Bookmark for tinyurl

Printable View

2008-08-20, 19:33
stewjack

Bookmark for tinyurl

This is the first bookmark problem I have had.

Is a bookmark for <tinyurl.com> really malware or an infected site? I ask this because Spybot - Search and Destroy claimed my bookmark was SpywareBOT (Malware), but could not "fix the selective problem" itself.

Deleting the bookmark manually did appear to solve the problem, but when I created a new bookmark manually Spybot - Search and Destroy flagged the newly created bookmark again. I had never even visited the url!

I guess I am asking; "Is the url for <tinyurl.com> what is being flagged, and is it a problem url?" Is Spybot - Search and Destroy just trying to keep me away from a suspect url?

Jack
2008-08-20, 19:42
blues

why does this "forum post" link to tinyurl. com? http://forums.spybot.info/showpost.p...postcount=1and

spybot blocks it. why have links on this forum to sites that are blocked by spybot itself?
2008-08-20, 20:49
drragostea

blues, I have to disagree. Unless that link was in the HOSTS file, then we would not have been able to visit the site at all.

Spybot does not really "block" access to the site, but in most cases disables malicious banners, ads, and flash.

stewjack, you'll have to wait until a official Spybot Team Member confirms this.
2008-08-20, 21:09
blues

spybot blocked it to me, and spybots counter went up everytime i clicked the link. it is also in spybots hostsfile.
2008-08-20, 21:13
drragostea

Quote:

Originally Posted by blues

it is also in spybots hostsfile.

Are you sure about that? I can visit the site and do not have "tinyurl . com" in my HOSTS file.

What counter? You mean SDHelper?
2008-08-20, 21:14
tashi

Hi there,

I have linked this thread for a detective's attention.

Thanks. :)
2008-08-20, 21:16
blues

Quote:

What counter? You mean SDHelper?

yes....
2008-08-20, 21:31
drragostea

I guess that'll clear some, thanks Tashi.

I haven't tried to visit the site with IE&SDHelper. I'll do it now.
2008-08-20, 21:43
blues

Quote:

I can visit the site and do not have "tinyurl . com" in my HOSTS file.

look closer;)

Quote:

I haven't tried to visit the site with IE&SDHelper. I'll do it now
2008-08-20, 21:48
drragostea

How?!

Yep, tinyurl . com loaded in Internet Explorer.
2008-08-20, 21:50
blues

strange.
2008-08-20, 21:52
drragostea

Not strange. Just pure observation. It did load.

Tell me. How did SDHelper "block" tinyurl.com?
--
2008-08-20, 21:57
blues

it just appeared a white page, and the sd-helper counter went up.

the hostsfile is here on your computer: C:\WINDOWS\SYSTEM32\DRIVERS\ETC search through it.
2008-08-20, 22:55
blues

Quote:

Spybot does not really "block" access to the site, but in most cases disables malicious banners, ads, and flash

does it block something to you at all? it has blocked me from visiting some sites.
2008-08-20, 23:05
drragostea

I see a bunch of HOSTS.backup files..

I can view the HOSTS file fine through WinPatrol.

The see the page normally. The ads, pictures, colors, text, etc. you get the picture. I'm not sure what's preventing you from going to the site, either that may be your 3rd party HOSTS application (HPHOSTS or MVPHosts, whatever that may be).
2008-08-20, 23:19
blues

it is not in hphosts and mvps hosts as i could find out.

look here http://hosts-file.net/?s=tinyurl.com&x=15&y=5 and search through this one http://www.mvps.org/winhelp2002/hosts.txt that hphosts site may take some time to load.

i use to delete the hosts backups.
2008-08-21, 02:18
stewjack

Quote:

Originally Posted by drragostea

stewjack, you'll have to wait until a official Spybot Team Member confirms this.

Thanks for the reply drragostea. It's not a big emergency for me personally, but I do use tiny url's when posting on mailing lists and forums, and although tinyurl's appear to just USE the service, I guess it COULD be possible that the service is spreading malware.

I have no trouble visiting the tinyurl site. Spybot just flags the bookmark.

I am subscribed to this topic and will continue to montor - Thanks again

Jack
2008-08-21, 03:12
drragostea

I understand. My concern and question would be how tinyurl can be manipulated to spread malware... A malicious redirection? A Hijacked Clipboard?

I'm sorry for the wait, but tashi (Team Spybot) has already referenced this link to the detectives. : )

It can be a potential false positive. Who knows?

In the meantime if you have any other questions feel free to ask.

Safe surfing.
2008-08-21, 03:43
tashi

Hi,

18 posts in this thread already can make it difficult for a detective to wade through, so please hold off any more.

Thanks.
2008-08-21, 08:50
Yodama

confirmed as a false positive,
will be corrected soon
2008-08-21, 09:00
blues

Quote:

Originally Posted by Yodama

confirmed as a false positive,
will be corrected soon

good:)

but it is strange that others are able to visit the site and not me. how is that possible when it is blocked by spybot?
2008-08-21, 09:37
blues

drragostea: tinyurl.com and www.tinyurl.com is in spybots hostsfile, i saw it. what you say is wrong. i have tried to use only spybots hostsfile and it was blocked. spybot is updated.
2008-08-21, 13:24
saferat

I confirm... problem with tinyurl.com

I can confirm what blues said.

TINYURL.COM is present in the HOST file and it is "in the entries inserted by Spybot - Search & Destroy". I use only Spybot to manage the host file, then no other software may be held liable.

The problem appeared only after the last update (20/08/2008). I am using Spybot S&D 1.6.0.30 on WinXP.

Tinyurl is absolutely NOT a malware site.

I solved the problem deleting the tinyurl entry from the host file:
--------------------------------
127.0.0.1 www.tinyurl.com
127.0.0.1 tinyurl.com
-------------------------------

I rebooted the system and now tinyurl work regularly.

-0--0--0--0--0--0--0--0--0--0--0--0-

@ blues
but it is strange that others are able to visit the site and not me. how is that possible when it is blocked by spybot?

Probably not all the Spybot users use the IMMUNIZATION function or, more simply, they don't have updated Spybot with the last definition released yesterday (20/08/2008, wednesday).
2008-08-21, 14:14
blues

i decided to stop using all the hostsfiles including the spybot hostsfile because it is boring to not see ads/pictures at all, i will rather see ads for things i like instead for error messages or blank spaces all over the place when something is blocked, but tinyurl is still blocked by the sd-helper and the counter goes up everytime i try to visit the site but it is no big deal for me but it may be annoying for others that want to visit tinyurl. but Yodama said it will be fixed so then it is nothing to worry about anymore.

have you really updated spybot drragostea? i mean to the latest detection rules.
2008-08-21, 16:16
drragostea

You got me there (latest definition updates). At least we know that it was a false positive after all.
2008-08-21, 17:18
neurotran

FP? tinyurl dot com in hosts file

1.6.0.31 on Win XP Pro 20/08/2008 update
tinyurl.com is inserted into hosts file and bookmark's 'detected' during scan.
2008-08-21, 17:19
spybotsandra

Hello,

It is a false positive that wil be fixed:
http://forums.spybot.info/showthread.php?t=32935&page=3

Best regards
Sandra
Team Spybot
2008-08-22, 19:43
tashi

Quote:

Originally Posted by saferat

I can confirm what blues said.

Yes as already stated:

Quote:

Originally Posted by Yodama

confirmed as a false positive,
will be corrected soon

Unfortunately with all the posts in this topic, (three pages), it is quite difficult for Team to wade through, or for other members to find any response from Team.

FYI: This particular sub-forum is really for users to report possible F/P's and wait for a detective to respond.