questions

[fester_1]

I noticed that 5 megs of outbound information went out of my computer to the safer networing ltd site ,while i was downloading spybot 1.4.????why????
This certificate is intended for the following purposes.1.ensures software came from software publisher.2.protects software from alteration after publication.4-7-2005 to 4-8-2006 and todays date is 2-22-2007.What this says to me is your certificate is not valid and you have no business letting people download spybot off your site.Most likely that is why 5 megs of information was took off of my computer by your server.Was it just looking for new threats or was it just data mining.??????
The third and final point about your software is i have noticed that in earlier versions that you search for an update,then you choose the mirror site ,then download the updates.Which so happen it was 212.xxx.xxx.xxx for the spybot site ,tds server for american update 65.xxx.xxx.xxx or some 60 series.But if you block 212 sites after you choose the mirror , you will get hits from the 212 web sites trying to communicate with my computer.For no reason it would seem.
Quite frankly and most likely the purpose of free is that is not free.For one it is big bussiness to manipulate internet explorer add ons,search pages and even a users servers.Corrupt internet explore so it uses ripe network addresses to download pages and windows updates. This most likely to the crybabies (complaining about norton) is why you are treated as such.If you act like spyware then you are spyware plain and simple,whether the owner of the software knows what the server is doing with his software is besides the point.

[daemon]

Hi fester_1!

You're right about our certificate. It is expired. Since we only use it within our own programs and they don't check this date, this doesn't really matter. The crucial thing is that we keep our private key secret, which we do.

How did you measure the 5 MB outgoing traffic? Are you sure this was Spybot causing it? Spybot doesn't send much data when it is updating itself. It only downloads the update files using the HTTP protocol.

How did you block the 212.xxx.xxx.xxx site (note that these xxx.xxx.xxx amount to 16777216 individual IP-addresses)? Our update sites don't try to connect to your computer. The update servers are just normal web servers and only answer HTTP requests.

We're sorry that you don't trust Spybot-S&D. It's hard to prove anything over the Internet. Perhaps just read the posts of our (mostly ;-) ) happy users in this forum and the reviews about Spybot-S&D you can find on the Internet.

Starting to spy on our users would be suicidal for our product and our reputation as a trustworthy Anti-Spyware vendor. This wouldn't make sense at all.

Best regards, daemon!

[fester_1]

yes the out bound traffic was an estimate while looking at the traffic monitor in mcafee and it somehow is connected with optimize 1.5 malicious web site operation that has not been obsolved with microsoft yet .But needless to say the generic host process is automatically trying to download with windows automatic download disabled.Dont know if it was just a bad uninstall of optimize 1.5 or just a malicious web site operator.
So it would seem what ever i download that an exact duplicate is being created in the outbound traffic for the same length of time.So if it took 20 minutes to download spybot over dialup then i also had 20 minutes of outbound traffic and not just small communication outbound traffic.Of course i have mcafee and can not tell where all this mass of outbound traffic is going.
I see your site is at 87.106.8.215 .
you ask how i block.Well lets say i have a rule in the firewall to block 210 to 215.255.255.255.then you would uncheck it in the firewall.then choose update spybot.then choose your mirror .then recheck the rule in the firewall after it starts to download from mirror site .Then you can watch the server from the ripe network try to get in to your system in my opinion.which would result in the incoming log of the firewall.Im already downloading the update from a usa site their should me no more events in the firewall.It might not be spybot doing this but nevertheless it is the server your product is on.
And i have used various forms of spybot,with and without the advertising robots in my time on the internet.All you get is bad checksums or it says the file is corrupted and i can get around that.

[daemon]

Hi fester_1!

If you send requests to a server and then activate a firewall block for this server, it is very well possible that you see some incoming data packages from this server in your firwall log.

This is by no means a "try to get into your system", but probably just the update server trying to answer the HTTP request your client made.

Greetings, daemon!