Start a Conversation

Unsolved

This post is more than 5 years old

5579

June 17th, 2009 04:00

Updates - June 17, 2009

Please refer to Calendar of Updates for today's updates.

The Calendar of Updates is devoted to bringing you the latest information about new and upcoming updates for almost every security software.

If anyone would like to discuss a specific update, please reply in this topic.

3 Apprentice

 • 

15.2K Posts

June 17th, 2009 06:00

(Please note my comments in the lower portion of this post...)

SpyBot 2009-06-17

Keylogger
+ InvisibleKeyLogger97
Malware
+ AdDestination + Fraud.AntivirusDoktor + Fraud.AntivirusPlus + Fraud.MalwareDefender2009 + Fraud.MSAntispyware2009 + Fraud.PCCenter + Fraud.PersonalAntivirus + Fraud.ProAntispyware2009 + Fraud.Sysguard + Fraud.SystemGuard2009 + MalwareProtector2008
PUPS
+ DAEMONToolsPro.Crack
Trojans
+ Virtumonde.sci + Virtumonde.sdn + Win32.Agent.jjv + Win32.FraudLoad.ie + Win32.Hidrag.a + Win32.Rbot.gen + Win32.TDSS.pe + Win32.TDSS.rtk + Win32.VB.mqz + Win32.ZBot
Total: 1433053 fingerprints in 490325 rules for 4696 products.

 

for those who use SpyBot's IMMUNIZATION** feature ---  which, in my opinion, is the main reason for average* users (XP or earlier) to keep spybot around nowadays --- be sure to RE-immunize after updating.

 

(*):  I am also a "fan" of SpyBot's TeaTimer (for XP only).   However, TeaTimer requires that the user respond to its occasional prompts to allow or deny various system changes.   Unless the user feels comfortable/confident doing so, it is preferable that a person NOT use TeaTimer, rather than risk using it haphazardly.

I do *NOT* advocate SpyBot for its scanner --- I believe MBAM and SAS are far superior.

 

(**):  Please be advised that there may be an issue with SpyBot's Immunization of Restricted Sites slowing down IE8 (some people are reporting that this conflict was resolved via the 9 June cumulative update for IE).   If you experience this problem, you will have to decide between the pros and cons, of extra protection vs. system slowdown.

Here's a "partial" solution:   SpyBot itself offers multiple layers of protection:  its SDHelper BHO for IE, its Immunization of Restricted Sites & Cookies (for specified/compatible browsers), and its HOSTS file protection (for all manners of internet access).   Admittedly, there are overlapping redundancies here, with each covering many (all??) of the same things.   Why?  Because, quoting PepiMK (the creator of SpyBot)  "There is malware attacking each layer, but rarely all [three], so we prefer multiple [redundant] layers".

HOSTS file protection is the first thing that "kicks in".   If a website is blocked by your HOSTS file (by virtue of a 127.0.0.1 local loopback entry for that site), no program [web browser, anti-virus / anti-malware, instant messenger, &etc.] will be able to access that particular website.   Meaning that, as long as your HOSTS file remains intact, IE will not have to "worry" about considering a duplicated list of restricted sites.   In other words, if you use SpyBot's Immunization to add its sites to your HOSTS file, then you don't also have to immunize against the same collection of multiple thousands of restricted sites that are currently interfering with IE8 running smoothly.   Be explicitly advised, however, that if you don't (also) immunize the restricted sites, and if malware somehow manages to attack and alter your HOSTS file, it will then leave these non-immunized restricted sites open to further attack you... meaning that this is not a "perfect" solution to the "congestion" problem... but it's certainly better than not using SpyBot's immunization at all.

----

This update has introduced another  Spybot/SpywareBlaster restricted site conflict, specifically, over

Red Sherriff (2) - imrworldwide dot com

Each time you hit the IMMUNIZE button in Spybot, it will remove protection from that site.   If you wish, you can then re-enable it via SpywareBlaster.

20.5K Posts

June 17th, 2009 11:00

Just released: Malwarebytes' Anti-Malware Version 1.38 (June 17th, 2009)

1. (FIXED) Minor issue with updating.
2. (FIXED) Certain types of freezing during full and quick scans.
3. (FIXED) Problem with Estonian language and installer.
4. (FIXED) Certain folders showing up as files in results list.
5. (FIXED) Scan time improperly displayed if Abort Scan clicked after Pause Scan.
6. (FIXED) Error during loading log files after database update.
7. (FIXED) Issues with freezing in protection mode. Certain conflicts with anti-virus software.
8. (ADDED) Some proxy support, please see /proxy command line parameter.
9. (ADDED) New command line parameters: /logtofolder, /logtofile (see help file).

Details: http://www.malwarebytes.org/mbam.php

336 Posts

June 17th, 2009 11:00

Deleted. Duplicate post.

1 Rookie

 • 

2.2K Posts

June 17th, 2009 21:00

I downloaded MBAM version 1.38 to both computers today. The process went well for the Vista computer, although there were apparently some updating issues early on according to the website. But on my XP machine I still get the "can't update" error message after the program appears to be updating for 30-40 seconds. The mod over there on the forum says it has to be either my AV...Avast, or my Firewall...Online Armor. I can't see where to navigate in Avast to include or exclude something. And Online Armor shows several entries "allowing" MBAM.

Taking it a step further, I checked to see if A Squared Antimalware might be the culprit, but once again could see no provision to include anything. Doubting that Windows Defender had anything to do with it, I looked at WinPatrol and could find no reference to MBAM in the Start Up menu section. Figured this might somehow be causing the problem. The program wants me to type a path to add MBAM to the Start Up menu, but  I am not sure how to do that, so any advice would be appreciated. All my other security programs show up in WinPatrol's start up menu, so don't have any idea if this is somehow causing the error messages.

Several other users have had  similar problems according to posts on MBAM's website, so the developers must have made some internal changes  to the program starting with version 1.37 that causes this conflict. I think they are reluctant to admit to it or to fix it. I have not changed any settings or security programs after version 1.36 and before 1.37. I did delete WinPatrol temporarily but that had no effect, added it back.

June 17th, 2009 22:00

   TeaTimer saves me many times while surfing but I use VISTA Premium SP1 and it works well.  But I also have Webroot Anti-Virus with AntiSpyware

while I use the McAfee Security Suite given to me by Comcast. Although both are anti-virus programs and supposedly 2 anti-virus

programs cannot run at once on one machine,but they do on my Dell Inspiron 1501. I also use WinPatrol to monitor any changes

to my processes. However, there is something called Joke/Shake,i.e.: JS/Joke-Shake \AppData\Local\Mozilla\Firefox\Profiles\h8dwi0p3.default\Cache\19AA94Dd01

which cannot be removed by anything except closing my web browser and then using CCleaner.com to Anlyze and then Remove a lot of temporary

memory.

 

3 Apprentice

 • 

15.2K Posts

June 18th, 2009 06:00

Willprospector,

I don't know if your mention of TeaTimer on Vista was in response to my comment that I'm a fan of TeaTimer on XP (only)... or if the placement of your comment here was purely coincidental.

As noted above, TeaTimer indeed has value, for those who can properly reply to its occasional prompts.   VISTA has significantly better built-in security (in the form of UAC) than XP, so it should duplicate many of TeaTimer's warnings.   If you don't mind the duplications... or if you find that TeaTimer actually provides you with security that Vista doesn't, then more power to you!  :emotion-1:

As for running two resident anti-virus programs without you actually noticing any problems:

1) odds are that your system is in fact being slowed down, as BOTH of the anti-virus programs are monitoring/scanning all executable files as they're being opened.   Your system should run faster with only one anti-virus program being resident.

2) an outright "conflict" between the two may be waiting until a virus actually attempts to impact your machine, at which point, the two anti-virus programs may suddenly find themselves in a "tug-of-war" to see which one will remove/quarantine the virus.

I believe it would be prudent of you to remove one of the antivirus programs (suites) NOW, rather than risk a headache later.

3 Apprentice

 • 

15.2K Posts

June 18th, 2009 06:00

Dale,

I am using avast on XP, and had no problem updating mbam, so i doubt that's the culprit in your case.

As for a start-up entry in WinPatrol, assuming you are using the free version of MBAM, its installation should place a Run-ONCE entry into your registry (and WinPatrol's startup list).   upon rebooting, that entry will run, be "used", and then disappear --- having run ONCE, it's done --- so you won't find it listed again   [if you have the paid version of MBAM, the situation will be different].

my suggestion... try uninstalling MBAM.  reboot.   download and install MBAM again.   confirm the presence of the Run-ONCE entry in winpatrol's startup list.   reboot.   confirm the run-once is now gone.  and then try running MBAM to see if it's working any differently.  

EDIT:   Just to clarify, are you saying you were unable to update the PROGRAM from 1.37 to 1.38 ???  or that after updating the PROGRAM to 1.38, you were then unable to update to the latest DATABASE?

1 Rookie

 • 

2.2K Posts

June 18th, 2009 07:00

Thanks David:

Version 1.38 downloaded and installed OK, then when I looked for updates I got the error message. I'll try what you said and see if it shows up in the Start Up menu. It's just kinda weird, because on the Vista machine with the same programs it works correctly. :emotion-43: 

EDIT: It went ahead and ran once...same symptom before and after the reboot. I think there is some problem between my computer and their server...based on the time delay for when the error message comes up. I'll go back to that forum and continue the saga. Guess I could just download each new version and scan once! :emotion-15:

3 Apprentice

 • 

15.2K Posts

June 18th, 2009 14:00

Dale wrote:  "I think there is some problem between my computer and their server..."   If so, shouldn't that equally impact what happens on your Vista machine?

I've been reading about the lag some people are experiencing in waiting for 1.38 to complete installation... the installer drops-off from the screen, is seemingly gone for quite a while... but eventually pops back to report the installation is complete.   Thinking back, I noticed that as well... on more than one machine... but it didn't phase me at the time.   But on reflection, I would have to conclude there's a problem ---- or else, a significantly new CPU-intensive installation procedure --- with the latest version.

Since I'm taking for granted your system is clean, and you like to have MBAM around and up-to-date "just in case", I would suggest you wait a few days to see how all this plays out.   Hopefully, someone will locate the problem and they'll issue a newer version.

June 22nd, 2009 18:00

   You believe it would be prudent to remove something that works very well although,technically,it is

not supposed to. This is why I do it:  1. Before I  added the Anti-Virus to my Webroot SpySweeper,

McAfee would come up with a little orange message that said "your is not being protected", so you

click on the orange icon and and McAfee pops up with a sign saying "System Guard not working",

click to FIX System Guard so you click FIX and the wole process takes 3 minutes maybe,in the

meantime, my computer in User mode, does not have System Guard enabled.  Well, what is

happening when when it is not enabled?   God only knows. So I now have Webroot Anti-Virus

and Spyware enabled all the time so I do not need to worry so much. As to the speed of my

computer while I have both, I do not CARE. I want to be secure. And it works and I never have

problems with viruses. I do not notice any difference in speed, I am pritected and your

argument is only an argument that seems plausible. But seeing how I have been doing

well for at least a half year, I am the pro at it and other people can follow my lead. I say

this because when I get on any spyware forum with a problem, which has not happened

with this configuration, none of the Experts can solve my problem. They just ask me to do what I have already done

and I end up solving the problem wit the exception of the Geek Forum who are absolutely fantastic.

I do rootkit removals and I own Software restore programs. I understand the "tug of war" scenario

and what I have found is whoever gets there first gets to quarantine it. I also intend to put

another 1GB of memory in my system. But speed is not an issue. I always clean my temporary files

with CCCleaner. If ou were able to give me some insight into Joke/Shake then I would consider

honoring your ability. The only thing I can find is to use CCCleaner to erase it in temporary memory.

None of my Registry cleaners seem to be able to touch or find the file even when directed to it.

    Tell me about Joke/Shake    and how    pdf.php  can lock my whole computer and I have to reboot.

I cannot use Windows Task Manager to Disable   my browser. These are the real mysteries.

Reply to: Re: Updates - June 17, 2009 - DELL COMMUNITY

1 Rookie

 • 

5.8K Posts

June 22nd, 2009 19:00

With all due respect, Willprospector, it is you who is having problems with this Joke/Shake problem.

Every reputable expert I know advises against using 2 anti-viruses in real-time, and for solid reasons. You choose to ignore this advice, and wonder why you have problems?

You also mention your "Registry Cleaners" can't remove it. Every expert I trust advises against using registry cleaners. See this for reasons why: Do I need a Registry Cleaner?

This is not a malware removal forum. I suggest you visit one:
http://spywarehammer.com/simplemachinesforum/index.php?board=10.0
http://en.community.dell.com/forums/3521.aspx

No Events found!

Top