AlexChris,
In advanced mode:
Basically, you have some tabs on the left. One of them says SETTINGS & on
there is FILE SETS. Scroll to the bottom of the file sets & tick the
TRACKS.uti under USAGE TRACKS
In the Spybot scan results you will see many that are green. You can
safely tick any of them but the LOGS cannot be deleted if Schedule Tasks
service is running. So, you can disregard it. Technically, there are only
2 logs that cannot be deleted when the Schedule Task service is running
With the Explorer entry you may want to expand & right-click the
autocomplete & exclude etc.
Click the TOOLS tab this is what I recommend you have selected:
ACTIVEX
BHO
BROWSER PAGES
IE TWEAKS
HOSTS FILE
SYSTEM STARTUP
ActiveX - what's listed in [Drive letter]\Windows\Downloaded Program
Files
Clicking each one will show you if it legit or malware... Experience
tells
me though
BHO - I will only ever keep one in here & that is the Spybot one & always
delete the others. Crap like Adobe BHO should be deleted
Browser Pages - this is a list of search pages, homepage... If you
install
Windows Live, Google, Yahoo Messenger they like to change these settings
My searches are set to:
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch & the
homepage
to what you want
IE Tweaks - Tick the top one (Lock Hosts File Read-Only as Protection
Against Hijackers)
If you want to type anything in the Current User/All Users IE Custom
Title
then do so. It just replaces that Microsoft Internet Explorer in the IE
title bar
Hosts File - normally contains just one entry:
localhost 127.0.0.1
System Startup - This is your machine programs basic startup (doesn't
include some locations)
Things like Abobe Speed Launcher, Real Update, Quicktime Task are safe to
remove but this is where you'll find virus software or the odd nasty file
too
It will say 'System.ini', but they are actually WinLogon\Notify
System Startup Registry Keys used by Spybot System Startup:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Spybot System.ini Location:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon\Notify
When cleaning Spybot & it says some entries cannot be removed & do you
want to do it on next startup, say no or it will take around 30 mins to
do
it. Besides, these entries are Direct 3D log files, Schedule Task log
files... not worth deleting
If you use Outlook Express as your newsreader. I posted how to set it up
in my previous post then you can add the reports (like attachments) to
your reply & I can look through the logs & advise you what to delete, if
you like
How to export a log:
Click ActiveX under the TOOLS tab. In the right pane right-click |
Export.
Do the same for the others; BHO, STARTUP...
Note: There is a bug in Spybot & I have told them about this since
starting from beta testing version 1.2, 1.3 & 1.4 & release versions but
they won't fix it for some reason although it happens to everyone I know
using it.
When you export a log it will be something like 'Spybot.bho report' & the
filter will be '.textfiles', but it doesn't save as a txt file. So in the
filename add '.txt' to the end before clicking the save button.
Spybot updates are out at the moment every Wednesday afternoon. After
each
update make sure you IMMUNIZE within Spybot
--
Newbie Coder
(It's just a name)
alexxchris said:
Sorry to come back so late as we were busy with our work. Many thanks
for
all those who responded and we are working through it. On the Spybot we
scan under the Standard mode. Have a look at the Advance mode what shall
we do there and what do you mean by "tracks' ? Thanks
:
Welcome to Safer Networking Forums:
http://forums.spybot.info/
--
~Robear Dyer (PA Bear)
MS MVP-Windows (IE, OE, Security, Shell/User)
AumHa VSOP & Admin; DTS-L.org
alexxchris wrote:
Using the above to scan it gives the following
1/ Microsoft windows.Avtive Desktop
2/ Microsoft Windows IE FirewallByPass
3/ SURFSPY (DELETED)
Do I let Spybot "fix the problem" for item 1 & 2? Please advice.
As from yesterday, it seems to take a long time for this newsgroup
dialog to
appear. Just wonder if it is due to Surfspy as this is the first time
S&B detected it....thanks
