SpyBot And Tablet PC Incompatibility Issue

I’m on the road enjoying time away from Tablet PCs and the connected life this weekend. But I ran across this bit of news that needs to be shared. Apparently the latest update to SpyBot Search and Destroy will do some damage to Tablet PCs, so if it is a part of your security arsenal (as it used to be mine before setting up the Beta of Vista) you need to be aware of this. What follows below is from an post on jkOnTheRun. The info was sent by Mickey Segal.

The latest updates for the anti-spyware program “Spybot Search and Destroy” (http://www.safer-networking.org/; most updates dated 3 November) seem to recognize some key Tablet PC functionality as a threat and delete it.  The damage can be undone with Windows XP System Restore.


Spybot detects what it refers to as “Smitfraud-C.Toolbar888”, and flags the following registry entries as problems:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon\Notify\TabBtnWL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon\Notify\Sebring

It offers to fix the “problem”, and if you then re-boot you find that the “Change tablet and pen settings” icon is missing from the tray and many Tablet buttons are disabled (on Motion Computing LS800 the Escape, Function, 5-way directional control button, Motion Dashboard button and Rotate Display button, yet the programs seem to launch properly if invoked by clicking on shortcuts).


System Restore to a time immediately before running Spybot fixes the problem.


I’ve reproduced this problem in a case in which the only item I allowed Spybot to fix was “Smitfraud-C.Toolbar888”.

I don’t know a lot about the Windows Registry or Spybot, so it would be good if others could check the plausibility of my concerns and help take appropriate action.

Be alert and be smart. Make sure System Restore is working properly.