Spyware Doctor doesn't detect everything

[ButchN]

I know all spyware programs cannot detect everything all the time, but lately SD is severely lagging behind.

I had Webroots spyware & antivirus program but when I had a few weeks of it telling me nothing was there yet SD & Superantispyware detected many instances (all on full scans) I took a screen shot showing the results of all 3 & asked webroot why.

Instead of an answer they refunded my $$ & closed my key!
So now I'm asking here what's up with SD?

I somehow got a virus or malware & SD showed nothing yet SASW detected many instances!

Both were run with full scanning & had the latest updates installed.

Here's my scans from earlier today:

http://home.comcast.net/~myws6/spyware_scans.jpg

[vecchio]

please be aware each program have differents detection modes and technologies. sometimes a program can detect more items than other but it does't mean reason for be the best program

[ffwfire]

Looks like all it detected to me were a bunch of tracking cookies. Use ccleaner or there is a link in the privacy guardian forum about getting pg for free.

I got it free from another promotion and I like it. Tracking cookies are nothing to be concerned about. I use firefox mainly and every time I close my browser the cookies are removed. I set it up that way, maybe you ought to try to configure your browser that way too, but cookies are nothing to be concerned about.

Edit: http://www.pctools.com/forum/showthread.php?t=44796 That should kill those cookies for you.

[tom.tdw]

hi
spyware doctor removes most cookies silently without telling you

it's all done by the cookie guard function in onguard

spyware doctor tries not to bother you with such low level threats

you can see what has been removed in history

[allibear]

Well on the screen shot we are seeing the tracking cookies results, I would be interested to see what else there was in the other areas of the scan results.

There are cookies there for winantispyware, winantivirus and drivecleaner.

I would be interseted to know if ButchN is experiencing any evidence of hijacking, misdirection of web pages whilst trying to surf, pop-ups etc. as all of these products are associated with a Vundo type infection, which is quite serious.

I can't see anybody deliberately visiting these products sites, to pick up those cookies, unless perhaps they had been 'hijacked' there by the infection.

[tom.tdw]

from the screenshot bunchN apperes to have netscape, only site guard (not cookie guard) protects netscape and that is currently still undergoing work (I'm running the unfinished version)

[ffwfire]

Tom is probably correct. I was going to say the exact same thing but realized Tom said it. In Butchn there is probably a way to take care of all cookies. I never used ButchN. It's the first time I heard of it.

You can probably delete the cookies from the browser, not even sure if you would use PG now if that will help you. PG probably doesn't support ButchN either.

If I were you I would change my browser. I use firefox, but only have the free version of Spyware Doctor. That doesn't have cookie guard, so I don't know if that supports it either, it probably does.

[allibear]

Tom is probably correct. I was going to say the exact same thing but realized Tom said it. In Butchn there is probably a way to take care of all cookies. I never used ButchN. It's the first time I heard of it.

You can probably delete the cookies from the browser, not even sure if you would use PG now if that will help you. PG probably doesn't support ButchN either.

If I were you I would change my browser. I use firefox, but only have the free version of Spyware Doctor. That doesn't have cookie guard, so I don't know if that supports it either, it probably does.

ButchN is the name of the person who posted the issue :) I think with just typing text, sometimes it is so easy to say things out of context and everything gets a bit muddled LOL.

My point is that some of the cookies listed indicate that there is a probability here that the cookies aren't the issue. Just delete them through the browser.

IF ButchN is infected with Vundo, deleting the cookies is not going to get rid of it. It is quite a nasty infection and may need a specialist fix, pending on how new the variant is and where the vendor's of the antispyware applications are at with the signatures for it. It's a Cat and Mouse game with these types of infection.

[ffwfire]

Lol okay I see now. If he is using ie 7 then all he has to do is go to tools/delete delete cookies and they will be gone after he clicks yes. It is always good to do that and delete the others too, history, temporary internet files just to clean some stuff up. Those 3 I would clean up on a regular basis.

No use worrying over a cookie. They are not harmful to your computer.

You can download PG for free and that will take care of it.

I never heard of Vundo trojan before, but I read about Winfixer. You're right though I looked Vundo up and it does install Winfixer, though I can't see Super Antispyware picking up all those cookies and not Winfixer. I think Spyware Doctor does an excellent job at detecting rougue programs too.

[tom.tdw]

vundo is probably the nastyest infection in cerculation at the moment

if it was a new variation of winfix it could have got through

superantispyware has always been quite good against vundo

you might want to run malware detective

[ButchN]

vundo is probably the nastyest infection in cerculation at the moment

if it was a new variation of winfix it could have got through

superantivirus has always been quite good against vundo

you might want to run malware detectiveGuys, even though I have the cookies, obviously something put them there, & yes, it's vundo.

I ran SuperAntispyware in safe mode & it detected vundo, something it didn't detect in regular mode.

PCT doesn't recommend using it in safe mode & it wouldn't initialize the engine.

BTW, even though SAPW detected & quarantined the 7 vundo infections, it's still here.

Oh, & it's my I.E. 7 being hijacked, not Netscape Tom.
I use Netscape for the ease of it's email client.

You mentioned superantivirus & malware detective, which ones would you suggest?

And yes, ButchN (N is the 1st letter of my last name) is my name! ;)

So anyone got any good suggestions to rid me of this?
I use Vista & was told to try AVG but it's not Visat compatible yet.

I don't know how this virus came to be as I didn't click a file to view a video, didn't click a site link I didn't not know & nope, didn't visit a porn site!

Thanks.

[tom.tdw]

hi
i recommend first you run malware detective then if you can't wait run panda activescan

sorry i meant superantispyware

[sprintman]

Just run CCleaner before you log out and you don't have to worry about all this stuff. If you use Windows and don't run CCleaner you need to have your head read!

[allibear]

I ran SuperAntispyware in safe mode & it detected vundo, something it didn't detect in regular mode.

PCT doesn't recommend using it in safe mode & it wouldn't initialize the

So anyone got any good suggestions to rid me of this?
I use Vista & was told to try AVG but it's not Visat compatible yet.

I don't know how this virus came to be as I didn't click a file to view a video, didn't click a site link I didn't not know & nope, didn't visit a porn site!

Thanks.

Have you ran a full scan with SAS in safe mode today. There where 10 new items updated/added to the database late last night for Vundo, you may get lucky second time around. Also check the box for 'scan alternate data streams' in the scanning options if it is not already check marked.

Go to AVG's site and recheck on the Vista compatibility, I thought AVG was now but I could be wrong, and it would be worth a scan in safe mode with that too, if it was.

Like Tom said you can run 'Malware Detective' in SD, and/or the Diagnostic Tool, (same thing), in SAS, and this will send reports to the vendor's so that signatures can be released for whatever bits are left of this infection.

Alternatively, if you don't want to wait, or while you are waiting, here are removal instructions using Vundo fix, there are several fix's that you may need to run, just print off and work through the document one step at a time.

http://www.bleepingcomputer.com/forums/topic18610.html

It's not as daunting a task as it looks, most of the time you will get it sorted with the fix without having to go into any manual deletion, again it depends on how recent the variant is versus the updated product.

Throw enough eggs at it and one will crack! :)

It is sometimes difficult to pin point how you got infected and these types of infection use devious methods to get into a system. Usually bundled with another download.

This is difficult to comlpetely get rid of, I wish you luck. ;)

[allibear]

Just run CCleaner before you log out and you don't have to worry about all this stuff. If you use Windows and don't run CCleaner you need to have your head read!

CCleaner is good but unfortunately it wouldn't be able to stop or remove a Vundo infection.

PS. Would be worth running for an 'after clean up though', after the infection is eradicated .

[sprintman]

I wasn't suggesting that. SAS and a-sqared handle that till PC tools get their act together. Windows users need CCleaner end of story. cheers..s

[allibear]

I wasn't suggesting that. SAS and a-sqared handle that till PC tools get their act together. Windows users need CCleaner end of story. cheers..s

Sorry LOL, I think it's just where the post appeared in the thread in context to the Vundo discussion, (there have been a few 'mix-ups' on this thread :D ).

Do you know if CCleaner is Vista compatible yet? It wasn't at the time I upgraded so I haven't used it for a while, but if it was now, I would have it back on.

[tom.tdw]

hi
ccleaner is vista compatible now:)

[ButchN]

Quick update, I tried to use AVG, but alas', AVG is only Vista compatable IF you buy it, which is a rip for us Vista users. :(

About the virus, it was vundo.

SuperAntispyware did updates to its program via a support ticket & PCTools Spyware Dr. was already updated, but it wasn't enough.

It took searching a few other forums via help from you guys here & getting those couple of vundo removal tools & that CCleaner.

It appears it is gone as I'm no longer getting popups & my HDD light is no longer constantly flashing like a K-Mart Blue light special! (My HP notebook uses all blue indicators hence my reference!)

Thanks again guys!

[allibear]

It appears it is gone as I'm no longer getting popups & my HDD light is no longer constantly flashing like a K-Mart Blue light special! (My HP notebook uses all blue indicators hence my reference!)

Thanks again guys!

Glad to hear you 'nuked' it Butch. Good work :)