View Full Version : Fixed: Bookmark for tinyurl
stewjack
2008-08-20, 19:33
This is the first bookmark problem I have had.
Is a bookmark for <tinyurl.com> really malware or an infected site? I ask this because Spybot - Search and Destroy claimed my bookmark was SpywareBOT (Malware), but could not "fix the selective problem" itself.
Deleting the bookmark manually did appear to solve the problem, but when I created a new bookmark manually Spybot - Search and Destroy flagged the newly created bookmark again. I had never even visited the url!
I guess I am asking; "Is the url for <tinyurl.com> what is being flagged, and is it a problem url?" Is Spybot - Search and Destroy just trying to keep me away from a suspect url?
Jack
why does this "forum post" link to tinyurl. com? http://forums.spybot.info/showpost.php?p=2469&postcount=1and
spybot blocks it. why have links on this forum to sites that are blocked by spybot itself?
drragostea
2008-08-20, 20:49
blues, I have to disagree. Unless that link was in the HOSTS file, then we would not have been able to visit the site at all.
Spybot does not really "block" access to the site, but in most cases disables malicious banners, ads, and flash.
stewjack, you'll have to wait until a official Spybot Team Member confirms this.
spybot blocked it to me, and spybots counter went up everytime i clicked the link. it is also in spybots hostsfile.
drragostea
2008-08-20, 21:13
it is also in spybots hostsfile.
Are you sure about that? I can visit the site and do not have "tinyurl . com" in my HOSTS file.
What counter? You mean SDHelper?
Hi there,
I have linked this thread for a detective's attention.
Thanks. :)
What counter? You mean SDHelper?
yes....
drragostea
2008-08-20, 21:31
I guess that'll clear some, thanks Tashi.
I haven't tried to visit the site with IE&SDHelper. I'll do it now.
I can visit the site and do not have "tinyurl . com" in my HOSTS file.
look closer;)
I haven't tried to visit the site with IE&SDHelper. I'll do it now
drragostea
2008-08-20, 21:48
How?!
Yep, tinyurl . com loaded in Internet Explorer.
drragostea
2008-08-20, 21:52
Not strange. Just pure observation. It did load.
Tell me. How did SDHelper "block" tinyurl.com?
--
it just appeared a white page, and the sd-helper counter went up.
the hostsfile is here on your computer: C:\WINDOWS\SYSTEM32\DRIVERS\ETC search through it.
Spybot does not really "block" access to the site, but in most cases disables malicious banners, ads, and flash
does it block something to you at all? it has blocked me from visiting some sites.
drragostea
2008-08-20, 23:05
I see a bunch of HOSTS.backup files..
I can view the HOSTS file fine through WinPatrol.
The see the page normally. The ads, pictures, colors, text, etc. you get the picture. I'm not sure what's preventing you from going to the site, either that may be your 3rd party HOSTS application (HPHOSTS or MVPHosts, whatever that may be).
it is not in hphosts and mvps hosts as i could find out.
look here http://hosts-file.net/?s=tinyurl.com&x=15&y=5 and search through this one http://www.mvps.org/winhelp2002/hosts.txt that hphosts site may take some time to load.
i use to delete the hosts backups.
stewjack
2008-08-21, 02:18
stewjack, you'll have to wait until a official Spybot Team Member confirms this.
Thanks for the reply drragostea. It's not a big emergency for me personally, but I do use tiny url's when posting on mailing lists and forums, and although tinyurl's appear to just USE the service, I guess it COULD be possible that the service is spreading malware.
I have no trouble visiting the tinyurl site. Spybot just flags the bookmark.
I am subscribed to this topic and will continue to montor - Thanks again
Jack
drragostea
2008-08-21, 03:12
I understand. My concern and question would be how tinyurl can be manipulated to spread malware... A malicious redirection? A Hijacked Clipboard?
I'm sorry for the wait, but tashi (Team Spybot) has already referenced this link to the detectives. : )
It can be a potential false positive. Who knows?
In the meantime if you have any other questions feel free to ask.
Safe surfing.
Hi,
18 posts in this thread already can make it difficult for a detective to wade through, so please hold off any more.
Thanks.
confirmed as a false positive,
will be corrected soon
confirmed as a false positive,
will be corrected soon
good:)
but it is strange that others are able to visit the site and not me. how is that possible when it is blocked by spybot?
drragostea: tinyurl.com and www.tinyurl.com is in spybots hostsfile, i saw it. what you say is wrong. i have tried to use only spybots hostsfile and it was blocked. spybot is updated.
I can confirm what blues said.
TINYURL.COM is present in the HOST file and it is "in the entries inserted by Spybot - Search & Destroy". I use only Spybot to manage the host file, then no other software may be held liable.
The problem appeared only after the last update (20/08/2008). I am using Spybot S&D 1.6.0.30 on WinXP.
Tinyurl is absolutely NOT a malware site.
I solved the problem deleting the tinyurl entry from the host file:
--------------------------------
127.0.0.1 www.tinyurl.com
127.0.0.1 tinyurl.com
-------------------------------
I rebooted the system and now tinyurl work regularly.
-0--0--0--0--0--0--0--0--0--0--0--0-
@ blues
but it is strange that others are able to visit the site and not me. how is that possible when it is blocked by spybot?
Probably not all the Spybot users use the IMMUNIZATION function or, more simply, they don't have updated Spybot with the last definition released yesterday (20/08/2008, wednesday).
i decided to stop using all the hostsfiles including the spybot hostsfile because it is boring to not see ads/pictures at all, i will rather see ads for things i like instead for error messages or blank spaces all over the place when something is blocked, but tinyurl is still blocked by the sd-helper and the counter goes up everytime i try to visit the site but it is no big deal for me but it may be annoying for others that want to visit tinyurl. but Yodama said it will be fixed so then it is nothing to worry about anymore.
have you really updated spybot drragostea? i mean to the latest detection rules.
drragostea
2008-08-21, 16:16
You got me there (latest definition updates). At least we know that it was a false positive after all.
neurotran
2008-08-21, 17:18
1.6.0.31 on Win XP Pro 20/08/2008 update
tinyurl.com is inserted into hosts file and bookmark's 'detected' during scan.
spybotsandra
2008-08-21, 17:19
Hello,
It is a false positive that wil be fixed:
http://forums.spybot.info/showthread.php?t=32935&page=3
Best regards
Sandra
Team Spybot
I can confirm what blues said.
Yes as already stated:
confirmed as a false positive,
will be corrected soon
Unfortunately with all the posts in this topic, (three pages), it is quite difficult for Team to wade through, or for other members to find any response from Team.
FYI: This particular sub-forum is really for users to report possible F/P's and wait for a detective to respond.