Question about immunizing after update
Hi, I just updated today and Spybot said I should "re-do immunization". I was wondering what exactly it meant since it doesn't say that every time I update. Do I hit "Undo" and then immunize again, or just hit immunize like I normally do after updating?
the weekly Spybot updates normally contain "a few" immunization updates... and it's always a good idea to re-immunuize after each weeks update.
in contrast, the update on 2008-11-05 contained a MAJOR immunization database update, which is why, to stress its importance, it included the "re-do immunization" prompt.
Okay, I still just hit immunize like normal, Spybot just told me that because it was an important update. That right?
to the best of my knowledge, yes, just do it as normal.
at least, that's what i did.
voltra:
This is speculation, although based in knowledgeable assumptions.
The updates contained an update to the Immunization database:
- Immunization database - !Updated Immunization database (546 KB) - 2008-11-05
That update affects the CLSIDs.sbs file that provides the CLSIDs for the Internet Explorer immunization items listed as "Plugins" (which block the download/execution of ActiveX processes).
The last update to that database appears to have been:
- Immunization database - !Updated Immunization database (546 KB) - 2007-07-25
Updates to the CLSIDs.sbs file appear to be the only updates that have an "Actions=immunize". So I assume that is what generates the message (now that is pure speculation) and is that is why you have not seen the message on a regular basis.
In regards to doing an immunization "Undo". The update of 2008-11-05 appears to have reduced the number of immunization "Plugins" immunizations from 895 to 894. If you do not do an immunization "Undo" before downloading the updates, normally Spybot will leave entries that have been eliminated in new updates and not remove them during a subsequent immunization "Undo". I personally consider that a deficiency (defect) in the immunization process.
ps: I have not had time to do an analysis of CLSIDs.sbs to see the exact changes that occurred between the 2007-07-25 and 2008-11-05.
Getting an answer is one thing, learning is another.
Microsoft Windows XP Home Edition running on a 2.40GHz IntelŪ PentiumŪ 4 Processor with 512 MB of RAM and a 533 MHz System Bus.
md wrote: "If you do not do an immunization "Undo" before downloading the updates, ... Spybot will leave entries... ; I ... consider that a... (defect) ".
The problem, however, is that [presumably] no-one thinks to UNDO the old immunization before getting each week's update... and as you noted, after the fact, it's too late. Which is why I believe "normal" immunization --- without an UNDO --- is the only reasonable course for a user to follow at that point.
It appears that the following entry was eliminated from the "Plugins" immunization during the 2008-11-05 updates:
See the following CastleCops discription of that CLSID:Code:[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{FCADDC14-BD46-408A-9842-CDBE1C6D37EB}] Compatibility Flags=dword:00000400
- CastleCopsŪ zeropop.dll FCADDC14-BD46-408A-9842-CDBE1C6D37EB
http://www.castlecops.com/tk1962-zeropop_dll.html
Getting an answer is one thing, learning is another.
Microsoft Windows XP Home Edition running on a 2.40GHz IntelŪ PentiumŪ 4 Processor with 512 MB of RAM and a 533 MHz System Bus.
Wow, so I should have actually been hitting Undo before every update since I installed Spybot? And wait, does that mean Undo doesn't actually remove everything Spybot has done when you're trying to completely uninstall it, for example, if you don't Undo before every update?
Last edited by voltra; 2008-11-08 at 21:51.
voltra:
True.
Since Spybot does not keep a separate file of everything that it has ever been immunized nor a file of items once immunized by Spybot but no longer immunized, the "Undo" only removes the items in its current immunization files. This can result in orphaned immunization entries that will no longer be remove with an immunization "Undo".
Getting an answer is one thing, learning is another.
Microsoft Windows XP Home Edition running on a 2.40GHz IntelŪ PentiumŪ 4 Processor with 512 MB of RAM and a 533 MHz System Bus.
voltra,md usa spybot fan,
Refer my post
http://forums.spybot.info/showthread.php?t=36039
I don't believe it is possible for undo to remove all past Spybot immunisations without using somthing akin to a wild card removal, and that would possibly remove entries from other software which would not be considered polite.
Certainly, doing an undo each time before reimmunising might reduce the number of old immunisation entries being orphaned, but as you can see from my post, even if one starts with none present, and immunises from a single issue, the undo from the same issue doesn't remove them all.
Posting Permissions
Reply With Quote