[Spybot: Questions about immunization]

Just recently when I run Spybot Search & Destroy, I keep getting the same numbers of things that need to be immunized against, and in the same category.
Don't have a clue as to what is allowing this.
Running XP Pro and using the Microsoft firewall....maybe not enough?
Thank you,
Rob

 

Are you running an antivirus??

Spybot Search & Destroy does not immunize. It detects & removes spyware when you run a scan.

I would recommend Spyware Blaster. It provides immunization. Read about & download it from here: http://www.brightfort.com/spywareblaster.html

Your windows firewall should be adequate. Additionally you may want to download & install MalwareBytes. Get it here: http://www.techspot.com/downloads/4716-malwarebytes-anti-malware.html

And last, SuperAntiSpyware here: http://www.superantispyware.com/

 

I uninstalled Spybot pronto, this software caused nothing but trouble. I find Malware a more reliable software.

 

"Malware" means Malicious software, i.e., software designed to cause harm.

"Malwarebytes" is one popular and effective anti-malware solution.

 

I'm pretty sure it does, at least, it used to.

It is good but only works for IE & Gecko-engined browsers. IIRC Spybot would also immunise Opera.

Personally, I think that the best thing to do with Spybot is to uninstall it.

 

I agree, MBAM is far superior to SpyBot. I had a bad experience with SpyBot once & it will never grace a computer that I own ever again.

It was probably good back in the day, but I honestly believe that it is past its sell by date now.

 

SpywareDr, many thanks for your correction and English lesson.

 

You're more than welcome.

 

During immunization, SS&D modifies the hosts file to block the domains of malicious servers by adding entries for those sites to redirect requests to a harmless destination.

The hosts file is a plain text file used by Microsoft TCP/IP for Windows which maps IP addresses to host names.

In XP, the file is in C:\WINDOWS\System32\drivers\etc\ You can view the entries made by SS&D with Notepad. Note SS&D makes a backup of the old file during immunization.

Same for 7, Vista, 2000, 2003, NT. In 95, 98, ME the location is in C:\WINDOWS\

Considering that SS&D is freeware for personal use, includes a number of useful utilities, and can be used safely alongside antivirus programs, I find it a worthwhile addition, especially for people with limited funds who use older systems.

The free SS&D forums include descriptions of the malware listed in the hosts file and instructions for removal. You can learn from these, and google for more information.

http://forums.spybot.info/forumdisplay.php?f=54

Note that malware programs can also modify the hosts file by adding sites of security tools so that they won’t resolve properly. For example if the entry 127.0.0.1 symantec.com is in your hosts file, you won’t be able to visit that site, because your PC is resolving that address to your own PC.

 

It is a good possibility that Spybot works relatively well on much older systems but I would much rather use SpywareBlaster for immunisation. There is a freeware version (which I use) which has to have its CLISD lists manually updated every fortnight (two weeks or so) & it is very light on your computer.

Wikipedia entry

Spybot's recent stable release (according to Wikipedia) was 1.6.2 / January 26, 2009; 3 years ago. IMHO this is far too long a time for an upgrade, especially compared to SUPERAntiSpyware or MBAM. A combination of MBAM &/or SAS with SpywareBlaster would be far more effective.

As I said earlier, I had a bad experience with Spybot, including similar problems to the OP. I'll never use it again & I wouldn't recommend it to anyone.

 

Not arguing with you, Davezilla. My goal was to answer whether SS&D does immunization and how it works. Personally, I use SS&D and SpywareBlaster and Malwarebytes and WinPatrol, along with MSE, the Windows firewall, and the hardware firewall in the router. IMHO problems with SS&D are often related to Tea Timer, which I don't use. Tried SAS, but didn't like it. Personal taste.

There is a new version of SS&D available on filehippo (Spybot Search & Destroy 2.0 RC1).
Haven't tried it. Promised improvements are:

Extended whitelisting identification for File Scanner and Startup Tools
New Protected Repair Environment runs all SS&D tools in a separate and secure desktop
Full Scan runs faster through files in the download directory
Separate File Scanner can handle huge folders (doesn't say how huge)
Fixed problems with Cleaner on reboot
Added Russian localisation
Included is a Professional Edition Test License (valid for 2 months)

 

Yeah, sorry antik, I wasn't trying to start an argument either.

Sounds pretty comprehensive. I've always fancied giving WinPatrol a bit of a spin someday. I worry about running too many antimalware programs though; they can often cause conflicts. I run MSE on my main (64 bit) desktop but everything else is 'browser end' so to speak. NoScript etc on Firefox, WOT, Ghostery, VirusTotal & others on Opera. I use the 64 bit Opera on my desktop as I feel it is safer than the 32 bit. My 32 bit machines have MBAM & SpywareBlaster as well.

Yes, I agree. I was trying to upgrade Spybot some years ago & for some reason I must have inadvertently activated Tea Timer. After some other problems I decided to uninstall Spybot. It's then that the 'fun' started!

Tea Timer was left behind after the uninstall & went all HAL 9000 on me & denied me a great deal of access to my own computer.

After a slight nervous breakdown, I decided to reinstall Spybot with its installer (I often keep installers in case I have to reinstall older versions of apps) as Tea Timer wouldn't let me download anything. Luckily it let me run the installer & I was able to deactivate Tea Timer & uninstall the now slightly insane Tea Timer (along with Spybot). Months later I discovered remnants of Tea Timer in Windows Defender's tools section. I actually miss Defender, but as I run MSE now I can't run it. After that incident I decided to stick with SAS (which I had installed before Spybot). I don't run SAS now as I feel that it is not what it once was, especially after its creator sold it. I only ran the freeware version as an on-demand scanner. One evening as I was working on an Open Office document SAS popped a nag screen (informing me about the vendor version & just how good it would be for me to purchase it) up over the systems tray. I thought it was a malware warning at first, even though it wasn't the realtime version. It never used to do this. This, plus a few other problems with SAS & I uninstalled it & went back to MBAM.

There is a PortableApps version also.

 

Davezilla: Agree. Love WOT and NoScript. Will look up ghostery and VirusTotal.

You wrote: "I worry about running too many antimalware programs "

Good point. I've stayed with SpywareBlaster and SS&D because after immunization, they leave nothing active. The lack of a new SS&D version hasn't bothered me. If it still does the defined task, leave it alone. The constant fixes to Flash don't make me feel safer.

"Comprehensive" is an illusion. A friend with top drawer paid-for protection clicked on a fake anti-virus pop-up and delivered himself into a world of hurt. It's always sobering when WOT pops up to say: "This site has a bad reputation. "

 

I also used to use RequestPolicy on Firefox but I haven't used it in a while. It can work to fine-tune NoScript & many people run both. Its developer is working on a new version. I tried the alpha on a portable version of Firefox. It looks promising. I would definitely check out the Dr Web link scanner for Firefox as well. There is an Opera version but it doesn't work (bug?).

Many on the Spybot forums have requested a version without Tea Timer. Just an immuniser version on its own like SpywareBlaster would be good though. SB has plans to immunise Chrome eventually (apparently they're working on it) but no plans for Opera, which SpyBot actually covers.

I'll be so happy when flash is replaced with something much safer!

Yes, WOT has its critics, but I have found it to be very useful & I usually don't like to surf without it. Its plug-in is light & reliable as well. Also WOT can be accessed from NoScript & Flagfox.

 

The problem is this; SSD worked fine for a long time; then recently it was not working as is supposed to. After immunization, did a complete search, then closed the program.
The next time I booted up, opened the program, got to immunization, the same number of fixes were there. The fixes were not saved as before. SSD does not seem to understand what I'm saying either. It's like making a file, but not saving it to the HD.
I have uninstalled the program. It did work well for a few years.....My machine is running XP Pro with SP 2. Haven't had any real problems for some time now. Probably need to upgrade.
Thanks for the info,
Rob

 

Thank you for the info....I have uninstalled it.
Rob

 

What happens when the immunization doesn't hold ? Rerun the program and the same fixes are still there. This just started recently. I uninstalled & re-installed...same problem. I finally uninstalled & removed the file completely.
Thanks again,
Rob

 

i have used SS&D for years with no problems. As a matter of fact, I installed it on a friends computer last night and it found several things and fixed them all and his PC is running great now. I have heard good and bad about TeaTimer and I still have it activated on all my PC's with no ill effects.

 

Rob Allen: Once you realize that immunization just modifies the hosts file, you don't expect too much from it. The technique is meant to keep malware from getting in, because once it does get in, you face an onerous task to get rid of it, sometimes requiring much more work than a scan with SS&D.

Mr. Bill: My personal experience with SS&D, incuding Tea Timer, has been like yours. No complaints. It's freeware, it's stable, it runs on everything, there is an actice and useful forum, and it does not do damage. It's not a silver bullet, but neither is anything else.

 

Rob Allen: Apologies for not answering your question about fixes not persisting. You said you had already uninstalled SS&D, so I figured you had moved on.

One thing you might try is to install the drive as a slave in another computer so you can run scans with Windows not active.