Spybot Search and Destroy eats Tablet PCs

Mickey Segal sent me an email detailing a problem with the latest version of anti-spyware program Spybot Search and Destroy running on Tablet PCs.  This from Mickey:

The latest updates for the anti-spyware program “Spybot Search and Destroy” (http://www.safer-networking.org/; most updates dated 3 November) seem to recognize some key Tablet PC functionality as a threat and delete it.  The damage can be undone with Windows XP System Restore.

Spybot detects what it refers to as “Smitfraud-C.Toolbar888″, and flags the following registry entries as problems:

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinLogonNotifyTabBtnWL
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinLogonNotifySebring

It offers to fix the “problem”, and if you then re-boot you find that the “Change tablet and pen settings” icon is missing from the tray and many Tablet buttons are disabled (on Motion Computing LS800 the Escape, Function, 5-way directional control button, Motion Dashboard button and Rotate Display button, yet the programs seem to launch properly if invoked by clicking on shortcuts).

System Restore to a time immediately before running Spybot fixes the problem.

I’ve reproduced this problem in a case in which the only item I allowed Spybot to fix was “Smitfraud-C.Toolbar888″.

I don’t know a lot about the Windows Registry or Spybot, so it would be good if others could check the plausibility of my concerns and help take appropriate action.

This is a serious problem so all Tablet owners running Spybot take notice and make sure you have a good System Restore image to fall back on. Thanks, Mickey!


Comments have been disabled for this post