Weird Incident with SpyBot 1

[seaport]

Just want to shared my terrifying experience on the weekend.

I was working on my Windows XP laptop and setting it up with LogMeIn remote access. I tested it on another PC and the remote access worked fine. Somehow right after I remotely logged on to the laptop, the Spybot S&P showed a warning - something like that an important registry change is about to make and it asked my permission. I did not understand the warning at all so I clicked "DENY". Continuously a dozen similar warning appeared and I answered "DENY" for all of them.

After that, something terrible occurred. I could not run any program (exe or com), even through command line, and no shortcuts worked, and I got the following error every time I tried.

"This file does not have a program associated with it for performing this action. Create an association in the Folder Options control panel."

It appears that SpyBot changed my registry so XP did not know what to do with executable files, although XP was still running fine, and if I clicked a Word file, Word software started.

Because I could not run any executables, I could not start SpyBot to undo what I did, neither could I start the Registry Editor to change registry. I could not start XP system restore, and neither could I start some private Recovery tool coming with my laptop. In other words, XP was completely paralyzed.

Eventually I googled some info. I rebooted the system into the safe mode command line, where I could start the system restore using DOS command. The problem was fixed after the restore.

I still had no idea what SpyBot did. Note that when the incident occurred, the user was on a non-administrative account.

Seaport

 

[linney]

As an Administrator go into Spybot S+D, on the top toolbar next to "File", under the heading of "Mode", set the mode to "Advanced". This will allow you access to further Spybot settings.

In Advanced Mode click "Tools" (bottom left of the main Spybot window. Select "Resident" and uncheck the option for "TeaTimer" which is the part of Spybot S+D which controls access to Registry locations.

After doing this you will not be bothered by Registry warnings as Spybot S+D will cease monitoring the Registry.

 

[seaport]

Thanks Linney,

I've been using Spybot for a while and had no problem. I have both Windows Defender and Spybot installed on my XP. Do you think this is a overkill?

Whenever I install something Spybot always gives me some warning, but Windows Defender never did. As a very cautious user, I think Windows Defender might be enough for me.

Seaport

 

[linney]

It is a purely personal decision as to what security applications you install, a lot of governing factors might be the sort of surfing you do and whether you feel at risk and also any previous history and run-ins with malware and other baddies.

I stopped using the "TeaTimer" a several years ago because of bad programming, probably things have changed since then. Rather than running a myriad of "realtime" scanning I just run regular manual scans when the machine is not busy. This is quite often as I hate seeing a machine idle if it is switched on. The exception is that I have an antivirus and Windows Defender running in "realtime". Also I don't surf as an Administrative user.

To answer your question, no, I don't think it is overkill.
I'm still waiting for Windows Defender to find some malware (other than MsConfig which it use to delight in flagging as an evil program).

 

[seaport]

Thanks again, Linney.

Seaport