Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Question About Immunizing And Sdhelper In Spybot


  • Please log in to reply
14 replies to this topic

#1 bloomcounty

bloomcounty

  • Members
  • 672 posts
  • OFFLINE
  •  
  • Local time:03:49 AM

Posted 05 July 2007 - 10:33 AM

Hi,

I read the following:
Such tools (mentioned below) as Ad-Aware and SpyBot have not only scanning capabilities, but also immunizing or ad-blocking features. I recommend you leave these turned off. This recommendation is based mostly on a “convenience of computer use” point of view. Tools that are excellent for scanning for malware do not necessarily serve as well the separate function of protection. The immunize, ad-blocking, and similar protective features of these programs mostly aren’t needed, don’t do much that is really helpful, and sometimes unnecessarily get in the way of how you use your computer. (If you are running Windows XP Service Pack 2, they really are unnecessary, at best!) There are so much easier and less intrusive ways to protect your computer, that I recommend you not risk making your computer life harder with features that don’t really help.

...and I was wondering what the opinion here was on using the Immunizing and SDHelper (i.e. "Permanently running bad download blocker in IE") in SpyBot?

I only use IE for Windows Updates -- I use Firefox for web browsing. So is it still better to have that option turned on in SpyBot or off? And why?

Is it that SDHelper thing that uses the Immunizing (i.e. "block bad products")? I guess if you weren't going to use that, then you'd just stop "immunizing"?

Any thoughts are appreciated -- thanks to the board for continuously helping me to learn! :thumbsup:
My stats: Windows XP Home SP2; Firefox 3.0.14 w/ Ad-Block Plus; IE 6.0 (used only for monthly Windows Critical Updates); ZoneAlarm 6.1.744.001 Free; AVG 8.5 A/V Free; SuperAntispyware Free 4.28.1010

BC AdBot (Login to Remove)

 


#2 Alan D

Alan D

  • Members
  • 144 posts
  • OFFLINE
  •  
  • Local time:11:49 AM

Posted 05 July 2007 - 11:58 AM

As I understand it (which isn't terribly far), the immunise function in Spybot does a number of things. It puts a list of known 'bad' websites into Internet Explorer's Restricted zone; it blocks some cookies; and it blocks the download of a list of known 'bad' activeX scripts.

Now, I'm not sure, but I think the last one may be of less importance if you already have Internet Explorer's security level set to 'medium', because IE will prompt you anyway whenever something is offered, and you can say no. The cookie issue isn't very important because it's so easy to get rid of them. But that list of 'bad' websites looks pretty useful to me.

For the record, I use both Spybot's 'immunise' feature, and I also use Spywareblaster. Although they do a similar job, the scope of the protection is considerably extended by using both. I also use Spybot's 'hosts' file.

Do these things interfere significantly with browsing? I haven't encountered anything worth noting. And if I did, I can turn them off. I don't think there's anything much to lose by using them, but there is a significant enhancement of protection to gain.

Of course if you use Firefox for your browsing, then this is all irrelevant.

Edited by Alan D, 05 July 2007 - 12:01 PM.

Windows XP Home SP2; AVG 7.5 Internet Security Suite (AV/AS r.t.p, and firewall); Windows Defender (r.t.p on); SuperAntispyware Free; a-squared Free 3.5.0.15; Spybot 1.4 (Immunised, but no Tea-timer); AdAware SE Free; AVG Anti-Rootkit Free; Spywareblaster; MVPS Hosts file (with HostsMan); McAfee Site Advisor.

#3 bloomcounty

bloomcounty
  • Topic Starter

  • Members
  • 672 posts
  • OFFLINE
  •  
  • Local time:03:49 AM

Posted 05 July 2007 - 12:17 PM

Of course if you use Firefox for your browsing, then this is all irrelevant.


Yeah, that what I was wondering... I only use IE for Windows updates. And I've actually got all the Internet Zones in IE set to High Security, except for Trusted, which is set at Medium and only contains the three addresses you need to add for Windows Update. (Well, I guess the Restricted Zone is set to "Custom" with everything turned off or set to prompt, as I believe that's the default anyways for that...)

So that stuff in SpyBot has zero bearing on anything for me, right?

I guess I can keep immunizing since that gets downloaded when you update (unless I stop updating that part, but that might be iffy), but just leave the SDHelper thing unchecked/turned-off...?

Thanks!
My stats: Windows XP Home SP2; Firefox 3.0.14 w/ Ad-Block Plus; IE 6.0 (used only for monthly Windows Critical Updates); ZoneAlarm 6.1.744.001 Free; AVG 8.5 A/V Free; SuperAntispyware Free 4.28.1010

#4 Alan D

Alan D

  • Members
  • 144 posts
  • OFFLINE
  •  
  • Local time:11:49 AM

Posted 05 July 2007 - 04:41 PM

So that stuff in SpyBot has zero bearing on anything for me, right?


I would assume so - unless one of your three trusted sites was compromised. I don't know if that's even possible?
Windows XP Home SP2; AVG 7.5 Internet Security Suite (AV/AS r.t.p, and firewall); Windows Defender (r.t.p on); SuperAntispyware Free; a-squared Free 3.5.0.15; Spybot 1.4 (Immunised, but no Tea-timer); AdAware SE Free; AVG Anti-Rootkit Free; Spywareblaster; MVPS Hosts file (with HostsMan); McAfee Site Advisor.

#5 oldf@rt

oldf@rt

  • Members
  • 2,609 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Avondale, Arizona USA
  • Local time:03:49 AM

Posted 05 July 2007 - 05:02 PM

If you use firefox as the main browser, I would recommend that you add Spywareblaster to your anti malware arsenal. link to main page:

http://www.javacoolsoftware.com

It does the immunize function for firefox, also.
The name says it all -- 59 and holding permanently

**WARNING** Links I provide might cause brain damage

#6 bloomcounty

bloomcounty
  • Topic Starter

  • Members
  • 672 posts
  • OFFLINE
  •  
  • Local time:03:49 AM

Posted 05 July 2007 - 05:09 PM

If you use firefox as the main browser, I would recommend that you add Spywareblaster to your anti malware arsenal.


I thought I had read that some people had problems with this...? Conflicts or something...? Or maybe that was something else...

Would it conflict with SpyBot?

It says this:

# Prevent the installation of ActiveX-based spyware, adware, browser hijackers, dialers, and other potentially unwanted software.
# Block spyware/tracking cookies in Internet Explorer and Mozilla/Firefox.
# Restrict the actions of potentially unwanted sites in Internet Explorer.

...so is the immunize thing the first line here? If it's then third, then it sounds like it's only for IE.

Thanks!
My stats: Windows XP Home SP2; Firefox 3.0.14 w/ Ad-Block Plus; IE 6.0 (used only for monthly Windows Critical Updates); ZoneAlarm 6.1.744.001 Free; AVG 8.5 A/V Free; SuperAntispyware Free 4.28.1010

#7 tg1911

tg1911

    Lord Spam Magnet


  • Members
  • 19,274 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:SW Louisiana
  • Local time:04:49 AM

Posted 05 July 2007 - 05:54 PM

The second line pertains to Firefox.
In Firefox, it blocks Ad/Tracking cookies.
I've been using it, along with Spybot's Teatimer, for several years, and have had no problems.
MOBO: GIGABYTE GA-MA790X-UD4P, CPU: Phenom II X4 955 Deneb BE, HS/F: CoolerMaster V8, RAM: 2 x 1G Kingston HyperX DDR2 800, VGA: ECS GeForce Black GTX 560, PSU: Antec TruePower Modular 750W, Soundcard: Asus Xonar D1, Case: CoolerMaster COSMOS 1000, Storage: Internal - 2 x Seagate 250GB SATA, 2 x WD 1TB SATA; External - Seagate 500GB USB, WD 640GB eSATA, 3 x WD 1TB eSATA

Become a BleepingComputer fan: Facebook

#8 tos226

tos226

    BleepIN--BleepOUT


  • Members
  • 1,577 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:LocalHost
  • Local time:06:49 AM

Posted 05 July 2007 - 08:24 PM

S&D immunize feature loads up IE restricted site list. Good thing till you use Outlook with May M$ patches.
TeaTimer is a wonderful runtime watch. So long as it does not interfere with similar watch of AVG which I believe you're using, it's safe. Check AVG kb. Or try TeaTimer and if S&D throws and alert about some registry change or whatever, followed by AVG telling a similar thing, you know you have a conflict.
I've used the immunize feature with ZA free and Avast AV with no problems, but not with ZA suite as it watches the registry, OS, the whole bit.

I think Spyware blaster has no conflicts.

Edited by tos226, 05 July 2007 - 08:25 PM.


#9 oldf@rt

oldf@rt

  • Members
  • 2,609 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Avondale, Arizona USA
  • Local time:03:49 AM

Posted 05 July 2007 - 10:05 PM

I have yet to run across a conflict with spywareblaster from any program. Again the key word is yet. There is quite a wealth of information at the Spywareblaster Knowledgebase , and a section at Wilder Security

Edited by oldf@rt, 05 July 2007 - 10:09 PM.

The name says it all -- 59 and holding permanently

**WARNING** Links I provide might cause brain damage

#10 bloomcounty

bloomcounty
  • Topic Starter

  • Members
  • 672 posts
  • OFFLINE
  •  
  • Local time:03:49 AM

Posted 06 July 2007 - 02:59 PM

S&D immunize feature loads up IE restricted site list. Good thing till you use Outlook with May M$ patches.
TeaTimer is a wonderful runtime watch. So long as it does not interfere with similar watch of AVG which I believe you're using, it's safe. Check AVG kb. Or try TeaTimer and if S&D throws and alert about some registry change or whatever, followed by AVG telling a similar thing, you know you have a conflict.
I've used the immunize feature with ZA free and Avast AV with no problems, but not with ZA suite as it watches the registry, OS, the whole bit.


I use OE not Outlook, so would that effect me?

Also, I noticed that there are still sites listed in IE Restricted Sites even though I have the SDHelper thing unchecked in Spybot. Does that add additional sites, or maybe they're already in IE from having used it in the past?

I've never used the TeaTimer thing, as I had read about problems (probably what you're referring to). Is that only for IE though? Again, I don't use IE (only for Windows Updates) and use Firefox regularly.

So what does SpywareBlaster have that SpyBot doesn't...?

Thanks!
My stats: Windows XP Home SP2; Firefox 3.0.14 w/ Ad-Block Plus; IE 6.0 (used only for monthly Windows Critical Updates); ZoneAlarm 6.1.744.001 Free; AVG 8.5 A/V Free; SuperAntispyware Free 4.28.1010

#11 tos226

tos226

    BleepIN--BleepOUT


  • Members
  • 1,577 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:LocalHost
  • Local time:06:49 AM

Posted 06 July 2007 - 09:00 PM

OE vs Outlook. I don't know. Google.

I don't recall what SDHelper is. Immunization fills the list. It's a good list. If you have no problems, leave it alone.
S&D is for IE only. I love the program and use for looking at a lot of settings and tweaking the startup list. But that list of restricted site hurt me so I removed it all and wait for M$ to fix their ways.

SpywareBlaster - complete description is on this site in the tutorials. It sets a kill but in the registry and prevents various bad things from running. It's a different mechanism. Google.

#12 Alan D

Alan D

  • Members
  • 144 posts
  • OFFLINE
  •  
  • Local time:11:49 AM

Posted 07 July 2007 - 02:14 PM

But that list of restricted site hurt me so I removed it all and wait for M$ to fix their ways.

Could you clarify that, please? How did the list of restricted sites hurt you?
Windows XP Home SP2; AVG 7.5 Internet Security Suite (AV/AS r.t.p, and firewall); Windows Defender (r.t.p on); SuperAntispyware Free; a-squared Free 3.5.0.15; Spybot 1.4 (Immunised, but no Tea-timer); AdAware SE Free; AVG Anti-Rootkit Free; Spywareblaster; MVPS Hosts file (with HostsMan); McAfee Site Advisor.

#13 bloomcounty

bloomcounty
  • Topic Starter

  • Members
  • 672 posts
  • OFFLINE
  •  
  • Local time:03:49 AM

Posted 07 July 2007 - 02:58 PM

I don't recall what SDHelper is.


SDHelper is the thing that gets added to your something (registry?) that shows up in a HijackThis log when you CHECK "Enable permanent blocking of bad addresses in IE" at the bottom of the Immunize screen in SpyBot:

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

This is the thing I *don't* have checked right now, since I only use IE for Windows Update. Any reason to check or not check it?

S&D is for IE only.


Are you saying the SpyBot program is for IE only? I can run a S&D scan of my computer with it -- why would it matter if I use Firefox or IE when scanning my computer with it?
My stats: Windows XP Home SP2; Firefox 3.0.14 w/ Ad-Block Plus; IE 6.0 (used only for monthly Windows Critical Updates); ZoneAlarm 6.1.744.001 Free; AVG 8.5 A/V Free; SuperAntispyware Free 4.28.1010

#14 tos226

tos226

    BleepIN--BleepOUT


  • Members
  • 1,577 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:LocalHost
  • Local time:06:49 AM

Posted 08 July 2007 - 11:18 AM

But that list of restricted site hurt me so I removed it all and wait for M$ to fix their ways.

Could you clarify that, please? How did the list of restricted sites hurt you?

Hi! I could hardly use Outlook2003. I posted here full description as well as links, but can't find my own post. Instead, read these:
see explanation in a post by Jim Eshelman
http://aumha.net/viewtopic.php?p=152814
also
http://forums.spybot.info/showthread.php?p=102248

This is not a S&D problem really. It is the change of how M$ now reviews restricted sites for every character you type.

Edit: ok I found my own stuff
http://www.bleepingcomputer.com/forums/t/91899/outlook2003-broke-cant-type-replies/
but all you really need is the aumha link

Edited by tos226, 08 July 2007 - 11:29 AM.


#15 tos226

tos226

    BleepIN--BleepOUT


  • Members
  • 1,577 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:LocalHost
  • Local time:06:49 AM

Posted 08 July 2007 - 11:23 AM

Are you saying the SpyBot program is for IE only? I can run a S&D scan of my computer with it -- why would it matter if I use Firefox or IE when scanning my computer with it?

Scanning has nothing to do with it. Spybot restricted sites list prevents your IE from going where it shouldn't. Scan is scan. Not relevant to what browser you use. If you shut off the BHO in IE then you've lost protection. In the rare instances when you use IE, if a trojan gets you, S&D will prevent from going there. Hope that's clearer now :thumbsup:




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users