CWSchredder reverting cookie management

J

Jan

Hi,

Every time I run CWSchredder 2.0, it reverts the cookie management in IE6
back to 'automatic', allowing all cookies. I have set cookies control in IE
to 'ask' for normal cookies and 'block' for third party cookies, but
CWSchredder seems to alter the settings every times it runs. Does anybody
know about this? Is it a bug?

Thanks
Jan
 
P

PA Bear

I very much doubt CWShredder is causing the reset, Jan. Are you selecting
"Fix" and not "Scan" when you run it? Are all browser windows closed?

It's probably caused by some non-CWS hijacker. Try scanning with Ad-aware
and Spybot, after checking for updates.

Help with Hijackware
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/Darnit.htm
http://www.mvps.org/sramesh2k/Malware_Defence.htm
--
~Robear Dyer (PA Bear)
MS MVP-Windows (IE/OE)

Posting and You
http://www.trials-shack.co.uk/posting.html
 
S

siljaline

Jan said:
Hi,

Every time I run CWSchredder 2.0, it reverts the cookie management in IE6
back to 'automatic', allowing all cookies. I have set cookies control in IE
to 'ask' for normal cookies and 'block' for third party cookies, but
CWSchredder seems to alter the settings every times it runs. Does anybody
know about this? Is it a bug?

CWShredder should not be interfering with your cookie management.
Delete all the contents but *not* the Program Folder:
[C:\Program Files\InterMute\SpySubtract]
Download and run a fresh copy >
http://www.intermute.com/spysubtract/cwshredder_download.html

Please report back your findings.

Hope this helps.
Silj

--
siljaline

MS - MVP Windows (IE/OE) 2003/04 AH-VSOP
________________________________________
Security Tools Updates
http://forum.aumha.org/viewforum.php?f=31

(Reply to group, as return address
is invalid - that we may all benefit)
 
J

Jan

Hi all,

I contacted in parallel the 'Intermute technical support' about this issue.
According to their answer, it looks like normal behaviour for CWShredder:

"Unfortunatly part of CW Shredders ability is to reset the settings, so
therefore you would need to change them back after doing a check
using that utility."

I experienced the same consistent behaviour on 2 different computers using
each a different version of CWShredder.
Both have winxp with all latest critical patches unstalled, with ZoneAlarm
as firewall, have no viruses (according to avast, panda online and trend
micro online), both have latest and updated AdAware SE personal and Spybot
1.3 (tracking cookies but they say no spyware) and HijackThis (as far as I
can see, no suspect things in the logs). Checks and scans are carried out on
a regular basis, the only thing that comes out of it are tracking cookies.
No persistent slow-downs in IE, hangs, crashes, or 100% CPU during surfing.

Machine 1 has XP home and I downloaded CWShredder v2.0 as of yesterday
(21-11) - first install ever on that machine. Machine 2 has XP Pro and an
older version CWShredder 1.59.1. Nevertheless, same behaviour on both
machines. Checked out that changes do not occur at boot.

Before running CWShredder, I check the cookie settings (control panel ->
internet options -> privacy tab -> settings: advanced): radio button
'Override automatic cookie handling' is checked, first-party cookies 'ask'
and third-party cookies 'block'. OK
Without any program running (including browsers), I start CWShredder and
click the 'fix' button. Nothing detected on both machines.
But when I check back in 'internet options' right after CWShredder, the
'override automatic cookie handling' is unchecked and although options are
greyed out, they seem to be set to allow first and third party cookies...
(tried it out several times, always same result)
The changes don't take place if you click 'scan only'...

I can live with the fact that CWShredder does do that, but I would have expe
cted some more info from merijn - intermute, or anywhere else on the web, in
newsgroups, but couldn't find any indication.
Thanks for all replies!
Jan
 
S

siljaline

:
<snip>
Jan!
This is most unusual behaviour for CWShredder...
You likely have a hidden Spyware parasite.
Run "HijackThis" http://aumha.org/downloads/hijackthis.zip
How-To, here: http://mvps.org/winhelp2002/unwanted.htm
Post your HijackThis log here:
http://forum.aumha.org/viewforum.php?f=30

Silj

--
siljaline

MS - MVP Windows (IE/OE) 2003/04 AH-VSOP
________________________________________
Security Tools Updates
http://forum.aumha.org/viewforum.php?f=31

(Reply to group, as return address
is invalid - that we may all benefit)
 
S

siljaline

Jan said:
Hi Silj,

I finally posted my HijackThis log in the forum you mentioned.
Maybe that will clear things out...

Jan

Hi Jan,
Thanks for posting back, you will be well taken care of!

Regards,
Silj

--
siljaline

MS - MVP Windows (IE/OE) 2003/04 AH-VSOP
________________________________________
Security Tools Updates
http://forum.aumha.org/viewforum.php?f=31

(Reply to group, as return address
is invalid - that we may all benefit)
 
P

PA Bear

It turns out InterMute Tech Support was right (for once) after all. A
registry trace (run by MVP RameshS) reveals the following:

CWShredder.exe...

2152 Delete Value

Key:

HKCU\Software\Microsoft\Windows\CurrentVersion\Internet
Settings\PrivacyAdvanced

SUCCESS

This unchecks the Advanced option "Override automatic cookie" option/resets
cookie handling to the default (block all but approved cookies).
 
J

Jan Il

Hi PA Bear :)

Thanks for posting back and letting us know what the results were on this.

Jan :)
Smiles are meant to be shared,
that's why they're so contagious.
 
J

Jan Il

Hi Robear...found it!

Thanks.. :)

Jan :)
Smiles are meant to be shared,
that's why they're so contagious.
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Top