Spybot wants to install

**Kodiak** · December 21st, 2008, 03:46 PM

I have a client that whenever she clicks on an email link it starts the spybot installer, anyone know what is going on here?

Winxp Home ED.

**NooNoo** · December 22nd, 2008, 03:41 AM

Spybot doesn't install like that - it's not spybot! I did have one bug that masqueraded as all sorts of things trying to get out passed the firewall...denied it and it morphed into something else. Anyway, run a full virus scan and then spyware (properly installed of course!)

**Kodiak** · December 22nd, 2008, 02:35 PM

Thanks for the reply NooNoo. I have run virus scans with Avast and spyware checks with spybot, mallwarebytes and combofix and have ran an hijackthis and checked that and all is now clean with the exception of Avast virus scan which picked up viruses in restore points which I have shut off system restore and ran a scan again and it was clean. I have since removed spybot and removed everything from the registry pertaining to spybot and it did make a change, now when you start Outlook (this is outlook 2000) and click on any link it will bring up my documents asking where the installer is to install spybot. Before the installer was on the desktop and it would run the installer but I have removed all spybot installers and now it doesn't know where it is. I have tried letting it install spybot when the installer was there and it would tell me there was a previous installation and it needed to remove it so I would let it do it's thing but still every time you click a link it wants to install it again.

2 things I'm thinking is uninstall office 2000 and reinstall or upgrade to 2003 or 2007.

I understand about viruses and trojans coming in emails but this is just any link.

**MobilePCPhysician** · December 22nd, 2008, 02:46 PM

Uninstall Spybot, reboot and install and run CCleaner.

**Kodiak** · December 22nd, 2008, 04:01 PM

Thanks for the reply MobilePCPhysician. I have tried that also. As far as I can see there isn't anything even remotely associated with spybot on the computer thus I believe is why Outlook 2000 wants me to point to the spybot.exe now. Even though I reinstall spybot or uninstall it Outlook 2000 won't see that it is there or not there.

I looked in Add-ins but it's not there either. Could there be an compatibility issue with outlook 2000?

**slgrieb** · December 22nd, 2008, 04:47 PM

I can't tell you about all versions of Spybot right off the top of my head, but for Spybot Search & Destroy 1.6, the installer is named spybotsd160.exe, and the main program file is SDMain.exe so Outlook is still looking for some piece of malware; not the legitimate Spybot Search & Destroy. You might uninstall and re-install Outlook 2000, but I' probably back it up, then use the Windows Installer Cleanup Utility to remove it, and then reinstall.

**Kodiak** · December 22nd, 2008, 09:09 PM

Thanks for the reply slgrieb. I think I will try just that when the snow clears and I can get out there. I'll report back if that works.

**CCT** · December 24th, 2008, 07:04 PM

2 related things that 'may' help;

http://support.microsoft.com/kb/290301

http://www.wilderssecurity.com/showthread.php?t=198284

**Kodiak** · January 5th, 2009, 11:29 PM

Strange as this may seem it ended up being an IE issue. Whenever you click on a link in an email it wanted to install spybot but when I made firefox the default it stopped doing this. All scans for critters came up clean.

**Niclo Iste** · January 6th, 2009, 01:38 AM

Interesting that it would do that. If it's something you can tinker with I'm betting if you uninstalled Spybot and ran the registry cleaner in ccleaner and then did a quick check with hjthis to remove any traces of spybot I bet it would fix it. Not to mention if you reset IE settings to it's defaults. I'm thinking that the integrated page/link scanner on spybot got corrupted while it was installing.

**Kodiak** · January 7th, 2009, 06:08 PM

I have tried

Reinstalling spybot and removing
I have ran ccleaner
Ran mallwarebytes
Ran spybot when it was installed
Reset all IE to default
Ran combofix
Ran Avast virus scan
Upgraded them to office 2003.
After all that ran Hijackthis

Yelled at it a bunch of times and gave myself a headache and the only thing that worked was setting forefox as the default browser.

I'm still betting a good drop kick would fix it right up.

Didn't try removing IE 7 which if I have to go out again that is what I will do.

**Niclo Iste** · January 7th, 2009, 06:17 PM

Originally Posted by Kodiak

I have tried

Reinstalling spybot and removing
I have ran ccleaner
Ran mallwarebytes
Ran spybot when it was installed
Reset all IE to default
Ran combofix
Ran Avast virus scan
Upgraded them to office 2003.
After all that ran Hijackthis

Yelled at it a bunch of times and gave myself a headache and the only thing that worked was setting forefox as the default browser.

I'm still betting a good drop kick would fix it right up.

Didn't try removing IE 7 which if I have to go out again that is what I will do.

Well there's you're problem! You didn't flip it off when you yelled at it! Drop kicking it is very stress relieving. I invested in a high durabilty tower just for such occasions. Curious how this is not resolving with all that you have done. I very well will have to ponder this further.

**slgrieb** · January 7th, 2009, 10:05 PM

Well, most of these issues are clear enough. The computer has had an infection of some variant of the W32.spybot.worm, but it's apparently been removed, so the system isn't actively infected, but it's still got a remnant or two left behind. I'd guess the infection installed a plug-in in Internet Explorer. The installation message occurs because the plug-in has been cleaned, but IE is still trying to load it. If you open IE7 in safe mode (no Add-ons) I expect you wouldn't see the message. So, if that's true, you should be able to use IE7's Manage Add-ons tool to find and kill the add-on. And no, it still has nothing to do with Spybot Search & Destroy.

**Kodiak** · January 13th, 2009, 04:17 PM

Thank Slgrieb. Right now they are living with firefox as their default browser but next time out by there I will stop in and see if what you suggest fixes the issue.