Printable View
Chrome scanning support has been added in 1.6.1.
Immunization is not possible with Safari and Chrome currently since both seem to offer no interface for that purpose. Well, Chrome has a database for an Internet blacklist, but we haven't how that could bu (mis)used for immunization yet ;)
What command line?Quote:
Originally Posted by PepiMK
Not that I don't know what a command line is, but if one is running automatically, there is no place to put this command line option in.
Please elaborate.
Same issue with the reference to the /silent documentation - the options are present, but no description of how to make use of them.
unsolicited:
You can add the command line parameters to the scheduled task. For example: by adding the following parameters, Spybot should start, update, immunize and close:
For additional information on command line parameters that can be used, see the following:Code:"C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autoupdate /autoimmunize /autoclose /taskbarhide
- Are there any command line parameters?
http://www.safer-networking.org/en/faq/30.html
I'm not so familiar with the programming languages, but it would be fun to know how ClearType can be integrated into Spybot, like it uses CT by default if the user's machine has CT enabled.
Thanks alot md usa spybot fan, you're code is what I was looking for, appreciate it. :)
Hi, thanks for this great software, it's good to see how the best stuff is still free (as so often) and that you're sticking to it for so long. I hope this is generating good business for you and that you managed to get in tune with that mystical Girl we've been praying for ;)
I just read on your frontpage people complain about speed, and even I am twiddling my thumbs for the hour it takes to scan. So here my suggestion as a software designer, programmer, and database person:
Your scanning algorithm seems to follow the following nested loop structure:
for(threat in ALL_THREATS) {
for(fingerprint in threat.fingerprint) {
for(fingerprintOnObject in fingerprint.affectedObjects) {
fingerprintOnObject.check();
}
}
}
problem with this is a lot of random access seeking 300000 times the same 100000 objects, hitting the registry 200000 times and >100000 times the same <10000 files. Instead, how about streaming the registry and files through a filter that looks for all fingerprints per file rather than files per fingerprint?
for(object in ALL_THREATENED_OBJECTS) {
for(objectThreatFingerprint in object.threatFingerprint) {
objectThreatFingerprint.check();
}
}
that way you check every object (file, registry key) only once and each time you check for all known threat fingerprints. I think you could get a 10x to 100x speed improvement out of that.
What do you think?
I have one more suggestion about usability. The other day I had a very ugly virtumonde infestation. And eventually it killed my setup to the point where I rebuilt a Windows machine (after > 5 years and 1 hard drive crash). The problem was something was deleting WINDOWS/system32/drivers files (pci.sys was gone). But why did I even restart?
I restarted because I was trying to kill winlogon before killing that sdss (sp?) process. And I did that because I loaded up some new process killer which I had to do for the first time and hit the wrong button then the machine came down never to boot again.
This shows:
- you want to avoid rebooting during clean up as much as you can
- when something bad has happened, any user will be executing unfamiliar
stuff under a state of stress with possibly limited access to information (if the browser has a "helper" that spawn malicious processes, you don't want to run the browser to read the fine-print.)
So, therefore, the more that Spybot S&D is able to kill processes automatically so that it can stop the spawning of malicious processes and insertion of registry keys, the better it is for a successful recovery. That new (?) virtumonde thing can probably teach a lesson into how it could work. You need to
1. kill the system-process (winlogon?) that spawns processes and inserts keys
2. while keeping the machine from shutting down and rebooting
3. do a sanity check on system files required for the next reboot
4. restore those files from a backup previously stashed away (outside of the recovery checkpoint function, which is affected by the same malware.)
and finally
6. Protect Spybot S&D from becoming itself a target for malware (keeping in mind that with increased popularity comes increased exposure.)
Thanks for all you have already done!
6. one small attempt in the current version are the randomly named copies of main executables in the Spybot-S&D folder and that they're marked system & hidden. We have two much stronger concepts at hand for 2.0 though. Not sure if I should mention them here to allew malware creators to counteract before they're even available :D:
As for the other stuff, you're right there of course, but I wonder what you would think about the bootable CD thing (insert a CD, boot from it, clean stuff while your system is inactive and malware can not interact/conflict) compared to your suggestions?
edit: overlooked the post above. actually, there is quite of lot of optimization in avoiding multiple lookups. Most of the commands and parameters use pre-created and optimized caches. Whether your suggestion would be a speed improvement or slowdown depends a lot on comparing the number of files to the number of patterns, and modern Windows installations grow quite huge, and has other disadvantages. As for the direction of comparing things, did you see this blog post? I tried to explain a bit about the difference of the two possible approaches and why we feel a hybrid would work best.
is there any set date on when 2.0 will be released??
Hello,
No, there is not any date set yet.
Best regards
Sandra
Team Spybot
The bootable CD would be a good thing, very certainly. That's something to want to have handy at all times. Sometimes I see some haphazardly thrown together Linux bootable CD with stuff that then doesn't do so much. But would be neat to have this for Spybot.Quote:
Originally Posted by PepiMK
O.K. I'll read this. You probably already do the right thing then. Just wish there was some magic to make it all go faster.Quote:
Originally Posted by PepiMK
do you think you could take a look at adding support for this to the app becouse this will not only make the program a whole better but more user friendly to. http://www.CompatDB.org http://compatdb.org/faq-96.html. and could you possable add support for http://www.ntcompatible.com witch is ran by same people as CompatDB.org
The CompatDB.org project is an attempt to create a free (as in the freedom) standard for user submitted compatibility lists as well free compatibility lists for Windows, Linux, and Mac OS. The provided compatibility lists as well the XML-based CompatDB.org document format are licensed under the terms of the GNU Lesser General Public License (LGPL) and can be used in both open source and commercial projects for free.
I didn't find a single product with the newest version or even a next-to-newest one listed, but more important: how would you thing it should be integrated? Just by itself, it would be far from anything else by topic (and in this case, looking p things online would always be more up-to-date). In the tools section, System Startup and Uninstall list installed software in a way, but do these entries use the exactly same names as Uninstall entries for example? I does not seem so, and associating thousands ore more of entries with additional data so that it could be used does look a bit time consuming.
I have some suggestion for the Spybot team.
Resident available for Firefox.
Better detection for ad-ware, malwares, dialers, keyloggers, trojans and worms.
Reduce memory usage during scan.
Increase the amount of updated threats.
More updates(not weekly).
An idea (I'm not sure if it's already getting implemented.).
Integrating SDDT in Spybot 2.0 or later.
Adding more testing features to SDDT.
Uploading malware samples for instance muha:
(or at least the information that is needed for more research, hahses, location file(s), and such.)
It's probably too late to post this suggestion for Spybot 2.0 but I wanted to suggest providing a separate icon for accessing the Spybot logs. I tend to configure Spybot to run as automated as possible to make it as easy as possible for people to run it. This way, I can "train" them to simply click the Spybot icon on a weekly basis and it will automatically update and immunize the system.
Accessing logs with Spybot 1.6.2 is a pain since I have to wait for the automated functions to complete before I can access the Spybot console window.
I do realize I can access the logs from Windows Explorer but that requires changing folder options to reveal otherwise hidden folders.
Spybot 1.6.2 has a separate update icon in the Spybot folder in the start menu and I think adding a separate "view logs" icon would provide quick access to the Spybot logs, for those who configure Spybot as I do.
Peace...
Hello,
There will be a special icon for the logs in Spybot 2.0.
You will find an outlook at Spybot 2.0 here.
Best regards
Sandra
Team Spybot
Spybot- FileShreader
this already has 'templates' to shread specific directories, im more than curious why the recycle bin directory wasnt included in it, as it would logically be one of the more pertinant places to use it?
My suggestion is to get this new version out before Spybot becomes totally irrelevant. It's amazing how many users have dropped the product lately. The current version is outdated and it makes the situation even worse when it takes so long to catch up. I really mean well but this 2.0 development has taken waaaay too long guys, MBAM & SAS (among others) have taken the ball and ran away with it. I would like to use S&D but there's no point anymore, it's just not as good as the alternatives. What's more, the alternatives continue to pull further away while development drags along for V 2.0. These days you can't take this long between development cycles, whether that's good or bad it's simply the way things are.
I'll admit, if it weren't for the immunization there would be no case for keeping Spybot on my system; I've even disabled TeaTimer because it bogged down my system with no real benefit. Now I just navigate to my Spybot folder, run the updater, then open Spybot and go straight to Immunize and that's it.Quote:
Originally Posted by Watasha
Hello,
I would have a suggestion for the immunize function. In particular for the modification of the hosts file.
I don't know if it is the immunize function that sometimes messes up or if the user have messed up their hosts before, but about once every two month I treat a case on the forums where the user is terribly scared cause his PC is connecting to 007guard.com all over the place.
The reason usually is that 127.0.0.1 localhost is missing and the first line has become 127.0.0.1 007guard.com, so that all connections connectiong to localhost are then showing as connecting to 007guard.com.
I thought it might be worth a shot to add "127.0.0.1 localhost" as a first line of the list for immunizing hosts, to prevent this kind of scare. I imagine this would be easy to implement and would prevent the FP.
regards myrti
Spybot 1.6.2 has an option to "remember my decision". So I don't have to click deny everytime a registry change pops up. It it possible to have same feature in Spybot 2 too?
I'm wondering why a feature as seemingly simple to implement and so useful (IMO) when needing more resources while Spybot is running than the machine has available isn't already part of the application?
Mark
Hello Mark,Quote:
Originally Posted by Markg2
there is a Pause button in Spybot-S&D 1.6.2. You need to check the option "Show expert button in the result list." in the settings pane to have it shown. I do not know why it is so well hidden though.
In the current beta of Spybot-S&D 2.0 a Pause button is available by default. :)
daemon
Thanks--no way I would have found the thing!
Mark
Well, not so fast. I've confirmed that the box is now checked off but when the scan runs I still only have the one selection horizontal bar that says stop the check. Is there another level of mystery here that I'm missing ;-)?
It needs to be on, not off.Quote:
Originally Posted by Markg2
daemon
Well the box is checked and the statement says, 'show...' so that's on but at least on this computer on doesn't equal on.
Thanks anyway--
Mark
If anything possible about his suggestion...
http://forums.spybot.info/showpost.p...99&postcount=3
As of July 22, 2011, Spybot running in startup has caused my computer to fail to load correctly with the error PAGE_FAULT_IN_NONPAGED_AREA. I am running Windows 7, no service packs, x64 bit system. I had to disable it in safe mode for my computer to start. I wanted to notify you all so that you could look into it.
These were the startup commands I had to disable:
C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
C:\Program Files (x86)\Spybot - Search & Destroy 2\SDCleaner.exe /autoclean
C:\Program Files (x86)\Spybot - Search & Destroy 2\SDistTestConsole
I have a hunch it might have to do with the TestConsole.
Spybot 2.0.4(aka Beta 2) is stable for some people, and others have problems with it. Everyone knows that use of a beta version is totally used on your own risk. Even the Spybot team says so. An average PC-user should not use a beta version because of their bugs.
I understood the risks before I installed Beta and accepted them. I just wanted to report it in case others had the same issue and a bug needed to be fixed. Beta is aiming to become stable for all users, so I wanted to help, but if that error is common then I do apologize.
No worries. It's nice to see people who helps the Spybot team to improve. The more people who install the beta and report bugs and make suggestions to improvements, the better the program will be. :)
Hello all,
I am requesting that I at least be able to have everything happen in one main window not so many pop-up little ones.
This has been a very annoying trend I find with a lot of software these days. Seems like a step backward. I don't mind if it can be "optional" to set it this way. I am really tired of repositioning and re-sizing windows all day.
Windows itself is absolutely the WORST offender. Whats with all those unresizable dialogs etc that never remember anything about anything.
ITS 2011 BILL !!!
OK ... rant over
I will say; however, that Spybot is still a great program. I'll also add that I was pleased that at least IT did remember my window positions and sizes. I'd just like to see a return to being able to do everything in one window if I so choose thus avoiding setting up all those window positions and sizes in the first place.
Keep up the good work :thanks:
Floyd
Vancouver BC
Canada
Day 2 of operation and all is well...
I went through it and set it up the way I always have. Pretty much manual Except for update.
Not sure if I'll be able to spend the time to go through all the possible scenarios, but doing file scan, system scan, updating ... they all worked well. I have on-access turned off because of the 2 other software doing that function here.
Sophos 9 enterprise type anti-virus with on-access scanning plus Malwarebytes real time enabled also. (Sophos seems very sensitive to many things but at least I get a warning and can research further. I have it set to heuristic ultra paranoid mode and it lives up to it, it seems) quite a few false positives but I'm sure the University network that supplies it likes it that way :-)
just an FYI
Floyd
Vancouver
Canada
:band:
Yea, it's quite annoying it's popping up a new window all the time when you're trying to access a new "entrance".
hi spybot search and destroy should have clean at reboot it ensures effective malware cleanup it has been already implemented in lavasoft spyware doctor
One suggestion:
Since it will confuse a lot of the users, and probably the users who don't know so much, you should remove the "Antispyware & Antivirus Protection" in the interface. You should rather rename it, because Spybot isn't an anti-virus application, it's an anti-malware application. If you rename it to "Antispyware & Antimalware Protection", it would be better, because I think there are users who think Spybot is an anti virus application, and therefore they remove their current anti virus, and replace it with Spybot. And there are plenty of people that doesn't enter Spybot's homepage and read the tips made(don't know if I can say it this way, my mother tongue isn't english).
Thanks,
Imageek
Hello,
Thanks for the suggestion. I will forward that. :)
Best regards
Sandra
Team Spybot
Perhaps these have been discussed already, but I don't see them...
- It would be nice to be able to exclude entire drives from scanning. Maybe there is one already, but I don't see it. When running under Windows PE, I think it's safe to assume no need to scan drive X and (sometimes) drive Y. Not a big deal.
- It sure would be nice to be able to update from the command line (e.g. when building a PE) and have all windows close automatically when done. The old "SDUpdate.exe /autoupdate /autoclose" doesn't close the main update window when finished.