Browser Helper Query

[Greyfox]

Assuming immunisation has been done, the resident IE browser Helper is enabled, and the browser helper set to "Block all bad pages silently", then it will block a "Bad" URLs such as "ad.yieldmanager.com" as a result of Spybot's listings in IE Settings/Zones.

If the browser helper is changed to "Ask for blocking confirmation" then when a "Bad" URL encountered, Spybot brings up a dialogue box with the option of Allow or Deny. If one selects "Always react this way", then clicks on Deny, an entry is added into the Allow & Deny list accessed via IE/Tools/Spybot - Search Destroy Configuration.

Whilst I can see where an Accept instead of Deny with the Always react this way" might be useful if one really wanted to always override a particular item in the Spybot IE Settings/Zone list, I am a confused as to what benefit adding an Always Deny for a specific URL into this list has, when the URL will be blocked by the IE Settings/Zone list anyhow.

In cases like "servedby.advertising.com/site=xxxxx" one can wind up with multiple entries for something that will be blocked even if it wasn't in the list

OR am I not understanding this correctly at all?

[md usa spybot fan]

Greyfox:

The SDHelper BHO and the placement of sites in Internet Explorer's Restricted Sites zone (see Note #1) are independent facilities. When SDHelper is enabled and is in "Block all pages silently" mode it blocks access to certain URLs without interaction. This blocking is not "a result of Spybot's listings in IE Settings/Zones", it is an independent action taken by SDHelper itself.

When SDHelper is in "Ask for blocking confirmation" mode it issues a dialog that must be answered when it encounters any of the URLs it would normally just block in "Block all pages silently" mode. The purpose of the "Always react this way" with a "Deny" is so you do not have to repetitively reply "Deny" to SDHelper dialogs for URLs you want to block while in "Ask for blocking confirmation" mode.

There is a problem however with the implementation of "Always react this way" with both the "Allow" and "Deny". SDHelper stores the entire URL not just the domain. In the example you cited: "servedby.advertising.com/site=xxxxx". Instead of allowing or blocking the domain "servedby.advertising.com", the entire URL is stored so that access to another URL from that same domain, such as "servedby.advertising.com/site=zzzzz", would not following the rule set for "servedby.advertising.com/site=xxxxx" by using the "Always react this way" option. The problem has been recognized but has not been corrected yet:
[SDHelper] Remember decisions for whole domains
http://forums.spybot.info/project.php?issueid=136
Note #1: Placing a site in Internet Explorer's Restricted Sites zone does not block access to the site. It may place restrictions on the interactions with that site depending on the Security settings for the Restricted Sites zone within Internet Explorer.

[Greyfox]

Thank you md usa spybot fan. I better understand the situation now and after following the link you provided have added my vote for a future option to block the domain instead of the complete URL.

Your answer does however raise another question. By what mechanism is the SDHelper picking up on URL's such as the ones I mentioned. Is there a black list for the SDHelper somewhere, or are these URL's being detected in some other manner.

Again thanks, your help is appreciated.

[md usa spybot fan]

Greyfox:

SDHelper.dll appears to use the following files from the C:\Program Files\Spybot - Search & Destroy\Includes folder:
Cookies.sbs
Domains.sbs
URL-Blacklist.sbs
I assume that the URL blocking is coming from:
URL-Blacklist.sbs

[Greyfox]

Thank you md usa spybot fan.

[foxrose]

I can't find the option when I look through the "settings" after opening the main window.

Another problem: When I set "always answer this way", the box still pops up every time, and with the same url. Seems to have no effect.

[md usa spybot fan]

foxrose:

I answered your query here:
Spybot S&D Configuration Dropdown Missing
http://forums.spybot.info/showthread.php?t=26119