Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Spybot S&d Keeps Sending Pop Ups


  • Please log in to reply
26 replies to this topic

#1 Dando

Dando

  • Members
  • 43 posts
  • OFFLINE
  •  
  • Local time:10:54 PM

Posted 16 April 2008 - 05:16 PM

Forgive me if I've posted this in the wrong section! I wasn't sure whereabouts to post it.

In Jan 07 I posted on Bleeping Computer , that my pc had been infected with a Trojan virus and with the help of a really nice chap on here, we managed to get rid of it. With his advice I now run SpyBot S&D, SuperAnti Spyware and Spyware Blaster, regularly on my PC. My problem is that Spy Bot keeps sending me pop ups telling me there's been a Registry Change or something, whenever I click on things. I did refer to this in my thread on Jan 18 2007 when I had the issue with the virus. How do I stop this happening or is it supposed to happen? Its frustrating as you have to click on the X to get rid of the little box before you can read what's on the screen.

I update all my antispyware, malaware software regularly before I do a system scan.

Thanks in advance for any help you can give me; and I apologise if I've posted this in the wrong section. I know my PC isn't infected (touchwood) with anything at the moment but thought I could post this in this section as I read that if you were at a loss on where to post, this was a place to start.....didn't think that tagging this question on to the thread from January 07 would help.

Thanks

Dando

BC AdBot (Login to Remove)

 


m

#2 DaChew

DaChew

    Visiting Alien


  • BC Advisor
  • 10,317 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:millenium falcon and rockytop
  • Local time:05:54 PM

Posted 16 April 2008 - 06:45 PM

  • If you have version 1.5, right click the Spybot Icon in the system tray near the clock (looks like a blue/white calendar with a padlock symbol).
  • Click once on Resident Protection, then right click the Spybot icon again and make sure Resident Protection is now Unchecked. The Spybot icon in the System tray should now be now colorless.
  • Go to Start > All Programs > Spybot - Search & Destroy > Spybot Search & Destroy.
  • Click on Mode > Advanced Mode. When it prompts you, click Yes.
  • On the left hand side, click on Tools.
  • Check (tick) this box if it is not yet ticked: Resident.
  • You will notice that Resident is now added under Tools. Click on Resident.
  • Uncheck (untick) this box: Resident "TeaTimer" (Protection of over-all system settings) active.
  • Exit Spybot Search & Destroy.
  • Restart your computer for the changes to take effect.
  • If you have version 1.4, go to Start > All Programs > Spybot - Search & Destroy > Spybot Search & Destroy.
  • Click on Mode > Advanced Mode. When it prompts you, click Yes.
  • On the left hand side, click on Tools.
  • Check (tick) this box if it is not yet ticked: Resident.
  • You will notice that Resident is now added under Tools. Click on Resident.
  • Uncheck (untick) this box: Resident "TeaTimer" (Protection of over-all system settings) active.
  • Exit Spybot Search & Destroy.
  • Restart your computer for the changes to take effect.

that's just teattimer trying to protect you, you just say yes when the registry change is asked and you are installing good program, say no when it's a bad or unknown program
Chewy

No. Try not. Do... or do not. There is no try.

#3 Dando

Dando
  • Topic Starter

  • Members
  • 43 posts
  • OFFLINE
  •  
  • Local time:10:54 PM

Posted 17 April 2008 - 04:48 AM

Thanks a lot Chewy!!! I am running version 1.4 of Spybot and did what you said above. I've turned the Tea Timer thing off and restarted the PC and am not getting the Spybot boxes coming up all the time now!!! There were a lot of files in the list when I looked at Resident or whatever before I switched off the tea timer. Guess that must be all the things its been checking since I installed it!! Anyhow many thanks for your time and input. I do appreciate it very much. Cheers!

#4 DaChew

DaChew

    Visiting Alien


  • BC Advisor
  • 10,317 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:millenium falcon and rockytop
  • Local time:05:54 PM

Posted 17 April 2008 - 05:08 AM

I love spybot but don't reccomend teatimer, that feature has messed up as many computers as it's saved in my oipnion.

And some cases the computer is virtually unfixable. It's a great feature when it works and you answer the questions right.
Chewy

No. Try not. Do... or do not. There is no try.

#5 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 50,581 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:04:54 PM

Posted 17 April 2008 - 09:05 AM

When inquiring about Spybot scans, you should always post a complete log of the actual detections received.

Spy Bot keeps sending me pop ups telling me there's been a Registry Change or something

Why does Spybot-S&D flag changes in the Windows Security Center Registry Keys?.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#6 Dando

Dando
  • Topic Starter

  • Members
  • 43 posts
  • OFFLINE
  •  
  • Local time:10:54 PM

Posted 17 April 2008 - 11:48 AM

Eeek Quietman7, what does that mean? "....you should always post a complete log of the actual detections received" I have no idea what you mean by post it. I run Spy Bot, Super Antispyware and Spyware blaster regularly and have Norton Security Centre as my firewall, virus detector protector, security thingy!! I am often told by Spy Bot (I think) that the Windows Security Centre is Disabled but it isn't. When I had a Trojan virus back in Jan 07 (which Bleeping Computer helped me sort out) I just did everything I was told to do. I did the Hijack This and Smitfix etc until we'd eliminated the virus. I downloaded the free antispyware and malaware stuff as requested and I've done nothing since other than do weekly scans and make sure that I download the updates to the antispyware. I would be clueless as to what to do when it throws things up... I just merely let it scan and if it detects a problem I let it deal with it by following the onscreen instructions. I don't make a note of anything or post anything to anywhere. Am I doing something wrong? Should I do something else? Is my machine at risk? Sorry for all the questions. The constant pop ups have stopped however, thanks to Chewy's advice. That was really driving me nuts

#7 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 50,581 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:04:54 PM

Posted 17 April 2008 - 12:01 PM

I wasn't sure from your description if you were referring to TeaTimer's alerts or notifications from an actual scan. Some folks confuse what they are trying to describe so I advised you to post scan results in case that's what you mean.

In any case, if you ever need to find a report from Spybot do this:
  • Launch Spybot, go to Mode and make sure Advanced Mode is selected.
  • Click Tools > View Report > View Previous Report.
  • You should see a list of files with names like Fixes.AAAAAA-XXXX.txt, where AAAAAA corresponds to a date (Example: Fixes.051030-1647.txt = file dated 2005-10-30)
  • Double-click on the report file to view.
If you have any problems doing this you can also find your reports in the following folder: C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Logs
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#8 Dando

Dando
  • Topic Starter

  • Members
  • 43 posts
  • OFFLINE
  •  
  • Local time:10:54 PM

Posted 17 April 2008 - 12:06 PM

Thanks for that, I will go and have a look. I think I saw all those reports when I followed Chewy's advice to turn off Tea Timer. However, I wouldn't know what to do, if anything, with all those reports and I certainly wouldn't recognise a potential threat. I only knew I had a virus because of a pop up that kept popping up asking me to buy some spyware because I had a Trojan virus.

#9 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 50,581 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:04:54 PM

Posted 17 April 2008 - 12:10 PM

Your welcome.

Spybot Tutorial
Using Spybot S&D
Spybot S&D Features explained
Advanced Mode, Tools, HOSTS file viewer, TeaTimer, SDHelper, System Startup
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#10 Dando

Dando
  • Topic Starter

  • Members
  • 43 posts
  • OFFLINE
  •  
  • Local time:10:54 PM

Posted 17 April 2008 - 12:16 PM

Many thanks again Quietman7, I appreciate your time and patience with me on this and your input. Everyone on here is always very supportive and I'm very appreciative.

#11 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 50,581 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:04:54 PM

Posted 17 April 2008 - 12:34 PM

You're welcome on behalf of the Bleeping Computer community. :thumbsup:
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#12 Dando

Dando
  • Topic Starter

  • Members
  • 43 posts
  • OFFLINE
  •  
  • Local time:10:54 PM

Posted 17 April 2008 - 02:00 PM

Hi again,

Have I opened a can of worms now? I've just scanned my PC twice with Spybot - the first time since switching off Tea Timer this morning and having read your comments on here.

The first time I scanned, I got 3 red error messages: Microsoft Windows security alert, which always comes up. Performance Optimizer which has never come up before and Worldsecurityonline, false alert, which always comes up. All three were in read. I "fixed the problem" and got rid of them all. However, during the scan another window popped open, it was a Microsoft / Microsoft Word type window which said "Warning" - There were problems in the include file C:\program files\spybot_search_destroy\includes\TrojansC.sbi See "include Error.log" for details. I ran a second scan. This time there were no threats as before in red but the same warning message came up. What do I do? Do I need to switch Tea Timer back on? This has never happened before. Is my PC okay?

Thanks as ever for any input

#13 DaChew

DaChew

    Visiting Alien


  • BC Advisor
  • 10,317 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:millenium falcon and rockytop
  • Local time:05:54 PM

Posted 17 April 2008 - 03:39 PM

I am not sure you got it all back in january and I see that your original helper hasn't posted since jan 25,

I was afraid all those popups from teatimer indicated an older infection, I have seen this.


would you try this?
  • Please download Malwarebytes' Anti-Malware and save it to a convenient location.
  • Double click on mbam-setup.exe to install it.
  • Before clicking the Finish button, make sure that these 2 boxes are checked (ticked):
    • Update Malwarebytes' Anti-Malware
      Launch Malwarebytes' Anti-Malware
  • Malwarebytes' Anti-Malware will now check for updates. If your firewall prompts, please allow it. If you can't update it, select the Update tab. Under Update Mirror, select one of the websites and click on Check for Updates.
  • Select the Scanner tab. Click on Perform quick scan, then click on Scan.
  • Leave the default options as it is and click on Start Scan.
  • When done, you will be prompted. Click OK, then click on Show Results.
  • Checked (ticked) all items and click on Remove Selected.
  • After it has removed the items, Notepad will open. Please post this log in your next reply. You can also find the log in the Logs tab. The bottom most log is the latest.
before you start the actual scan disconnect from the internet and then shut down as much resident protection as you can

Edited by DaChew, 17 April 2008 - 03:40 PM.

Chewy

No. Try not. Do... or do not. There is no try.

#14 Dando

Dando
  • Topic Starter

  • Members
  • 43 posts
  • OFFLINE
  •  
  • Local time:10:54 PM

Posted 17 April 2008 - 04:19 PM

Hi Chewy

Thanks for this. Its 22.15 here in the UK now so I will run this tomorrow. However, I note you say "before you start the actual scan, disconnect from the internet and then shut down as much resident protection as you can". What does that mean? Sorry if I appear thick but I need to know. and you'll need to be specific! LOL. The PC is a laptop and I have wireless connection. I take it I shouldn't log on to the internet when I go to run the scan? What is resident protection? Do you want me to turn off all my security, firewall etc or what. I will do as you request and post the results but it will probably be sometime tomorrow. Thanks for your help tho. I just wonder if I still have that virus, even tho all my scans say I don't. :thumbsup:

#15 DaChew

DaChew

    Visiting Alien


  • BC Advisor
  • 10,317 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:millenium falcon and rockytop
  • Local time:05:54 PM

Posted 17 April 2008 - 04:33 PM

your symptoms sound like an infection, one that never got cured

I noticed you had teatimer running last january

teatimer is a resident protection, your antivirus and some spyware programs have resident protection that's active protecting you, the problem is when you try to fix something they can and will often stop the fix.

If you are infected and it's beyond MBAM to cure then you should open a new thread or have someone reopen your old one

If you turn off your router or just disable your wireless apapter in device manager it will keep something worse out while you drop your defenses and try to fix your problem if any

before you reconnect be sure and reboot and make sure your defenses are back up

I would hold off on teatimer for a while
Chewy

No. Try not. Do... or do not. There is no try.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users