Spybot Search & Destroy is a free (for personal non-business use) anti-spyware/spyware removal program used by millions of people around the World, to protect their computers from spyware, adware, Trojans and other types of malware. Spybot updates for malware detections are released every Wednesday and this week's updates were released on schedule. If you are using Spybot S&D to protect your computer you should check for updates every Wednesday afternoon and apply all that are available.
Malware writers are constantly modifying their programs to evade detection, so anti-malware vendors have to issue regular updates to keep up with the bad guys. New definitions and false positive fixes for Spybot Search and Destroy are usually released every Wednesday. This week's updates were released on schedule, as listed below. These detections include new or modified fake (rogue) security programs (fraudulent anti virus/spyware; scareware) (Malware), Trojan downloaders, password stealers, rootkits, DDoS attack bots and spam bots. It is imperative to keep your security tools updated and scan frequently for malware threats.
Note: one + sign before a detection indicates an update to an existing malware family for which previous definitions have been released. Two ++ signs indicate a completely new detection of a new or rewritten malware type.
An anti-spyware program that is updated once a week cannot protect you from malware threats created or modified and released in the last 24 - 48 hours. If you want realtime protection against the most current spyware, keyloggers, rootkits, rogue anti-virus and security programs, Trojans and other forms of malware, with very frequent automatic updates, scheduled malware scans and the blocking of known-hostile IP addresses, you should try
Malwarebytes Anti-Malware.
Definition updates made on 08/11/2010
Malware (Fake anti-virus, etc)
+ ErrorSafe
+ Fraud.Antivirus
+ Fraud.InternetSecurity2010
+ Fraud.Sysguard
+ Win32.FraudLoad.edt
Trojan (Bots, Trojan downloaders, rootkits)
+ Virtumonde
+ Virtumonde.dll
+ Virtumonde.prx
+ Virtumonde.sdn
+ Win32.Agent.fbx
+ Win32.Agent.sc
+ Win32.Bifrost.gen
+ Win32.FraudLoad.ss
+ Win32.Muollo
+ Win32.OnLineGames.noa
++ Win32.OnLineGames.tojy
++ Win32.OnLineGames.tolh
++ Win32.OnLineGames.tolu
++ Win32.OnLineGames.tomw
++ Win32.OnLineGames.tonk
++ Win32.OnLineGames.tooc
++ Win32.OnLineGames.toqk
++ Win32.OnLineGames.tote
++ Win32.OnLineGames.totl
++ Win32.OnLineGames.totv
++ Win32.OnLineGames.tozi
++ Win32.OnLineGames.tpct
++ Win32.OnLineGames.tpei
+ Win32.ZBot
Total: 3090503 fingerprints in 1057887 rules for 5711 products.
False Positives Reported This Past Week
There were 2 false positives reported this week.
1: A file named ww1138.exe - an update for win3.1x calculator, was detected as Win32.Monderb.aqpu. This has been fixed with the current updates.
2: A confirmed false positive was fixed today for "Win32.Wemon.sh" - [SBI $1ACF3A39] Settings (Registry change, fixed) - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\
Aways make sure you are using the current version of Spybot S&D, before updating definitions or scanning. Older versions tend to give false positives, or fail to adequately remove detected malware.
Notes about the detection categories
If you see updates in the "PUPS" category, this means Possibly Unwanted/Unpopular Programs. They appeal to many social networkers but may track your surfing habits and report on your computer configuration, without your explicit knowledge. These often include some smiley programs, screensavers and browser toolbars.
"Spyware" includes applications that track your surfing and report to a third party without your permission.
"Keyloggers" record your keystrokes and steal logon credentials to your bank, trading company, website and server control panels, PayPal, eBay, etc.
"Malware" means Malicious Software and includes among other things - fake/rogue anti virus, anti spyware, system security and registry scanners and infection alerts. These often appear on hostile websites, or websites that have been hacked to redirect you to places where false alerts and scans are launched. The goal is to panic you into purchasing the program to remove the (fake) infections. This is really a soft form of extortion and is generally referred to as scareware and rogue security alerts.
Note, that people who pay for scareware to remove the fake alerts are giving their credit or debit card numbers and security codes to criminals. Most live in the former Soviet Union and are associated with the RBN.
"Trojans" pretend to be a required missing Codec, Flash update, plug-in, or news report, or porn player, whereas they are really the worst malware that installs remote control (Bot) software and rootkits into your PC. Like the Trojan Horse of ancient Troy, once installed, Trojan Horse programs hand the keys to your PC castle to cybercriminals!
Installing or uninstalling and Immunizing Spybot S&D
Installing, upgrading to a new version, or uninstalling Spybot requires Administrator level privileges. Updating definitions does not require these permissions most of the time. But, to immunize against all threats does require Admin privileges. If you. like me, operate as a Power/Standard User, you can right-click on the icon to launch Spybot S&D and Run As (an) Administrator. From there you can download the latest definitions, immunize completely and scan/disinfect with full administrator authority.
Updating Spybot Search and Destroy
Before you update Spybot Search and Destroy make sure you have the latest official version. Older versions are no longer supported and will cause you a lot of grief when you immunize and scan for problems. Only download Spybot S&D from the official website, at: spybot.info, or from its alternate domain: Safer-Networking.org. Fake versions with similar names will rip you off for payment to remove threats, whereas the real Spybot Search & Destroy is free for personal use. No subscriptions, no download fees, but, donations are gladly accepted.
In case you are new to Spybot S&D, there are two ways to update the program and malware definitions. The preferred method (For Windows PCs) is to go to Start > (All) Programs > Spybot - Search & Destroy > Update Spybot - S&D. The independent update box will open. Leave the default options as is, unless you need all languages or want beta definitions, and click on "Search." Another box will open with "mirror" locations around the world where you can download updates. Select a location nearest to you from the list and click on "Continue." Make sure all updates are checked, then click on "Download." If all definitions are verified as being correct the check marks will disappear from the check boxes and be replaced with green arrow graphics. However, sometimes one or more mirror locations have not updated all of the definitions and you will get a red X for those definitions. Click on Go Back, select a different mirror, and try again. I have consistent success using Giganet or the Safer-Networking servers. When all updates have succeeded, click on "Exit."
You can also download the latest definition includes file from a clean PC and save them to a removable disk or drive, then install them into the Spybot S&D program while the infected PC is offline. This helps you disinfect a PC that cannot presently get online, or cannot access security websites for updates (because of the Conficker or similar malware), or due to other networking problems. The downloaded definition includes will look for a typical Spybot installation location and will update it instantly, as long as the program is closed during the updating process.
Download links and more instructions about using Spybot Search and Destroy are in my article titled "How to use Spybot Search & Destroy to fight malware".
TeaTimer false positives
In the case of Teatimer false positives that are fixed by updates, TeaTimer will have to be restarted after the update is applied. TeaTimer cannot be updated with new definitions if it is still running! After you update definitions to fix false positives, a restart of either TeaTimer or the Computer is required. If this doesn't fix the false positives, you may need to reset the TeaTimer detection list, as follows:
Right click the (TeaTimer) Resident tray icon
Select "Reset lists"
Alternately, close and restart TeaTimer using this method:
* start Spybot S&D
* switch to advanced mode
* navigate to "Tools" , then "Resident"
* uncheck the check box for Resident TeaTimer to close TeaTimer
* wait a bit so TeaTimer can unload completely, for instance wait 1min
* check the check box for Resident TeaTimer again to restart the TeaTimer
If that fails also, please read the rest of the things to try on this forum page, in replies #2 and #4.
When TeaTimer blocks the file you can also allow the file to be executed (also remove the check mark for deletion). You can exclude any file from further detections during a scan by right clicking the items in the Spybot S&D scan result and select "exclude this detection from further searches"
Malware fingerprints are frequently changed by their purveyors, to slip past definition based anti-malware tools. As malware detections and behavioral analysis modules increase in complexity, so does the possibility of false positives. For this reason it is often a good idea to quarantine suspected malware rather than deleting it, until the next weekly Spybot definitions have been released. Scan the quarantined items again and if they are still detected as malware, delete them after a week or two. You can also open a new thread on the Spybot False Positives Forum to see if your detection is real, or a false positive.
If you are running several brands of security software, make sure that only one active protection (realtime monitoring) feature runs at a time. In case you want to deactivate the TeaTimer, to avoid conflicts, you can do this in Spybot S&D advanced mode in Tools - Resident, as described above.
back to top ^
