Trouble Starting Safe Computing

Started Building my fortress yesterday, but ran into a problem. I'm going through Doug's Tools and practices step by step, and using posts from Abydos and tallin where they list the programs they use as a sourse. I chose Avast AV as my anti- virus(already had it), and downloaded Comodo Pro Firewall along with BoClean Anti-Malware. During the Comodo set-up I elected firewall only, but under firewall I selected the highest security; I beleave it is called Dedfence+. Spywareblaster was the next download, and that is where the problem started. I received a bunch of Comodo Defence+ alerts saying "spywareblaster.exe was trying to modify a protected registry key". I allowed a bunch of them, thinking they were evil addresses, but they never stopped. This morning I tried to get to the Spywareblaster help, but when I click on it nothing happens. I tried to run Spywareblaster and of course the alerts returned. I left the alert "up", in fact it 's up now, and I notice that it changes periodically. the key is: HKLM\SOFTWARE\Classes\CLSID\{3B6C15BE-F9FD-7E15-F865-ABA8E2A09915}\tySipTamJtc. It's only the part after the last \ that changes. Any help would be greatly appreciated. I'm sure it is something simple, but I would only be guessing. Hope I didn't mess up allowing several of these. Thanks, Billed

Hi Billed

A important feature in Comodo Pro Firewall you have to learn is the install mode.
It will temporarily lower comodo's defenses, so it is imparitive that when you install
things you don't surf and watch / hear video's and music, etc. etc.

If you double-click the comodo shield, notice the line in the bottom right corner, in the
main window. Simply click once, and it is in installation mode. You will get a popup
very 25-30 seconds or so, where comodo will ask if you would like to switch back to normal
mode, just in case one forgets it.

When installing SpywareBlaster, and you know nothing else is going on, it is safe
to answer allow and remember my answer

So basically, if I were you. I would uninstall SpywareBlaster and install it anew. You
might have to address any previous blocks by comodo (Those you answered no to)

To do this, open comodo once again, press the Defence+ tab, choose advanced radio
button to the left, access Computer security policy (First one by default) Find anything
related to SpywareBlaster, and click remove with the radio button to the right.

Hope this will help you along, otherwise you are welcome to ask ahead


Regards

Hey Abydos, Thanks, I printed your post, and I'm off to work at it. I'll let your know how I do. Billed

Hey Abydos,
Thanks, I printed your post, and I'm off to work at it.
I'll let your know how I do.

Billed

Hey Abydos, Things rarely go as I plan when I turn on the computer. I followed your instructions yesterday wound up with the same problem. I had removed all the Spywareblaster entries under Computer security policy and clicked apply. I went back to Computer security and found the first entry was Spywareblaster.exe. removed it again, but it just kept returning with the next Defence+ alert. Thought I would ask for more help this morning. logged on to WTT and then ran Spywareblaster so I could get the exact character sequence in the Computer security policy entry. Everything changed at this point. A window popped up suggesting I change to Instillation Mode. I closed my WTT connection and went to installatoin mode and everything went smooth as silk!! When I reinstalled Spywareblaster yesterday, I unclicked run Spywareblaster and clicked finish. Next I got out of installation mode and then ran Spywareblaster. Obviously got out of installation mode too soon. Ayydos YOU DA' MAN!——thanks. I would like to ask for a little more help(ok a ton more). Comodo is telling me I have 13 files my review. Three of them are Recycled\dcn.exe where 'n' is a number. two of them are from Javacool Software and one is from Lars Hederer. I think these are installation programs I've sent to the recycle bin. the rest are dlls or exe files related to programs like Avast, Secunia, Spywareblaster, and FireFox. The Radio buttons at the right are confusing. Does remove mean remove from the list or remove from computer? What does purge mean? I'm cautious here, since I put a hole in a CD driver in the past mishandling Avast. Some advise on handling these would be greatly appreciated. I don't know how they became untrusted. Thanks Again, Billed

Hey Billed

The review files, are files that the parent programs have altered themselves in some way.
Also deleted files shift status, hence you will see them also. Its not a feature one use very
often, but it is there for convinience if you suspect a parent program have been altered with-
out your knowledge, and you would like to see just which file it is.

Purge: Will purge the files for whatever malicious code there may be embedded in the altered
version. Using Comodo's own anti-malware engine to do so.

Remove: Will remove the entry from the list. It may re-appear if the parent program alters it again.
Usually updated files will appear there, or files that gets altered frequently.

Its nothing to worry about, its just a added layer of security. Usually, if you don't suspect any
fishy going on, its safe to check / tick all, and choose remove.

And glad you got SpywareBlaster installed


Regards

Ps: Awaiting the next ton of questions, but I won't be available this afternoon.

Thanks Abydos, That's a great help. I'll be back, Billed

HEY, I'm finally back, and a bit wiser. JavaRa, SpywareBlaster, and Spybot Search & Destroy are now on my all programs list. I've studied the using SpywareBlaster, Spybot S&D tutorials on bleeping computer. I immunized,created restore points, and scanned. Spybot found 81 infections –ouch. Both the full report and the results report are saved. Allowed Spybot to destroy all but two of the malwares (red entries). These were Microsoft.WindowsSecurityCenter.AntivirusOveride:[SBI $3604910C] Settings, and Microsoft.WindowsSecurityCenter.AntivirusOveride:[SBI $0C94D702] Settings and under kind were called Registry change. Should I allow Spoybot to destroy these? I was surprised when I went to " Recovery" and found no entries in the backup list. I thought that since I had just destroyed many malware entries there would some entries. Why is the list empty? Observation: It was totally interesting that the bleeping computer tutorial mentioned under black entries (internal system settings) that it could be missing help files. None of my help buttons work, but my Spybot scan report had no black entries –all red. Again any help is appreciated! Y'all have a great day, Billed

Hey again Billed

First off, 81 infections? You sure that they were all red? No green / bluish entries with missing checkmarks?

Green Entries - These entries are usage tracks. Usage tracks are fingerprints left in your system that contain information about what you have done in the past with your computer. Information that is typically stored in these usage tracks are last open files, last used directories, web sites that you have visited, or files that you have opened. Fixing these entries can cause no harm to your system so if you would like to remove them, there will be no harm done.

The two red you mention about the security center, you can ignore. It is Spybot telling you that one or more
settings within the Windows Security Center have been changed to something else than default settings.
Like, if you have instructed the security center that you will monitor your Anti-virus, instead of windows doing it.

You should ignore those red entries if, and only if, you know that you have changed some settings yourself.
http://www.safer-networking.org/en/faq/46.html

I was surprised when I went to " Recovery" and found no entries in the backup list. I thought that since I had just destroyed many malware entries there would some entries. Why is the list empty?

See above. I don't think all those entries was malware. But, it would still be a good idea to go visit the malware forum,
just to be on the safe side of the fence.


Regards

Ps. Just a funny one, Billed means Picture in danish