View Full Version : Temporary Immunization
HubriSonics
2017-06-28, 05:06
Temporary Immunization
When I run an immunization check, I get this message:
"221930 of 221934 entries are already immunized, but 4 are still unprotected!"
Then I apply immunization, after which I get this message:
"All 221934 entries are immunized!"
Then I exit Spybot, relaunch Spybot, and run immunization again. Afterwards, this is the message Spybot displays:
"221930 of 221934 entries are already immunized, but 4 are still unprotected!"
Then I apply immunization again, which results in this message:
"All 221934 entries are immunized!"
Each time I repeat this sequence of actions, I get the same results. I am running Spybot as the Administrator. I am using Spybot 2.4. My OS is 32 bit Windows Vista. Is there any more information that Safer-Networking would like me to provide?
When you open the immunization page, down in the lower right corner it says "Show Details". Could you click that, then scroll through the list and find where it says there are 4 unprotected, then post on here in what category the 4 unprotected are in?
HubriSonics
2017-06-29, 22:33
Thanks for asking the right question, Zenobia. Here are the results I got:
Global (Hosts) (C:\Windows\System32\drivers\etc\hosts.)
Unprocessed: 0
Unprotected: 4
Protected: 15625
Total: 15629
You're welcome. :)
Do you have any security software running that has real-time protection (https://en.wikipedia.org/wiki/Antivirus_software#Real-time_protection)?
HubriSonics
2017-06-30, 05:37
Yes I do. Could any of these applications be causing the problem?
1. AVG Free
2. Malwarebytes
3. Spybot Search & Destroy
It's possible, but usually you would get a notification from one of the security product's real-time protection if it blocked/removed something when you were attempting to immunize. It's worthwhile to look into that, though, just in case. :)
Do you have the AVG Free 2017 version?
I have the same error message and it seems to only occur on my systems that has Avast Free installed. The few Systems I have (a mix of Win7 and Win10) that only have Malwarebytes as the sole Antivirus do not display this SpyBot error.
Error:
"... but 4 are still unprotected!"
BobxT
Are the four unprotected in yours also in the global hosts category? You could look in the Virus Chest and see if anything listed in there seems related to the Hosts file or Spybot. Original location would be the best thing to look at, most likely:
https://www.avast.com/faq.php?article=AVKB21#idt_10
I haven't had Avast Antivirus for a while now, does it have any kind of hosts file blocking or anything like that? :)
Are the four unprotected in yours also in the global hosts category?
YES.
Also nothing in the Avast Free Virus Chest. And no reference within Avast referring to the hosts file.
I have also tried backing up the hosts file and restoring the original blank, default, Windows 7 host file. ie same as when Windows 7 first installed and host file is "empty", only with comments (starting with "#") in the file.
I have also completely disabled Avast Free and run Spybot in update and Immunization modes. Same result with "... but 4 are still unprotected!".
BobxT
I looked for anything with Avast changing the Hosts file automatically, and I could only find one thread. By the end of it, I guess it wasn't Avast changing it:
https://forum.avast.com/index.php?topic=179821.0
That was from a few years ago, also. Ultimately, it looks like it wasn't Avast related.
I did look at some instructions for Avast. I think the File System Shield might be the part of Avast which might handle changes to the hosts file (it has been a few years since I had Avast, though, so not 100% certain.)
https://help.avast.com/en/av_free/17/settings_sh_std_on_exec.html
If you click the Actions down arrow, it shows the default action is:
Fix automatically (default): attempts to repair the file. If unsuccessful, moves the file to the Virus Chest or deletes the file if neither action is successful
So, if the 4 unimmunized hosts file entries are due to Avast, it could be possible that Avast is able to fix it automatically, therefore nothing shows in the Virus Chest. You should get a notification if that happens, though. So could you open the Actions screen and check to see that "Show a notification window when action is taken: notifies you each time an action is applied by the Shield." is ticked? From the looks of it, you might have to check under each detection type: Virus, PUP or Suspicious
You have misread what I posted..
AVAST WAS completely DISABLED when I ran my SpyBot immunisation (check system then update) test. <--**
And I also ran with a restored original blank, default, Windows 7 host file.
--
Repeated running of SpyBot Immunisation ALWAYS comes up with the same error message, so nothing is being fixed yet SpyBot always concludes with saying it is fixed.
Additionally, I always have Avast set everywhere to ASK and does not do ANYTHING automatically.
Yes, I did miss that. Okay, you can open a support ticket:
https://www.safer-networking.org/support/ticket/technical/
KateAkaGunner
2017-10-06, 03:15
both 2.6 and 1.6 say they need updating...i update go back and check again and it says i need to update the 4 issues
I have Windows 10 64 bit
please help :confused:
Temporary Immunization
When I run an immunization check, I get this message:
"221930 of 221934 entries are already immunized, but 4 are still unprotected!"
Then I apply immunization, after which I get this message:
"All 221934 entries are immunized!"
Then I exit Spybot, relaunch Spybot, and run immunization again. Afterwards, this is the message Spybot displays:
"221930 of 221934 entries are already immunized, but 4 are still unprotected!"
Then I apply immunization again, which results in this message:
"All 221934 entries are immunized!"
Each time I repeat this sequence of actions, I get the same results. I am running Spybot as the Administrator. I am using Spybot 2.4. My OS is 32 bit Windows Vista. Is there any more information that Safer-Networking would like me to provide?
My Solution was to Uninstall Avast
Same issue was running Avast antivirus on the PC that had problems. I copied the host file and compared the host file of another PC running Spybot Search and Destroy which did not have problems This PC was running MS Defender. The host file from the PC running Avast (which stated 4 unprotected) did indeed have four entries less than the PC which had 0 unprotected. The comparison of host files revealed that the missing host file entries had the word avast in the address. (variations download-avast & telecharger-avast) By the way I checked these websites and they are suspected of being bad sites. So the Spybot folks are 100% right and Avast is wrong to delete the entries. Disabling Avast does not correct the problem. Avast had to be totally uninstalled to correct this. In fact even after removing Avast, I had to immunize and recheck a few times before the issue went away. Also as a side note, once Avast was uninstalled I got a pop-up from Spybot indicating that the problem could be due to a 3rd party antivirus or firewall. This helpful message did not appear until after Avast was uninstalled.
I can confirm the report by Sueska.
But as he did bot include the actual names and further details, I show them here...
These 4 are not present and if added will be removed by Avast, thereby producing the error in Spybot.
www.download-avast.com
download-avast.com
telecharger-avast.com
www.telecharger-avast.com
However, I am keeping Avast and Spybot and this confirms my earlier assumption that it is largely a cosmetic problem although not the fault of Spybot. I would like to know the reasoning behind the Spybot team's determining that these TWO Avast servers are considered malware or Spyware.
The first would seem by it's name to be relevant to product downloading. Perhaps these are the servers that push out the pop-up panels in Avast Free..? At the moment this is my assumption and if true a very small price to pay.
BTW, anyone thinking of raising a Ticket for Spybot support, I suggest you don't bother. Support is completely clueless and don't even bother to read or consider any submission logically. You are better off sticking with this Forum.
My Solution was to Uninstall Avast
Same issue was running Avast antivirus on the PC that had problems. I copied the host file and compared the host file of another PC running Spybot Search and Destroy which did not have problems This PC was running MS Defender. The host file from the PC running Avast (which stated 4 unprotected) did indeed have four entries less than the PC which had 0 unprotected. The comparison of host files revealed that the missing host file entries had the word avast in the address. (variations download-avast & telecharger-avast) By the way I checked these websites and they are suspected of being bad sites. So the Spybot folks are 100% right and Avast is wrong to delete the entries.
Disabling Avast does not correct the problem.
Avast had to be totally uninstalled to correct this. In fact even after removing Avast, I had to immunize and recheck a few times before the issue went away. Also as a side note, once Avast was uninstalled I got a pop-up from Spybot indicating that the problem could be due to a 3rd party antivirus or firewall. This helpful message did not appear until after Avast was uninstalled.
Thank you for validating my research BobxT, however I purposely did not list the full websites for fear someone may click on a potentially malicious link. Web of Trust has negative reviews for these websites plus Spybot also included them in their list. I checked Whois and cannot validate that these websites are associated with Avast. If a site has the word download + a dash + a domain name, that does not mean that this site is necessarily affiliated with that domain. For example download (dash) google.com is not a google server or part of google's domain. I do agree with you that users can continue to use both products and ignore the message if they want. Even though the websites Avast removed from the host file might be legitimate, why take a chance? Best to go to the official https://www.avast.com directly.
AnimaNomad
2017-12-09, 18:43
Hi Guys,
I'm having the same problem below, and I've done some digging, I'll show you my findings:
Temporary Immunization
When I run an immunization check, I get this message:
"221930 of 221934 entries are already immunized, but 4 are still unprotected!"
Then I apply immunization, after which I get this message:
....
I've updated my Spybot Search & Destroy 2.6 with Admin rights to the latest signatures followed by a complete immunization
https://drive.google.com/open?id=1cYW1WvO2oVY2rjKcD4bXCdRP6jMej2UM
Since it has complaint about incomplete immunization of the hosts file, I did get rid of all Spybot Search & Destroy hosts file entries
using sed to remove the entries and check that they were reaaly gone with grep.
https://drive.google.com/open?id=1ZJ3Deg_VET7k5R9tHL_i94c6qCYLrxUY
Then ran Immunization check, and of course, it found out that it the hosts file did not have any antispyware entries. (just a program crosschecking)
https://drive.google.com/open?id=1m-Vta_xZMHW7q4ZwopM_kjWr27UxGoFV
Then I did run the whole Immunization again, and looked for how many entries Spybot Search & Destroy inserted in the hosts file.
Although it seems to have worked, it didn't, because if you looked closely, it did inserted just 4 entries short (15629 - 4) in my case.
https://drive.google.com/open?id=159GmFqBm3oYY1tqm3k8XXdlJl7OvEAyS
So, in my opinion, there are two possible scenarios:
First: The hosts file served by Spybot Update is missing 4 entries.
Second: The number of lines to crosscheck in the Immunization proccess is 4 entries higher than it should.
Independently of the cause, Spybot Search & Destroy 2.6 Developers should take a look at it and sort it out.
Best regards,
Nomad
TheOwner
2018-07-01, 07:12
Hello,
is here any reason why download-avast is blocked by immunisation? Is malware site or legitimate Avast site? Thank you.
I had a peek at the site using Google cache, but I couldn't tell anything from that. I also did a search on the site to see if any info would come up, but couldn't find anything relevant there either.
You could ask Support about it. Technical Support has "Technical queries related to Spybot", so I presume that might be the one to use to ask:
https://www.safer-networking.org/support/ticket/technical/
Traveller11
2018-07-06, 17:13
Hi Folks!
In 2017 I had this 'problem' and it took some time between Zenobia and myself to resolve it.........
BUT in the end it was 'found' or at least the cause was and it was rectified.
The darn thing just happened again 48hrs ago after my AV/Firewall Updated, so off I went to find the answer from the first time, and it went like this.........
=================================================================================================
Passive Protection Not Working!
Finally got the answer in which the 4 outstanding 'Hosts' files get sorted out!
As I am using Zone Alarm I went into the 'Firewall' side of ZA and then 'View Details', then 'Settings' then click on 'Advanced Settings' and 'UNCHECK' the 'Lock hosts file'.
Then come out of ZA and run Immunization in Spybot, the outstanding files that will not clear immunization are then (or should be) resolved!
When that is done DON'T FORGET to go back into ZA and RE-CHECK the 'Lock hosts file' to continue your protection in ZA.
=================================================================================================
So if you have this 'problem' then it might be worth checking your Firewall as it seems that is where the 'problem' resides which causes the failure in SpyBot Immunization
Good luck!