SWB Protection Disabled

I have repeatedly been hitting "Enable All Protection" in SWB, only to reopen the program a short time later and seeing that "1432 items have protection disabled" under Restricted Sites. IE protection is not affected. No Mozilla or Firefox installed. I have also set my IE configuration to the recommended settings but those are changed back as well. I have un/reinstalled with the same results. Have also run Sbybot S&D, Adaware, Spyware Guard and CWShredder. Anyone solving this will have my eternal gratitude.

 

I've consistently had the same problem with 3.1 (and 3.0, I think), but only with regard to Firefox, and with the number of items -- about 275, I think -- being always the same. Not a spyware problem, I don't think, as I run Spybot S&D, AdAware regularly, along with Ewido Security Suite (anti-trojan) and Avast anti-virus.

 

OK, I have been testing your theory, checking SWB after each update and scan. Sure enough, when updating Spyware guard the protection was diabled (no problems w/ Ad-Aware or Spybot S&D). So I removed SG. Now it appears that opening IE also causes SWP protection to disable. Any thoughts there?

Note: I am using the yahoo tool bar w/ popup blocker as well.

Thanks in advance!

 

I have the same problems as semds128 and I am using the same programs. I also notice that when the protection is disabled (especially with the restricted sites - CoolWebSearch being the most insidious) that any "HKEY_CURRENT_USER\software\Microsoft\Windows\Internet Settings\ZoneMap" url's that I delete - ZAP! They come back! I use the Google toolbar with pop-up blocker & IE 6.01.HELP!!

 

I checked to make sure protection for Firefox was enabled, then did updates for SpywareGuard and Blaster, AdAware, Ewido Security Suite, and Avast. Protection was still enabled after each update (did -Guard twice).
The problem seems intermittent and erratic, for me at least.

 

Can anyone at Javacool help with this situation? I am at a complete loss and am still having problems!

 

Greetings !!!

I too have this problem. In my case, I think that it is caused by AOL's Spyware Protection service. It appears to affect SpyBot Search & Destroy as well.

I'm doing this from memory, so it probably WON'T be 100% accurate. I am on AOL. AOL put out a news release back in January that they would soon offer anti-spyware service as part of their AOL 9.0 package. They had "partnered" with Aluria Software to produce and provide the new service to their customers. After four months of waiting, they finally rolled out thei new AOL Spyware Protection on May 26th.
Soon thereafter, I downloaded and installed it. After re-starting my computer, I ran scans using Spybot, AdAware, CWShredder, and McAfee (all updated). Everything on my computer was "clean and clear". I then did a scan with the AOL program. It took well over a half-hour to complete its scan.
After finishing its scan, AOL's Spyware Protection (AOL/SP) reported some "nasties" were on my computer! I was STUNNED!!! After I settled down, I set about to find where, oh where, could they be. I did not recognise any of the files they mentioned. I had no idea how the "nasties" might have got on my computer in the first place, especially having just run the other scans and having SWB and SG on my system.
Figuring discretion is the better part of valor, I chose to block them rather than delete them. I'm glad that I made that choice.

As near as I can tell, when I used AOL/SP to block the "nasties", it disabled some of the "signatures" in Spyware Blaster and in the immunize section of SpyBot S&D. After the AOL/SP blocking, I ran another 37 minute scan and it came out "clean". Then I went back to both Spyware Blaster and SpyBot S&D and re-immunized, so to speak. Being assured of full protection from both programs, I then ran another AOL/SP scan (another 30+ minutes gone out of my life...).

As you've probably already guessed, yes, the "nasties" were back!!! So now you've read my little story and you can add it to the rest of the info in this thread.

I don't know if this will help anyone here, but I hope that it does in some way, shape, or form shed some light on this mystery.

REMEMBER: The only GOOD MalWare, is DEAD MalWare !!!

Robin20152

 

Hi, Robin20152

Welcome to Wilders.

May be AOL is [was] doing some sort of tracking on you so it demobilizes
some of the other two's entries.

I would not trust some thing that done that on well known products.

Take Care,
TheQuest

PS:- Also read this post by ronjor AOL Software Engineer

 

Here's some more info about this problem; whether it's relevant to anyone else's experiences I don't know.
I delved a little deeper into exactly what goes on when SpywareBlaster's protection is enabled. Apparently, all the protection is concerned with the prevention of spyware tracking cookies.
This is controlled simply by a "Hostperm.1" file which is found in your Firefox profile folder. One is present anyway, to record the sites which you have prohibited from setting cookies. As best I can tell, what SpywareBlaster does is copy a list of bad sites or cookies into that file, so they can't set cookies during your surfing.
I set up more profiles than most Firefox users, because I enjoy trying out various optimised or unofficial, "third-party" builds. I noticed that, immediately after setting up a new profile, the hostperm.1 file was listed as 1 kb. And SpywareBlaster would, at that point, tell me that all the protection for Firefox was disabled. I then told it to enable all protection, after which the size of the file was 6 kb. If I manually copy the 6 kb hostperm.1 from an older profile into the newer one, before re-enabling all protection, then, again, SpywareBlaster reports that all protection is enabled. And, sure enough, when I check the list of prohibited cookies in Firefox (Tools>Options>Privacy>Cookies>Exceptions) I have a long list of prohibited sites already -- on a fresh profile. (Which is as it should be!)
I haven't noticed any unusual failures on the part of SpywareBlaster since I started looking into this a week or two ago, and I half suspect that (some, at least) of the previous failures to maintain protection on the part of SpywareBlaster were simply due to my creating a fresh profile, which isn't automatically protected upon creation ... you have to open S-B and tell it to enable protection for the new profile.
One possibility, if protection reads disabled when you haven't created a new profile, is that S-B has failed to read the hostperm.1 file correctly; another is that some other program (and such a program sounds malicious) has erased part or all of your hostperm.1 file in your profile. To check which is the case (and again, this is only for a profile which was previously protected) you could go to the cookie settings mentioned above, and check for the long list of prohibited sites.
I'm no expert on SpywareBlaster, so if this is erroneous or incomplete, please correct it.
The versions of Firefox which I've checked this on are various 0.8+ builds, mainly from May and early June, all of which use the %AppData%/Firefox profile path (as opposed to a Phoenix - 0.8 - or Mozilla/Firefox - 0.9 - profile folder); my OS is WinXP home. No AOL.

 

A little more:
Another factor which could be involved in the loss of protection would be the manual clearing of the sites listed in ...Cookies>Exceptions. Obviously, if you do this, you are deleting all the sites SpywareBlaster is protecting you from in your hostperm.1 file. You might take this action if you have used this list to add your own sites from which you will not accept cookies, changed your mind about one of them, and, instead of going through and finding the one site you want to change, just erased them all instead. I've checked this and, as common sense would dictate, it does remove protection, and SpywareBlaster informs you of that! But if you've done this without realizing the connection with S-B, you may think S-B is having a buggy day.
There's another thread on the forums concerning manually copying, via notepad, a list of restricted sites into the ...Cookies>Exceptions list of Firefox 0.9 and 0.91 in order to provide S-B's protection for this new version; it may be of interest.

 

Has this ever been resolved?

I have the same problem. I enable protection and as soon as I open IE, all protection to Restricted Sites state that it is Enabled, but, the notice to the right states that "1539 items have protection disabled..."
(see attachment)

Any fixes

Thanks

 

I do believe that spywareblaster sometimes has a problem in deciding if the protection is on or not.

For spywareblaster, it always says that 70 ltems are unprotected for firefox. I look into host perm and I see that the so called unprotected items are in there.

To be sure, i delete all other profiles. I rerun SWB it complains, I enable all protection, restart everything. SWB complains again about the 70 items. I look into the host perm files and the unprotected items are there!

 

I found 1534 items with protection disabled this morning, exactly as ekim1954 posted but with a slightly different count. I updated SWB on Feb. 13.

 

Most of the time....probles such as this has been found to be caused by other programs that users have loaded.

As was mentioned by LowWaterMark in post # 3...."most likely that one of your other security products is undoing the protections set by SpywareBlaster."

One of the latest problems that has cropped up concerns the Panda Anti-virus program which is\was dis-allowing SpywareBlaster to add new protections (and Spybot to Immunize)....as noted in the below thread.

This thread---> Panda AntiVirus 2005 with TruPrevent

Having said that....I'll ask what LWM asked in post # 3...."Do you run anything else (other than SB) between having set protections and going back to see that they are disabled?".

Could you also please provide some more details about your system? Such as...

-Version of Windows
-Any other security applications you have installed (anti-spyware, anti-virus, firewall, etc.)

Regards,
Bubba

 

Perhaps it's a coincidence....but with Spywareblaster's Feb. 13 database loaded....Restricited Sites protection enabled and also using IE-Spyads Feb 13th database....I can un-install IE-Spyads database....re-check Spywareblaster and there are 1534 items with protection disabled.

By chance are you using IE-Spyad jayzzz ?

 

Yes...though for some reason, it didn't go in as usual this time... Hmmm. And going through the removal process does reinstate that change in SWB. What does it mean I should do about either or both?

 

1) I would choose between the two programs as far as Restricted sites protection.

or

2)Remember that there are some exact same entries in each program....and if you disable some\all protection in one of the programs....you are effecting some of the entries found in the other program.

Regards,
Bubba

 

Is this a new issue between the two, or was I doing something wrong w/ IE-SPYAD before? IE-SPYAD doesn't affect Firefox, right? And I'm only using IE for an M$N group, and occasionally to format text in a Hotmail message.

As long as I use Firefox for everything else, it's more helpful to have SWB enabled -- isn't it?

IE-SPYAD has always been in C:\IE-SPYAD, but after this last time I updated, the files are scattered through C:\ and there is no folder called C:\IE-SPYAD. I know how to uninstall it using their tool, and did, but some or all of the files are still there. Might you know which way it's supposed to be, and whether I've got a problem in that regard?

I appreciate your advice. Once I learn something, it's covered, but I keep running into new things!

 

Perhaps I could use the directory printer I recently downloaded to print the contents of the IE-SPYAD file, and use it to search for & delete the matching files in C:\ ?

 

Since the day Restricted Sites protection was made available in Spywareblaster....that was the day issues such as this arise.

Without getting too technical....and hopefully I want bore you if you've seen it before....but IE-Spyad and Spywareblaster add entries to IE's Restricted Sites Zone. They accomplish this by adding the entries to the registry....which is the same location as each other....which is the same location that is used if an IE user manually adds sites to the Restricted Zone. That's where the issue arises because alot of users of these programs are not aware of that.

No....not in any shape or form does it effect Firefox.

 

That means the times I've found things SWB protection disabled before, it was caused by changing IE-SPYAD, and I didn't realize it.

I NEED to understand more than I do, and you said it on a good level. Thank you. I knew the information about the things separately, but didn't connect the dots to see what it could mean for them together.

It sounds like as long as I stick to only my familiar spots using IE, my best move for protection might be to stay with SWB because that helps FF, too. I don't tend to go to very aggressive sites, like those for music downloads or porn.

Then it's just a matter of locating the right files to delete from the weird way IE-SPYAD installed last time.

 

I think I know what you are speaking of....and if you need further help in cleaning it up....feel free to holler....or PM me and I'll do what I can in assisting you.