Items Becoming "Unchecked"

Discussion in 'SpywareBlaster & Other Forum' started by mamabear, Jul 1, 2004.

Thread Status:
Not open for further replies.
  1. mamabear

    mamabear Registered Member

    Joined:
    Jul 1, 2004
    Posts:
    5
    I made the following post at another forum this morning http://www.lavasoftsupport.com/index.php?showtopic=34392. Several people replied saying that they had experienced the same thing. It was suggested that someone post here to see if anyone had any comments.

    _________________________________________________________________

    I am using Spywareblaster 3.1. Several times lately, checked items have become unchecked and when I open Spywareblaster (to check for updates or whatever) I randomly get the message that 1 or more restricted sites have protection disabled. I'm not unchecking them myself - it's as if they're "unchecking themselves" after I'm on the internet. The last several have been coolwebsearch sites. I haven't been infected with CWS (yet) but it seems strange. Has anyone else noticed this happening or am I unchecking things in my sleep?

    Edit: This isn't happening after updating and before enabling protection. This is happening randomly - not after updating.

    Last Edit: I didn't make a note of the previous sites but this morning the one that was unchecked was freewebs (dot) com.
     
    mamabear, Jul 1, 2004
    #1
  2. LowWaterMark

    LowWaterMark Administrator

    Joined:
    Aug 10, 2002
    Posts:
    18,280
    Location:
    New England
    Are you using any other privacy or security software that you are either updating or scanning with between when these item(s) are set then being unset?

    For example, anyone who just applied Eric's updated IE-SpyAd will see freewebs.com go from protected to unchecked. Eric Howes' latest update to IE-SpyAd removed freewebs.com from being protected. (He had it previously, but there was talk lately that it was too broad and blocking the entire domain was not appropriate.)

    There are also threads here where other scanners have been removing entries from the restricted zone because the way they do their scans, they don't actually check the zone something is in... They just see a CWS site listed in that IE domains registry key and remove it even though it is set to restricted zone.
     
    LowWaterMark, Jul 1, 2004
    #2
  3. LowWaterMark

    LowWaterMark Administrator

    Joined:
    Aug 10, 2002
    Posts:
    18,280
    Location:
    New England
    LowWaterMark, Jul 1, 2004
    #3
  4. mamabear

    mamabear Registered Member

    Joined:
    Jul 1, 2004
    Posts:
    5
    In my case, it's probably because of the ie-spyad update which I did this morning. That's good to know - I guess I need to check Spywareblaster whenever I do an ie-spyad update. I'm not clear on what you're referring to in your second scenario.
    What scans are you referring to? I've done Ad-aware, AVG, Trojanhunter scans but nothing was picked up or removed with them (lately).

    Thanks for replying so promptly. It's a relief to know there is a legitimate explanation for this. I was worrying that CWS was doing something new and "tricky-dicky".
     
    mamabear, Jul 1, 2004
    #4
  5. LowWaterMark

    LowWaterMark Administrator

    Joined:
    Aug 10, 2002
    Posts:
    18,280
    Location:
    New England
    You really need to look at each one case by case. By knowing what changed in IE-SpyAd's latest update, and guessing that maybe you updated that, we just answered the freewebs.com change mentioned in the first post above.

    If you see other items becoming unchecked, then we'll need to know the specific items and what else you ran between when they were set and unset. Case by case, we've always identified that some other product was unsetting the items set by SpywareBlaster.

    SpywareBlaster doesn't use unique registry structures to set its protections. It just uses the existing ones, such as: IE's restricted sites list, IE6's P3P cookie blocking site list, and the existing ActiveX control listing key, so we've seen many cases where some other product has mistakenly gone in and removed those protections.
     
    LowWaterMark, Jul 1, 2004
    #5
  6. mamabear

    mamabear Registered Member

    Joined:
    Jul 1, 2004
    Posts:
    5
    Do you want us (the users) to report which sites are involved when and if this happens? If so, is this forum the appropriate place to do so?
     
    mamabear, Jul 1, 2004
    #6
  7. LowWaterMark

    LowWaterMark Administrator

    Joined:
    Aug 10, 2002
    Posts:
    18,280
    Location:
    New England
    This is actually a good place to gather that kind of information, including the specific items being unchecked and which security tool might have done it. By posting here, others will likely come along and confirm that they too have that problem and can recreate it using the same products.

    Of course, this isn't really a problem with the Javacool product in question. It is the other product that is removing the protection that needs to be looked into. But, by people posting about these occurrences here, we can work together and inform the products authors about these problem and figure out why it is happening. In some case, it might even result in Javacool reconsidering the blocking of some items... (Freewebs.com as an example again. Eric decided to remove it (ie. stop restricting it) based upon things posted at various security forums about that domain. Now Javacool will have to decide if he'll follow Eric's lead and remove it, or leave it in place and just let people choose for themselves to override the protection if they need to use freewebs.com)
     
    LowWaterMark, Jul 1, 2004
    #7
  8. gradders

    gradders Registered Member

    Joined:
    Jul 1, 2004
    Posts:
    4
    Location:
    London England and Fortaleza Brazil
    Hi,
    I have found that Pest Patrol detects some registry entries for SpywareBlaster.
    If you have the detected item deleted by PP then SpywareBlaster shows it to be unticked.
    I think is was a CWS item.

    Gradders
     
    gradders, Jul 1, 2004
    #8
  9. mamabear

    mamabear Registered Member

    Joined:
    Jul 1, 2004
    Posts:
    5
    Gotcha! :cool:
     
    mamabear, Jul 1, 2004
    #9
  10. MikeBCda

    MikeBCda Registered Member

    Joined:
    Jan 5, 2004
    Posts:
    1,627
    Location:
    southern Ont. Canada
    Related "problem" here, but not even sure if it's a problem or just a display quirk.

    When I visit certain sites and while there open SpywareBlaster, I find that if I click on the Internet Explorer tab (i.e., showing items rather than restricted sites), about a dozen items toward the end are showing as red and unprotected. I've double-checked, and these are always cookies, not spyware items.

    The "main" Protection status screen, however, shows 0 items unprotected.

    If I unprotect and reprotect, using either "All protection" or just the "Cookies" option, the individual items are again shown as protected and happily stay that way while on site (until next visit).

    The only other protection I use (besides SB and SG, that is) is Ad-Aware 6, the free (non-resident) version. Oh, and Cookie Pal 1.7c.

    A releatively recent HJT log review here showed I was quite clean, except for one "orphaned" but harmless reg entry apparently left behind by PalTalk.

    Any suggestions? Or maybe it's just not worth worrying about?

    Thanks and best,
    Mike
     
    MikeBCda, Jul 1, 2004
    #10
  11. tekkielee

    tekkielee Registered Member

    Joined:
    Jan 23, 2003
    Posts:
    8
    :D Hi fellow surfers

    This can also happen if you fix anything with highjack this. It will uncheck things in spywareblaster and spybot s&d.
     
    tekkielee, Jul 1, 2004
    #11
  12. eburger68

    eburger68 Privacy Expert

    Joined:
    Mar 4, 2002
    Posts:
    244
    Hi All:

    The latest version of IE-SPYAD is removing the domain freewebs.com, which used to be included in IE-SPYAD, and not relacing it. That's why you're seeing that one disabled Restricted sites entry in SpywareBlaster.

    I removed that particular item because it targeted the entire freewebs.com domain, which is a free hosting site used by many individuals and businesses with no relation whatsoever to CWS. See this recent thread at Net-Integration for more information:

    http://forums.net-integration.net/index.php?showtopic=17124

    Given that there was only one page on Freewebs.com that sported a *link* to another page associated with CWS, I decided that including the entire freewebs.com domain was simply overkill. So I removed it. It is removed by the uninstaller in order to keep IE-SPYAD users in sync with the latest version of IE-SPYAD. (If the uninstaller didn't remove it, users who hadn't updated in a while would be left with that domain in their Restricted sites zone and I'd get complaints about it.)

    If you want to re-enable the protection for the entire freewebs.com domain, the easiest solution is to open SpywareBlaster, uncheck the "Restrict the actions..." box on the Restricted Sites tab (which disables all protections at once) and re-check that box to re-enable all the protections. No need to scroll down the list to re-eanble the one previously disabled protection.

    For those of you using SpywareBlaster, Spybot S&D 1.3, and IE-SPYAD, please keep in mind that all three of these apps now add items to the Restricted sites zone. Given the sheer amount of overlap, there are bound to be minor glitches like this. The solution in all cases is simply to disable and re-enable protection to add all the protections back in.

    Best,

    Eric L. Howes
     
    eburger68, Jul 1, 2004
    #12
  13. mamabear

    mamabear Registered Member

    Joined:
    Jul 1, 2004
    Posts:
    5
    Thanks for the explanation and also for letting me know how to re-enable all protection without scrolling through the entire list. :)
     
    mamabear, Jul 1, 2004
    #13
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...