Will Not Immunize Hosts File

[Always Confused]

After installing today's updates, I closed Spybot (1.5.1.14), restarted it, went into Immunize.

Immunize ran until it go to the Windows Global (Hosts) area, whereupon it stopped, with 425 entries not immunized.

Closed Spybot, repeated process, again Hosts file not completely immunized.

Tried once more, gave up, posted this message.

[PepiMK]

Does the function in the Tools section (Tools -> Hosts file) work, or doesn't that work either?

[Always Confused]

Does the function in the Tools section (Tools -> Hosts file) work, or doesn't that work either?
I don't know: I decided to run Immunize once more, while I was eating breakfast. When I returned to the computer room, I found that the process had, finally, finished, and now I have everything immunized.

It only took four tries....

So, as everything is immunized, I cannot test the Tools > Host file function for you.

[PepiMK]

Since you also had problems with full Firefox immunization, what other security applications do you have running? Might there be another security app blocking this?

[Always Confused]

Since you also had problems with full Firefox immunization, what other security applications do you have running? Might there be another security app blocking this?
That's something I've been wondering about (and meaning to ask about here.)

I'm using Spyware Blaster, Spy Sweeper, and McAfee Security Center. Neither Spy Sweeper nor McAfee has "complained"; that is, neither program has popped up any messages while I've been immunizing Spybot.

[GT500]

Doesn't Spy Sweeper have a HOSTS file protection?

Try removing all of Spybot's entries from your HOSTS file, and then re-immunize. If it gets blocked, then start disabling security software one by one (starting with Spy Sweeper), and re-try the immunize after disabling each software. That should help you figure out what's blocking Spybot's HOSTS file immunization.

You can also check the logs from Spy Sweeper and McAfee, and see if they mention anything about the HOSTS file.

[Always Confused]

Yes, Spy Sweeper has a form of Hosts file protection, but I doubt that that is causing any problems with Spybot. As I wrote earlier, when trying to run Spybot's Immunize function, Spy Sweeper is not giving me any on-screen indication of anything that Spy Sweeper does not trust, which is what Spy Sweeper does when it does detect possible problems.

From the Spy Sweeper help file:

"Monitors the Hosts file for any changes. Some programs will add or change the IP address for a Web site in the Hosts file. When you try to go to the added or changed Web site, you will really go to a different Web site, such as an advertising site. This shield ensures that programs do not change an IP address without your knowledge. "

You can also edit the Hosts file through Spy Sweeper, but that's not relevant here. The Spy Sweeper log file is for sweeps, so it would not show anything for today. Spy Sweeper is set to sweep automatically at 2000 Mondays.

Your suggestion about removing Spybot entries from the Hosts file is intriguing. When I feel up to fighting with the entire known world, I just may try that, thanks.

[GT500]

...

Your suggestion about removing Spybot entries from the Hosts file is intriguing. When I feel up to fighting with the entire known world, I just may try that, thanks.

If you have made no customizations to your HOSTS file, then it's not very difficult to remove Spybot's entries. Just remove everything below the first entry, which should read something like: 127.0.0.1 localhost

[Always Confused]

If you have made no customizations to your HOSTS file, then it's not very difficult to remove Spybot's entries. Just remove everything below the first entry, which should read something like: 127.0.0.1 localhost
Yes, I know that. What I meant was that, if the first trial does not work, then I'll have to follow more of your directions and, if necessary, keep on testing, something I'm not quite ready to do at this time.

That's because I've done enough fiddling recently with other programs, styles, colors, the Internet stopping while I was writing this,etc.

[GT500]

Understandable. ;)

Just make sure to explore it at least a little bit before the final version of Spybot comes out. If it's not a compatibility issue, and winds up being a bug, then it's best that the Spybot team know about it before they release v1.5 as a final product.

[Always Confused]

Understandable. ;)

Just make sure to explore it at least a little bit before the final version of Spybot comes out. If it's not a compatibility issue, and winds up being a bug, then it's best that the Spybot team know about it before they release v1.5 as a final product.
No one who understands me is [fill in the blank as you best see misfit...].

Agreed, and I'll get to this today/tomorrow/"soon."

[Always Confused]

Results of testing:

1. Changed HOSTS from Read Only, to allow editing.

2. Opened HOSTS in WordPad, removed all Spybot-supplied entries (except, of course, the "This was placed here by Spybot" and "Here Endeth The Spybotheth Entrieths."

3. Saved now nearly-empty HOSTS file. Before I could actually save the file, the Spy Sweeper HOSTS shield caught the change, popped up, and asked if I wanted to allow the change; replied "yes," of course.

4. Started Spybot, went to Immunization, saw that 6355 Windows Global (Hosts) entries were not immunized; all other entries were immunized.

Started Immunization process. While I have no timings of earlier immunizations, nor of this one, I can state that this one ran considerably faster than previous attempts, even of attempts where there were many fewer entries to immunize.

When Spybot was done immunizing (all 6355 entries done,) McAfee's System Guard pop-up appeared, asking if I wanted to allow the changes to the HOSTS file, to which I replied "allow."

5. Checked HOSTS file properties; file reset to Read Only.

This was the first time that I have seen either Spy Sweeper or McAfee question anything about the HOSTS file.

What this proved is likely unknowable. I can only suspect some odd problem in the HOSTS file before I edited it today, or some other variable for which there is likely no solution.

I can only state again, as I did above, that the Immunization process ran quickly and faultlessly. I can also wonder what may transpire when the next Spybot update is available (not the program, a data update.)

[GT500]

I assume that you left the HOSTS file set as writable (aka. non-read-only)? If so, that might be why it worked faster. It may also be why there were less issues this time around. Perhaps, now that the HOSTS file is read-only again, you might see this issue cop up with the next database update.

Personally, I would disable McAfee's HOSTS file protection (if possible). It may just be that having two security softwares monitoring and protecting your HOSTS file is causing a weird conflict. There are also other issues with McAfee, but I won't go into them here and now.

[Always Confused]

Yes, I left the HOSTS file as writable; I'm not certain when it reverted to Read Only. Thus, I don't know if it was writable during the immunization process, and wonder if it now being read-only might affect future updates.

As for McAfee, yes, I'm aware that some people have issues with it. I've been using it for many years, with practically no issues, and as it continues to look good in terms of tests run by various organizations, I have no reason to change to something else. I know of no anti-virus/firewall/etc. programs that don't have issues. I find it amusing to read about, say, program "A", which is highly praised by many, hated by others, and so on.

And, again, as today was the only time that I've seen McAfee ask about modifying the file, yes it is possible that it is creating a conflict, but I have no way of knowing. I will be interested to see if future immunizations also cause McAfee to query me about changing the file.

Chuckle, chuckle: I was just about to send this missive when I noted that I had just received an email from this system. I checked that email, and, as I suspected, found that it was a notification that you had posted the message to which I was responding. I guess I need to go back in time, wait for your email, and then write this....

[GT500]

Like I said before, I won't go into the McAfee issue heavily right now (unless you want me to). I am a bit curious as to why you mention that it gets good reviews. McAfee Enterprise Edition failed it's February 2007 Virus Bulletin certification (http://www.virusbtn.com/vb100/archive/results?vendor=VE2) (they don't test the home editions), and it's performance has been the slowest for years. I find it odd that anyone who tests multiple anti-virus softwares would give McAfee a good review (unless they were testing the Enterprise Edition)...

As far as the e-mail, I guess that's what you call delayed reaction. ;)

[Always Confused]

First, I'm not talking the Enterprise edition, but the home one; second, for every revue of nearly every antivirus program, one can easily find another that contradicts the first. Enough said.