Spybot 1.62 and updates

[bruceb]

Just updated to V1.6.2 and when it did the check for updates, it is downloading files from
2008 ... Why ? ? ? How do we get this corrected ? ?
Windows XP SP2 and yes, date / time are correct .. Note the beta 1.6 was not uninstalled
first. If it should have been, your installer either should suggest it or do it itself.

[md usa spybot fan]

bruceb:

The upgrade process reinstalled your previous version of Spybot with Spybot 1.6.2.46 (in other words replaced). With that in mind, please read the following thread (in particular this post (http://forums.spybot.info/showthread.php?p=289731&highlight=Keyloggers#post289731)):
Question about new spybot
http://forums.spybot.info/showthread.php?t=45628
If that does not explain the updates from 2008, please let me know and I'll attempt to provide a more understandable explanation.

[bruceb]

I just did a complete uninstall of everything Spybot including reboots and then reinstalled
V1.6.2 and tried to update it again. Same issue with it downloading updates from 2008.
I do not know if that is in addition to other updates that may have 2-11-09 dates as per
the latest def download on the spybot website. Hopefully, it will show correctly when your company sends out the next set of defs updates.

[md usa spybot fan]

bruceb:

Some of the updates are in fact correctly dated 2008.

[bruceb]

OK .. but that is very confusing. One would think the files would be updated to the latest info and dated this year at least.

Let's see what happens when V2.0 comes out. Any word yet on what the major changes will be and when we can expect to see V2 Beta or Final ?

Thanks

[drragostea]

Just make sure you got all the important updates downloaded and that's all it matters.

Well the beta of v.2.0 will come out 'soon'.

[md usa spybot fan]

bruceb:


OK .. but that is very confusing. One would think the files would be updated to the latest info and dated this year at least. ...
They are the lastest updates and probably the only reason for confusion is because they are dated at all.
_____

Spybot used to update all the signature (detection) files with each update. Updating started to become problematic because of the ever increasing size of the signature files was causing an ever increasing load on the download servers. They switch to a form of incremental update by splitting the files for most categories of malware into two files. One file containing older more stable signatures and the other containing more resent signatures. Doing this potentially reduces the size of the weekly download.

Quite a few security programs use a form of incremental updates rather than update the entire signature database each update.

Ariva AntiVir, for example, has four main signature files (antivir0, antivir1, antivir2 and antivir3) the largest if which (antivir0) was last updated 2008-10-27 whereas the most frequently updated signature file (antivir3) is often updated many times a day (six times yesterday - 2009-02-13).

a-squared takes another approach. Their new signature updates are all stored in separate files. In the past they would periodically consolidate the smaller files into a few large files containing hundreds of thousands of signatures. However, if it became necessary to update even one signature in one of these large consolidate files, that created an extremely large update. I assume that that is why they altered their signature storage scheme last year. With the exception of their new Ikarus signature file which is stored in a single file although it is updated multiple times daily, the new signature updates are still all stored in separate files. However, there are now two dozen or so consolidated files that only contain about fifty thousand signatures each. Between the consolidated files and the small incremental files there are well over a hundred file (one hundred thirty three actually) that were last updated in 2008.

Spybot, Ariva AntiVir and a-squared all use a form of incremental updates and have multiple signature files that are downloaded. In each of these products some of the signature files were last updated in 2008. The only difference is that Ariva AntiVir only shows the file name being downloaded. a-squared only shows the number of signatures in each file being downloaded. On the other hand the developer of Spybot elected to show the date that a particular download file was last updated.

Just like in Ariva AntiVir and a-squared, that does not Spybot files last updated 2008 obsolete nor unnecessary.