settings (Registry key, nothing done)
    HKEY_USERS\S-1-5-21-515967899-1957994488-320666883-1004\Software\ChaosSoft

    SearchForIt: Settings (Registry key, nothing done)
    HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\activex compatibility\{c109664b-ceb1-420b-b353-d55a561536dd}


    --- Spybot - Search && Destroy version: 1.3 ---
    2004-08-11 Includes\Cookies.sbi
    2004-08-30 Includes\Dialer.sbi
    2004-08-30 Includes\Hijackers.sbi
    2004-08-20 Includes\Keyloggers.sbi
    2004-05-12 Includes\LSP.sbi
    2004-08-30 Includes\Malware.sbi
    2004-08-12 Includes\Revision.sbi
    2004-08-11 Includes\Security.sbi
    2004-08-30 Includes\Spybots.sbi
    2004-08-30 Includes\Tracks.uti
    2004-08-30 Includes\Trojans.sbi

    Sam
     
  6. Bubba

    Bubba Updates Team

    Joined:
    Apr 15, 2002
    Posts:
    11,271
    "been using this screensaver for about a year"
    Hmmm....well I downloaded the screen saver but I was not required to actually install it but if I right clicked the Matrix Code Emulator.scr file....there was an install selection. Do you recall when you got it did you right click the file and select install ?

    After checking the file out a bit....I right clicked the file and selected the install and it does create a ChaosSoft reg entry in the installed section of the Software reg key but it's simply the settings one can use concerning the screensaver. What I did notice in the creation of the reg key was the one of the key names it applied....00000000-0000-0000-0000-000000000000....which is also used by one of the CoolWebSearch variants. However....by monitoring the install....I did not see anything other than a legit screen saver. Of course....what you have and what I have may be 2 different things.
     
  7. usplusfour

    usplusfour Registered Member

    Joined:
    Sep 2, 2004
    Posts:
    6
    No, I don't remember if I right clicked to install! The one I have is Matrix Code Emulator v. 1.5.
    Do you think I should get rid of it? It's my favorite!!!!


    Sam
     
  8. Strawface

    Strawface Registered Member

    Joined:
    Sep 2, 2004
    Posts:
    2
    Bubba and Sam -

    I too, have just run into the SearchForIt Toolbar conflict between Spybot - Search and Destroy and SpywareBlaster. I saw it first on the Spybot - Search and Destroy scan and immunized it. I had updated my Spybot signature files just prior to running the scan. It was shown as a registry entry, identical to the one found by Sam's Spybot scan.

    Then I checked SpywareBlaster after first updating it's signature files. SpywareBlaster indicated one unprotected item under Internet Explorer. When I scanned down the list to see what it was, it turned out to be the SearchForIt Toolbar. I checked it and added it to the protected items. Then I went back to Spybot Search and Destroy, did another scan and found that the SearchForIt Toolbar registry entry was back!

    I don't know if the SearchForIt Toolbar came to me with something I've installed since my last scans a week ago, or if it's just a bug that came with my Spybot - Search and destroy signature update.

    All I'd like to know is, which application is in error? Should I leave the registry entry in Spybot, or should I leave the item unprotected in Spyware Blaster?

    Puzzled - Strawface o_O
     
  9. usplusfour

    usplusfour Registered Member

    Joined:
    Sep 2, 2004
    Posts:
    6
    Strawface,
    I have chosen to keep it checked in Spyblaster and ingnore it in Spybot!
    Seems it came with the updates and it is a false positive!

    Peace
    Sam
     
  10. Bubba

    Bubba Updates Team

    Joined:
    Apr 15, 2002
    Posts:
    11,271
    @ Sam,
    I have the same version as you and have ran it thru the ringer and IMO it's more of false positive on Spybot's part for picking up on just the ChaosSoft entry that I watched with a reg monitor while Spybot was scanning.

    @ Strawface,

    As was mentioned earlier and in the link I provided....IF....spybot is picking up\reporting the below reg key....it can be ignored because it's a legit entry made by SpywareBlaster and a screwup on Spybot's part that will probably be fixed in an upcoming definition update.

    SearchForIt: Settings (Registry key, nothing done)
    HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\activex compatibility\{c109664b-ceb1-420b-b353-d55a561536dd}
     
  11. usplusfour

    usplusfour Registered Member

    Joined:
    Sep 2, 2004
    Posts:
    6
    Thank you very much Bubba for your time!

    Peace
    Sam
     
  12. Bubba

    Bubba Updates Team

    Joined:
    Apr 15, 2002
    Posts:
    11,271
    Your very Welcome Sam....and if you see your Firewall asking if you want to let ChaosSoft or Matrix out to play....we'll be glad to take a look at that :)

    You do use a Firewall don't you ?
     
  13. Strawface

    Strawface Registered Member

    Joined:
    Sep 2, 2004
    Posts:
    2
    Sam and Bubba-
    Thanks for your rapid feedback. I thought I looked at all your original info, Bubba, but I missed the link you included. I apologize and will have to scour the threads more thorougnly in the future.

    Oops! - Strawface
     
Thread Status:
Not open for further replies.