Shirley Crabtree Posted October 26, 2005 Report Share Posted October 26, 2005 I was recently asked to look at a relatives Pc as there was obviously something amiss.AVG found nothing...Spybot S&D found nothing in particular...Trojan Hunter found nowt...MS Antispyware found sod-all and Adaware flagged the usual cookies :rolleyes: I KNEW there was something wrong so ran a pandascan...It found 219 spyware .exes all over the HDD but it doesn't disinfect these files....Great thinks I....219 files to manually delete in safe mode.Then I remembered about Nellie telling me about Ewido...I did an online scan with Ewido :-http://www.ewido.net/en/And lo and behold...It found 219 spyware files and deleted the lot of them.Why doesnt Spybot S&D,Adaware or MS Antispyware see these files?...Thats what I'd like to know :SSpyware is evolving!!!!The trusted old safeguards dont seem up to the job nowadays :( Quote Link to comment Share on other sites More sharing options...
ɹəuəllıʍ ʇɐb Posted October 27, 2005 Report Share Posted October 27, 2005 Interesting! I just ran the Ewido online scan, and it found over 500 spyware cookies that CCleaner did not see. Downloaded Ewido and ran it, it found even more! I wonder where all these cookies were hiding...? Quote Link to comment Share on other sites More sharing options...
CurlyWhirly Posted October 27, 2005 Report Share Posted October 27, 2005 Interesting! I just ran the Ewido online scan, and it found over 500 spyware cookies that CCleaner did not seeThat seems rather a lot of spyware cookies - 500 :o Spybot, Ad-aware and a-squared occasionally find a few spyware cookies on my PC.Incidentally, I also ran Ewido online scan and it only found 1 spyware cookie which was a false positive as the so called spyware cookie was in actual fact a PC forum that I am registered with! Quote Link to comment Share on other sites More sharing options...
Thos Posted October 27, 2005 Report Share Posted October 27, 2005 I ran Ewido also and it found 2 "high risk" spywares lurking. It took about 15 minutes against about 35 minutes for AVG, 20 mins for a-squared and about 3 for Spybot. Anyone know if the time taken to do these scans bears any relation to their thoroughness?Thos. Quote Link to comment Share on other sites More sharing options...
-pops- Posted October 27, 2005 Report Share Posted October 27, 2005 I think AVG and Ewido look for different things.I am quite impressed with Ewido. Just tried on my other machines and found a few bits of malware on both - missed again by my previous scanners. Quote Link to comment Share on other sites More sharing options...
dadyassa Posted October 27, 2005 Report Share Posted October 27, 2005 Just ran ewido, 26 infections including a dialer generic ? Quote Link to comment Share on other sites More sharing options...
andsome Posted October 27, 2005 Report Share Posted October 27, 2005 Just ran a second scan. What am I doing right that everyone else is doing wrong? Quote Link to comment Share on other sites More sharing options...
-pops- Posted October 27, 2005 Report Share Posted October 27, 2005 Looks pretty good andsome. Have you done the full download and scan from that yet?As I said, I only got a few minor things on mine - perhaps it indicates how pure our Internet activities are :P :blink: Quote Link to comment Share on other sites More sharing options...
catgate Posted October 27, 2005 Report Share Posted October 27, 2005 I went and looked at the Ewido site and it seemed to me that we W98 luddites are left out on a limb. Maybe that means we are not worth attacking??? Quote Link to comment Share on other sites More sharing options...
andsome Posted October 27, 2005 Report Share Posted October 27, 2005 Looks pretty good andsome. Have you done the full download and scan from that yet?As I said, I only got a few minor things on mine - perhaps it indicates how pure our Internet activities are :P :blink:I did the online scan. Quote Link to comment Share on other sites More sharing options...
doug Posted October 27, 2005 Report Share Posted October 27, 2005 Just tried the online scan from Ewido and like andsome it found nothing. In fact it did the scan in under a second and said done. Wonder if it's working properly. I did notice that it was a beta version.Should we start a fresh topic on this? Quote Link to comment Share on other sites More sharing options...
andsome Posted October 27, 2005 Report Share Posted October 27, 2005 Just tried the online scan from Ewido and like andsome it found nothing. In fact it did the scan in under a second and said done. Wonder if it's working properly. I did notice that it was a beta version.Should we start a fresh topic on this?I don't think that that was right. My scan took several minutes. Quote Link to comment Share on other sites More sharing options...
doug Posted October 27, 2005 Report Share Posted October 27, 2005 Well just downloaded the trial package and did the scan. Took about 40 mins and found 61 iffy's. Quote Link to comment Share on other sites More sharing options...
-pops- Posted October 27, 2005 Report Share Posted October 27, 2005 Should we start a fresh topic on this?Good idea - you've got the know-how :D Quote Link to comment Share on other sites More sharing options...
doug Posted October 27, 2005 Report Share Posted October 27, 2005 Hope I've done this properly folks, really I'm just a beginner at this shuffling about stuff. :unsure: Quote Link to comment Share on other sites More sharing options...
nellie2 Posted October 27, 2005 Report Share Posted October 27, 2005 Ewido is very good, it is advisable to check which files it wants to clean and delete though as it has been known to come up with the odd false positve, although that was a while ago. Quote Link to comment Share on other sites More sharing options...
ɹəuəllıʍ ʇɐb Posted October 28, 2005 Report Share Posted October 28, 2005 After cleaning 6 registry entries and the 500+ spyware cookies (using the downloaded trial version), I ran the online beta scan again. It found ... 500+ spyware cookies! :ninja: So this time I had a closer look at where these "hidden" cookies are kept, as Ccleaner did not find any of them. They are inC:\Documents and Settings\myuserid.DOMAIN\Application Data\Mozilla\Firefox\Profiles\m83os0gp.default\cookies-1.txtC:\Documents and Settings\myuserid.DOMAIN\Application Data\Mozilla\Firefox\Profiles\m83os0gp.default\cookies-2.txtC:\Documents and Settings\myuserid.DOMAIN\Application Data\Mozilla\Firefox\Profiles\m83os0gp.default\cookies-3.txtC:\Documents and Settings\myuserid.DOMAIN\Application Data\Mozilla\Firefox\Profiles\m83os0gp.default\cookies-4.txtC:\Documents and Settings\myuserid.DOMAIN\Application Data\Mozilla\Firefox\Profiles\m83os0gp.default\cookies-5.txtNow that is curious - is this where Firefox keeps its cookies? If this is the case, then neither Ccleaner nor Ad-aware nor Spybot S&D knows about this.I will post a query in the Firefox forum and report back here. Quote Link to comment Share on other sites More sharing options...
ɹəuəllıʍ ʇɐb Posted October 28, 2005 Report Share Posted October 28, 2005 Ok, I think I got it now. Firefox cookies are kept in this fileC:\Documents and Settings\myuserid.DOMAIN\Application Data\Mozilla\Firefox\Profiles\m83os0gp.default\cookies.txtThis file has today's date, and is rather small. The other files with the numbers in it are older - some dating back to November 2004. I think they are kind of backups from the actual cookies file. All spyware cookies detected by Ewido were in these old files, not in the actual cookie file.I am going to delete these old files now. Quote Link to comment Share on other sites More sharing options...
rong Posted October 28, 2005 Report Share Posted October 28, 2005 I did this and my FF wasn't happy this morning. A couple of shutdown and restarts put it right. May not be related. Quote Link to comment Share on other sites More sharing options...
illukka Posted October 28, 2005 Report Share Posted October 28, 2005 could be that most of the ewido findings were located in system restore folder(s)unlike most scanners ewido is able to clean those..it is a very efficient malware solution. boasting a hi-tech scan engine with code/unpacker emulationi recently received a 3.2 MB scanlog(list of infections:o ) from someone whose machine i was cleaningi bet you guys dont use spywareblaster, it prevents the spyware cookies even for moz/FFedit: i just found the report of my lastest ewido scan some weeks ago, thats 12,8 MB and i dont even have archive scanning enabled :o Quote Link to comment Share on other sites More sharing options...
nellie2 Posted October 28, 2005 Report Share Posted October 28, 2005 could be that most of the ewido findings were located in system restore folder(s)i bet you guys dont use spywareblaster, it prevents the spyware cookies even for moz/FFI do... :) I've been banging on about it for years it seems now. Quote Link to comment Share on other sites More sharing options...
illukka Posted October 28, 2005 Report Share Posted October 28, 2005 Nel, you probaly dont have 500 infected items, at least not cookies !if you enable restricted sites and moz/FF protection in spyware blaster the ewido reports will be shorter Quote Link to comment Share on other sites More sharing options...
rong Posted October 28, 2005 Report Share Posted October 28, 2005 I do to (spyware blaster) I only had 23 ewido things all FF cookies, medium security. Quote Link to comment Share on other sites More sharing options...
illukka Posted October 28, 2005 Report Share Posted October 28, 2005 let me guess, they were located at C:\System Volume Information\_restore, right ? Quote Link to comment Share on other sites More sharing options...
rong Posted October 28, 2005 Report Share Posted October 28, 2005 Not sure, will do another and let you know. Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.