Updating Detection Rules

[Koosharem]

Hi Zenobia -- Yes, there has been a long gap in my postings!! The summer has been busy for me and, SB S&D [B][I]seems[I][B] to be working. But, I still have that nagging suspicion the "Integrated Updater" is different than it used to be. I still don't get the "option" of selecting my own mirror sites for the downloads, and it all happens now in just a few seconds!

I went to the "How To" tutorial for "Updates" and got what I used to see when I selected "Search for Updates" on the program's home page (See Atch 1).

The only thing that opens now when I check for updates is a single window (as shown in Atch 2) with the "Search" button greyed-out!

I "exercised" the Updater earlier this afternoon (a couple of days since new updates were available) and got the following in the Log:

11/11/2011 12:13:23 PM Downloaded update info file. (http://www.safer-networking.org/updates/spybotsd.ini)
11/11/2011 12:13:29 PM downloaded update Detection rules: Supplemental
11/11/2011 12:13:29 PM - URL: http://mirrors.computerbild.de/updat...pplemental.zip
11/11/2011 12:13:29 PM - Local file: C:\Program Files\Spybot - Search & Destroy\Updates\supplemental.zip
11/11/2011 12:13:40 PM downloaded update Detection rules: Update
11/11/2011 12:13:40 PM - URL: http://mirrors.computerbild.de/updat...s/includes.zip
11/11/2011 12:13:40 PM - Local file: C:\Program Files\Spybot - Search & Destroy\Updates\includes.zip
11/11/2011 12:13:44 PM Downloaded update info file. (http://www.safer-networking.org/updates/spybotsd.ini)

All this downloading appears to have occurred in just 21 seconds! And the Log shows that Zip files were included! When was there time to un-zip & install them?? Does SB S&D do this automatically?? (This is what puzzles me -- in the "old days" this whole update-process would consume at least several minutes!)

A short time later, I went to the Website and did a "manual update"; and the log showed only the following:

11/11/2011 2:10:44 PM Downloaded update info file. (http://www.safer-networking.org/updates/spybotsd.ini)
11/11/2011 2:10:46 PM Downloaded update info file. (http://www.safer-networking.org/updates/spybotsd.ini)

What is in the "update info file"?? (Is this just an indication that no more recent updates are available?)

Here's hoping you can see what I'm missing -- I just want to be sure my scans are being done with the most recent program updates latest detection rules.

[Zenobia]

The zip files shown in the logfile are normal.Spybot handles them on it's own.

Let's see......I did find a post where someone else had a somewhat similar problem with updates back in 2009,and they said reinstalling Spybot seemed to fix the problem.
http://forums.spybot.info/showthread.php?t=51207

Would you consider trying that?
There are uninstall instructions here:
http://www.safer-networking.org/en/howto/uninstall.html
Also,if Spybot hasn't removed anything major lately,and you think it would be safe to remove the backups(quarantined files) that Spybot creates,would you also consider doing this part of the instructions as well?

Also, neither the automated uninstall nor the manual uninstall like described above will remove the following directories, which you will have to remove by hand:

• Windows 95 or 98: C:\Windows\Aplication Data\Spybot - Search & Destroy\
• Windows ME: C:\Windows\All Users\Application Data\Spybot - Search & Destroy\
• Windows NT, 2000 or XP: C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\
• Windows Vista: C:\ProgramData\Spybot - Search & Destroy\

(Please note that the Application Data Folder is hidden. So if you cannot find this folder please check your folder properties.)

Explanation: this folder contains the backup (the quarantined files) that Spybot-S&D creates. If the Uninstall would remove this folder as well, this would mean that those backups would be gone. We saw it a few times that new users uninstalled Spybot-S&D in panic after they have experienced a small problem, thus removing the backup that would have undone any changes.

If you do decide to uninstall/reinstall,then there is a mirror list here where you can pick a mirror to redownload Spybot:
http://www.safer-networking.org/en/mirrors/index.html

Please let me know how it goes.

[Koosharem]

Thanks for the info and ideas on what to try.

I think I will go for the "uninstall - reinstall" approach. But, first I need to solve another problem that has cropped up in doing uninstalls.

The most recent occurrence was in uninstalling Ad-Aware (using the uninstaller provided by Lavasoft!) in preparation for installing a new version. At the end of the uninstall procedure, I was prompted to re-start the system ("to complete the uninstall").

When I did the restart, Windows XP got to the point of displaying my "wallpaper graphics" and halted! No Desktop nor System Tray! Not much I could do with that! I was able to recover using Ctrl-Alt-Del to bring up Task Manager, and close Windows from there. Simply rebooting didn't help. 'Had to boot in Safe Mode, and use System Restore to get to an earlier configuration. This isn't something I want to do very often!!

So, it may be a while before I get back to you with any "news". In the meantime, SB S&D appears to be working successfully with this "spontaneously automated" update procedure" . . . .

[Zenobia]

That might have happened if explorer.exe did not start.If it happens again,when pressing Ctrl-Alt-Del,look to see if explorer.exe is listed in task manager.If it isn't,then clicking file,New task,then typing explorer.exe sometimes works,or you may get an error if explorer.exe cannot be started.
Did that happen just the one time when using the adaware uninstaller?

[Koosharem]

No, the bootup halt has occurred several times before the Ad-Aware experience.

But, thanks for your suggestion Re Explorer.exe. That was suggested on another forum also. I'll try it next time the halt happens (if I don't get a "fix" in the meantime )

[Zenobia]

You're welcome.
It only happens when uninstalling programs?
Do you reboot your computer,or shut it down regularly,or do you leave it on most of the time?
Is your computer working pretty good,other than when the booting halt happens?

[Koosharem]

No, the "boot up - halt" doesn't occur just with uninstalls. I've had it happen when returning to normal boot after using Safe Mode, and another time, some months ago, in doing a system re-start after installing a new program!

Yes, I shut the system down and re-boot regularly -- I don't leave it running when I'm not using it.

Yes, the computer is running fine otherwise. I run MS Security Essentials as my primary anti-virus tool along with Ad-Aware Pro (before this latest boot up halt occurrence, when I re-started the system after uninstalling Ad-Aware).

Since I've been unsuccessful in finding a "cause", I'm uneasy about making [U]any[U] change to the system -- this is tough, 'cause I like to "tweek" things! Oh well, perhaps your "Explorer.exe" will be a good "safety net" for me

[Zenobia]

Yes,or at the very least,if you get an error when manually starting explorer.exe (if the bootup halt happens again),it will help to maybe find out the cause by googling the error,hopefully.Good luck with it.

[Koosharem]

Hi Zenobia!!

Good news! I discovered why my "getting updates" had changed and I no longer got the opportunity to choose a mirror site for the download -- and everything seemed to happen "too fast", causing me to be concerned that I wasn't getting ALL the updates (detection rules AND program updates).

I was reviewing my settings (in Advanced Mode) and found, down in "Web Update", that I had checked the first box ("Check at each program start"). I changed that to the second box ("Remind me to look"). That's all it took -- I'm back to the "familiar" pick-a-mirror-site routine!

I guess, now that I understand the "check at each program start" option does, indeed, result in getting ALL the updates, it probably is the better choice since it automates the process -- no room for forgetting!

So, thank you for sticking with me and offering suggestions.

The "boot-up-halt-at-Wallpaper" issue may still be "out there" -- 'hasn't happened recently, but I'll remember your suggestion Re explorer.exe if it does.

Best Regards

[Zenobia]

Good,glad you found out why that was happening.