Some Spyware Blaster Protection Disables Itself

I use a dialup connetion and I'm not always online but I never shutdown my computer. I'm using Windows XP and if I'm away I have it go into "standby mode"

Every morning or so, before I go online, I check all my antivirus software and rerun Spyware Blaster just to be safe. Lately, I notice that when I rerun the program anywhere from 1 to 4 restricted sites have their protection disabled. I am not aware of any site I visit that could be causing this and I've never given permission to any site or program remotely related to these. It seems to be consistantly:
CWS 1295 searchmiracle.com
SearchBarCash
MediaTickets - mt-download.com
MSCache - skoobidoo.com

Although when I first started noticing this there may have been different sites. And not all four are always disabled at any one time.

I pretty much visit the same sites everyday and there seems to be no correlation to where I go and what sites or how many sites have protection disabled.

What could be going on?

Thanks.

 

Yep, I had the same problem, at the time I found it was caused buy me running Spybot spyware cleaner. So I now have got in the habit of looking to see if any protection has been removed after running spyware cleaners!

 

Your correct in that they are entries for the Restricted Zone. What is your dial-up connection and do they have any Spyware cleaners....for instance AOL Spyware Cleaner.

Also....if when you see this happening again....would you mind placing a check next to those items and then re-boot your computer. Once your PC has re-booted would you then go into SpywareBlaster and see if they are indeed still checked.

 

you might get cwshredder to get rid of the cw file but have someone check the log before you do anything. as deleting the wrong stuff can be bad for computer.

 

Thanks for the thoughts. It has taken me this long to test all the ideas you folks have presented and get a consistent result.

I'm on Earthlink and they have a built-in version of Webroot's Spyware Sweeper, but I don't use their task bar and thus don't use the scan feature of their spyware blocker program. However, since their "taskbar" is always operational even if not visible (I think I have to have that to use their Accelerator), it's possible the blocking or immunizing function is on. I have never seen it issue any warning. All my blocking seems to come from SPYBOT S&D.

Yes. I do use Spybot S&D and used to always run its "immunize" funtion first, then launch Spyware Blaster from Spybot's own link to it. But after several days of swithcing the order I run them back and forth, I can find no relation between the disabled sites and Spybot.

(Being kind of a spy killer junkie, I also have X-Cleaner in paid mode and SpySubtract Pro. I don't use either of their "immuniztion" functions though as that much scanning slows down my machine too much. The only possibility here is that X-Cleaner runs a quick scan on startup. Since I haven't been able to duplicate the full problem I originally described, I haven't tested that possibility yet.)

BUT I HAVE FOUND A CONSISTANTLY REPRODUCIBLE PROBLEM!

This time it's with BALZEFIND. (I don't think I've let the problem go on long enough to find more than one restricted site protection become disabled before I catch it.)

Now on restart, BLAZEFIND ALWAYS has it's protection disabled. I manually check the box next to it, then I enable all protection and all is well. Then on shutdown and restart, BLAZEFIND is unchecked again.

Are we on to something?

Thanks everyone for your help!
Jeff

 

I would definetly keep an eye on that Blazefind entry and concentrate on that entry as if SpySubtract is the culprit as you attempt to determine. The reason I say look in that direction first....is because we have had a few threads that I found via a Forum search using spysubtract or spy subtract as the search words. In a number of those threads....Spysubtract was a player....and definetly had a few False positives. In fact....one of the posts dealt with a Spysubtract scan and it reported the same 4 False positives your showing in your initial post. While this is not positive proof Spysubtract is the culprit....I suggest you take a close look in that direction.

Post referencing Spysubtract False positive scan results:

https://www.wilderssecurity.com/showpost.php?p=308463&postcount=16

Machine=COMPUTER-1
Time=Wed Nov 24 05:16:09 2004
Product Version=1, 0, 1, 53
OS Version=Microsoft Windows XP Home Edition Service Pack 2 (Build 2600)

Started Scanning
Programs in Memory
Finished Scanning
Started Scanning
Internet Cookies
Programs in Memory
Windows Registry
Found '' in 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\searchsquire.com'
Found '*' in 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\blazefind.com'
Found '*' in 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\clickspring.net'
Found '*' in 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\flingstone.com'
Found '*' in 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\mt-download.com'
Found '*' in 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\my-internet.info'
Found '*' in 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\searchbarcash.com'
Found '*' in 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\searchmiracle.com'
Found '*' in 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\skoobidoo.com'
Found '*' in 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\slotch.com'
Found '*' in 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\xxxtoolbar.com'