SpywareBlaster item unprotects itself.

[Heather]

"Andy Walker" <awalker@nspank.invalid> wrote in message
news:48c9d1a7.88967468@news.webtv.com...
> Heather wrote:
>
>>The fact that 2 of us are seeing the same thing become
>>*unprotected* strikes me as a fault of some sort in the program. Any
>>comments?
>
> I've seen this type of thing happen before when another anti-spyware
> program sees the registry entry for a domain as threat and deletes the
> entry (even though the entry actually places the domain in the
> restricted zone). I think this has happened with Spybot Search &
> Destroy and Windows Defender in the past, and probably others.

Thanks Andy.....yes, I run Spybot once a week and also SuperAntiSpyware
every 10 days or so......so it could have been something in one of them.
That would make sense.

Cheers....Heather

[Andy Walker]

Heather wrote:

>
>"Andy Walker" <awalker@nspank.invalid> wrote in message
>news:48c9d1a7.88967468@news.webtv.com...
>> Heather wrote:
>>
>>>The fact that 2 of us are seeing the same thing become
>>>*unprotected* strikes me as a fault of some sort in the program. Any
>>>comments?
>>
>> I've seen this type of thing happen before when another anti-spyware
>> program sees the registry entry for a domain as threat and deletes the
>> entry (even though the entry actually places the domain in the
>> restricted zone). I think this has happened with Spybot Search &
>> Destroy and Windows Defender in the past, and probably others.
>
>Thanks Andy.....yes, I run Spybot once a week and also SuperAntiSpyware
>every 10 days or so......so it could have been something in one of them.
>That would make sense.

I ran some tests and it appears to be a problem with the immunize
feature within Spybot. It looks like they are corrupting the key for

HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Internet
Settings\ZoneMap\Domains\5starvideos.com

This causes the key to be useless for protection and SpywareBlaster
recognizes that the key needs to be reset. You should run
SpywareBlaster after you immunize with Spybot in order to reset the
key until Spybot fixes the problem. I don't feel like reporting it to
them myself so if someone else wants to, then be my guest.

[slate_leeper]

On Fri, 12 Sep 2008 00:55:00 -0400, Andy Walker
<awalker@nspank.invalid> wrote:

>I ran some tests and it appears to be a problem with the immunize
>feature within Spybot. It looks like they are corrupting the key for
>
>HKEY_CURRENT_USER\Software\Microsoft\Windows\Curr entVersion\Internet
>Settings\ZoneMap\Domains\5starvideos.com
>
>This causes the key to be useless for protection and SpywareBlaster
>recognizes that the key needs to be reset. You should run
>SpywareBlaster after you immunize with Spybot in order to reset the
>key until Spybot fixes the problem. I don't feel like reporting it to
>them myself so if someone else wants to, then be my guest.


You are exactly correct. Running "immunize" with SpyBot SD causes the
problem, even though Spybot SD shows zero unprotected items both
before and after the immunization run.

Therefore I agree that there really is no problem to worry about as
far as infection or safety of my system is concerned.

Thanks much, awalker!

-dan z-


--
Protect your civil rights!
Let the politicians know how you feel.
Join or donate to the NRA today!
http://membership.nrahq.org/default....ignid=XR014887

[Heather]

Thanks, Andy......I will follow your suggestions.

Heather

"Andy Walker" <awalker@nspank.invalid> wrote in message
news:48c9f4cf.97967328@news.webtv.com...
> Heather wrote:
>
>>
>>"Andy Walker" <awalker@nspank.invalid> wrote in message
>>news:48c9d1a7.88967468@news.webtv.com...
>>> Heather wrote:
>>>
>>>>The fact that 2 of us are seeing the same thing become
>>>>*unprotected* strikes me as a fault of some sort in the program.
>>>>Any
>>>>comments?
>>>
>>> I've seen this type of thing happen before when another anti-spyware
>>> program sees the registry entry for a domain as threat and deletes
>>> the
>>> entry (even though the entry actually places the domain in the
>>> restricted zone). I think this has happened with Spybot Search &
>>> Destroy and Windows Defender in the past, and probably others.
>>
>>Thanks Andy.....yes, I run Spybot once a week and also
>>SuperAntiSpyware
>>every 10 days or so......so it could have been something in one of
>>them.
>>That would make sense.
>
> I ran some tests and it appears to be a problem with the immunize
> feature within Spybot. It looks like they are corrupting the key for
>
> HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Internet
> Settings\ZoneMap\Domains\5starvideos.com
>
> This causes the key to be useless for protection and SpywareBlaster
> recognizes that the key needs to be reset. You should run
> SpywareBlaster after you immunize with Spybot in order to reset the
> key until Spybot fixes the problem. I don't feel like reporting it to
> them myself so if someone else wants to, then be my guest.

[Default User]

On Fri, 12 Sep 2008 00:55:00 -0400, Andy Walker <awalker@nspank.invalid>
wrote:

>I ran some tests and it appears to be a problem with the immunize
>feature within Spybot. It looks like they are corrupting the key for
>
>HKEY_CURRENT_USER\Software\Microsoft\Windows\Curr entVersion\Internet
>Settings\ZoneMap\Domains\5starvideos.com
>


FYI



"Hi everyone,

A database update has just been released for SpywareBlaster ( 9/12/08 ),
which removes the now dead domain.

[note: the previous post refers to "5starvidios" instead of
5starvideos.com, although this is probably a typo]

Please update SpywareBlaster, and then enable all protection.
SpywareBlaster should no longer show "1 item has protection disabled" under
Restricted Sites.


There were two primary triggers here:

1.) A particular domain is now offline (not just pretending to be, as is
often the case with malicious/unwanted domains), and thus protection
against it is no longer needed. Thanks to your reports, the latest update
for SpywareBlaster takes care of this appropriately. Thus it no longer
shows "protection disabled" for the item Spybot was removing.

2.) Spybot seems to repeatedly remove protection for items no longer in its
database when you Immunize (much like older versions of SpywareDoctor used
to do, before they fixed this behavior). As was the case with
SpywareDoctor, this is unnecessary (if Spybot isn't re-adding that
particular entry, it only needs to remove it once), and can interfere with
a user's choice to re-add it themselves later (either manually or with
another program). Luckily, this should be an easy thing to tweak on
Spybot's part, and I'll see what I can do about getting in contact with
PepiMK to see if he can add it to the to-do list for a future Spybot
version.

Best regards,

-Javacool"
http://www.wilderssecurity.com/showthread.php?t=219532

[Buffalo]

Default User wrote:
> "Hi everyone,
>
> A database update has just been released for SpywareBlaster ( 9/12/08
> ), which removes the now dead domain.
>
> [note: the previous post refers to "5starvidios" instead of
> 5starvideos.com, although this is probably a typo]
>
> Please update SpywareBlaster, and then enable all protection.
> SpywareBlaster should no longer show "1 item has protection disabled"
> under Restricted Sites.
>
>
> There were two primary triggers here:
>
> 1.) A particular domain is now offline (not just pretending to be, as
> is often the case with malicious/unwanted domains), and thus
> protection against it is no longer needed. Thanks to your reports,
> the latest update for SpywareBlaster takes care of this
> appropriately. Thus it no longer shows "protection disabled" for the
> item Spybot was removing.
>
> 2.) Spybot seems to repeatedly remove protection for items no longer
> in its database when you Immunize (much like older versions of
> SpywareDoctor used to do, before they fixed this behavior). As was
> the case with SpywareDoctor, this is unnecessary (if Spybot isn't
> re-adding that particular entry, it only needs to remove it once),
> and can interfere with a user's choice to re-add it themselves later
> (either manually or with another program). Luckily, this should be an
> easy thing to tweak on Spybot's part, and I'll see what I can do
> about getting in contact with PepiMK to see if he can add it to the
> to-do list for a future Spybot version.
>
> Best regards,
>
> -Javacool"
> http://www.wilderssecurity.com/showthread.php?t=21953

Thanks for the update on this issue.
Buffalo