Immunization not working...

S

Sephiroth

New member
This needs to be in the Spybot normal user forum, but I am unable to post there. This is for my home computer, not a work machine.

Spybot will immunize all but 945 entries on my XP Pro x64 laptop. The entries are ALL IE entries. FF and hosts immunize perfectly. I only run Symantec Endpoint Protection on my machine (64bit version), but disabling it does no good. It refuses to immunize multiple IE entries, one containing 547 unimunized entries. The funny thing is, I just tried immunizing again, and the first two that wouldn't immunize actually did immunize, but then the very next one became unimmunized and put my unimmunized count right back to 945. It's as though Spybot wants me to have exactly 945 unimmunized IE entries, but it doesn't care which ones.
 
Same problem here, been wrestling with it for weeks. I have NONE of the software listed in the "usual reasons" sticky thread.

Windows XP Pro x64
IE8
Avast Home
SpywareBlaster
Spybot S&D

I have tried uninstalling both Avast And SpywareBlaster - no joy. I have even restored to a drive image from before the issue started. No success there either.

From memory, the 945 items are in administrator settings and domains. The debug list .txt file is too large to upload and I don't have a zipper installed (because this is a stripped down install).
 
Now at 969 items failing to immunize after latest Windows Update x64 IE8 security patch followed by Spybot S&D update. No such issues with XP Pro 32 bit.
 
Sorry, I can't.

I could try rolling back to a drive image recorded before this issue arose and then apply the Windows Updates one-at-a-time, recording another image after each update then applying the SS&D updates until I find which one it is, but to be honest I don't have time for that.

*edit* Spybot hasn't "stopped working" please read this thread again.
 
Last edited:
Stupid question here for you folks having problems....what type of browser are you using?

Ahother thought....when was the last time you deleted all your Temporary Internet Files....and Cookies...and Add-Ons?

I DO know that IE8 still has problems (from friends of mine)...but you CAN roll back to IE7. I'm still on IE7 as I've heard / read about too many issues.

That said....to Delete items in Temp etc...open your IE and then click on Tools, then Internet Options....then under Browsing History click on Delete....then another window will open up for Delete All (check the box).

Once this is done then try your Immunization again.

Of ALL the friends I have....only ONE person has had immunization problems...and that was because the machine was already infected with malware :sad:
 
Last edited:
a4nic8er said:
Same problem here, been wrestling with it for weeks. I have NONE of the software listed in the "usual reasons" sticky thread.

Windows XP Pro x64
IE8
Avast Home
SpywareBlaster
Spybot S&D
Click to expand...
Hi
I have the same config as you, tried everything. But then I go under tools>internet options>advance> reset Internet Explorer settings.(IE8)
Then I run Immunization again, all gone:laugh:

Hope this help

Arne
 
Hoffmaister said:
Hi
I have the same config as you, tried everything. But then I go under tools>internet options>advance> reset Internet Explorer settings.(IE8)
Then I run Immunization again, all gone:laugh:

Hope this help

Arne
Click to expand...

OK, tried that. Unfortunately all it did was change the sections where the 969 non-immunized items are. See attachment and compare it to the one in my previous post.
 
@ Hoffmaister: are you running XP Pro 64 bit?

Here's what I have done to try and trace the cause of this problem...

Isolated from internet.
Restored to image from 30 November 2009
SSD-immincomp3A.PNG


NO Microsoft Updates installed!

Disabled SpywareBlaster protection.
Uninstalled Avast! 4.8.
Rebooted.
SSD-immincomp3B.PNG


Immunized.
SSD-immincomp3C.PNG


So far, so good (remember, still no Microsoft updates).
Connected to internet, updated SS&D.

SSD-immincomp3D_upd.PNG


Started SS&D.
SSD-immincomp3E1.PNG


Immunized, 1737 items failed. See attachment immudebug1737-1.zip for 990KB immunization debug text file.
SSD-immincomp3E2.PNG


Updated and enabled SpywareBlaster protection. No change.
Rebooted. No Change.
Immunized. No change.
Removed Immunization, reset Internet options to default (deleting all personal settings).
Rebooted.
Immunized. Note, all 1737 failures are now in one section - Internet Explorer (64 bit) \Software (Secure Domains). See attachment immudebug1737-2.zip for 293KB immunization debug text file.
SSD-immincomp3F.PNG


Installed 9 Microsoft High Priority updates (may as well, I have proven that they are not causing the problem).

SSD-immincomp3G.PNG


Rebooted.
Installed Avast!5.
Rebooted.
Ran SS&D Immunization again. No change.

Conclusion: The problem arose when only SS&D updates alone were installed. The issue is with SS&D itself, when running on XP 64-bit systems.
*edit* I suspect the issue is with the 658KB "Base trojan horse detections 2009-12-09"
 
Last edited:
Updated SS&D (yes both updates - screenshot taken midway through update).

SSD-immincom4A_upd.PNG


Immunized, 1869 items failed (up from 1737, an increase of 132 items). Half of the new detections succeeded. Each of the sections showing 11 items unprotected had 22 prior to imminization attempt.
SSD-immincom4B.PNG



Immunized again. Slight change to placing of immunization failures, from IE 32 bit to IE 32/64 bit, but still the same number.
SSD-immincom4C.PNG


Removed Immunization, reset Internet options to default (without deleting all personal settings).
Immunized. Note, all 1869 failures are once again all moved to one section - Internet Explorer (64 bit) \Software (Secure Domains).
SSD-immincom4D.PNG


New day, same stuff :\
 
No such issues with XP Pro 32 bit or Windows 7 RC 64 bit on same machine, only XP Pro 64 bit.

SSD-immincom4E-W7.png
 
Last edited:
spybotsandra said:
Hello,

Did you also undo the immunization and then immunize again?

Best regards
Sandra
Team Spybot
Click to expand...

Yes. I did that and quite a few other things. My actions and the interesting results from them can be easily followed by reading page one of this thread.

*edit* There's even a couple of immunization debug files there too, if anyone at Spybot is interested in looking at them.
 
Last edited:
Sorry for the lack of responses. The forums had an issue with my posting permissions and I had to get an admin to fix me up. My results are the same however. Spybot immunizes Windows 7 32/64, Windows Vista 32/64, and XP 32, but not XP x64 Edition. It fully immunizes Firefox, but IE acts strange with immunizations. For example, every other item had X number of unimmunized entries. Well once in a blue moon it will immunize those, but then one farther down the list will GAIN unimmunized entries so that the exact same count of unimmunized entries is the same. I do NOT use IE at ALL, but like to keep it immunized anyway. I am required to use it for Windows Update obviously, and I worry about hijackers and things.

*EDIT*

One thing to note is that I do not install Vista/7 software on my XP machines due to the increased resource usage. As such, I have IE6, not IE7 or IE8 on the machine. I also have Media Player 10, and I use Star Office, not MS Office. Anyway, I have IE6 where one of these guys posted that he had IE8, so I believe that this is an issue not related to the version of IE.
 
Last edited:
I have IE8 running on WinXP Pro SP3, and am not seeing any increased resource usage over when I had IE6 or IE7. It runs fine and is far safer that the previous IE offerings. I use Firefox 3.6 as my default browser.
 
Hello,

Please also try to click a second time on the immunization tab after immunizing.
Does this change anything?

If this does not help please try the following:
1. Start your PC in safe mode.
2. Launch Spybot.
3. Unselect all the options in the immunization tab except the ones which are not immunized.
4. Undo Immunization.
5. Redo Immunization.

Best regards
Sandra
Team Spybot
 
spybotsandra said:
Hello,

Please also try to click a second time on the immunization tab after immunizing.
Does this change anything?

If this does not help please try the following:
1. Start your PC in safe mode.
2. Launch Spybot.
3. Unselect all the options in the immunization tab except the ones which are not immunized.
4. Undo Immunization.
5. Redo Immunization.

Best regards
Sandra
Team Spybot
Click to expand...

Ok. Tried that, several times. Appeared to work until reboot into normal mode but I suspect it was just moving the unprotected items around again. Upon normal restart and Immunization check, I end up with 5919 unprotected items in IE 32 bit (Domains). Uncheck everything but that section, undo, immunize. Looks ok. Select all, check again. Now have 1857 unprotected in IE 32 bit (secure domains) plus 1857 unprotected in IE 64 bit (secure domains). Deselect all but those two, undo, immunize, have to 1857 in IE 64 bit (secure domains). Stuff this, select all, check again, 1857 unprotected in IE 64 bit (secure domains), right back where we started from.

SpybotS&D won't immunize IE 64 bit (secure domains) properly, but appears to be immunizing 32 bit IE ok. While wondering if this is going to be rectified, I will make sure not to use 64 bit IE 8.
 
tried your suggestions to no avail. I had already tried immunizing multiple times and that never worked. It seems to have a set number of immunizations it simply refuses to do and shuffles around what cannot be immunized. This is now also affecting a friend's computer, which is XP Pro 32bit. He has IE6 also since XP becomes unusable for his system (512MB RAM) if he installs 7 or 8.
 
Alright after the latest Spybot updates it immunized some, but not all entries. However, I decided to try my weekly chore of selecting only the ones that won't immunize and undo the immunization, then redo it. This worked on a few, so I deselected those, and after multiple times of chasing the immunization bug around (immunize one, another loses immunization) I finally got everything immunized. This is ALL IE-related. The hosts file and FF immunize perfectly each time. We'll see what happens when the team releases another update though...
 
Latest update: No better, worse if anything.

2193 Immunization failures, spread all over.

SSD-immincom7C.PNG


Took 10 -15 minutes of rebooting into safe mode, immunize, check again, select each section, undo, redo, check again, reboot in normal mode, check again, select each section, undo, immunize, check again, select all, check again, undo, immunize, check again - just to get the 2193 failures into the same section - IE (64 bit) \SOFTWARE (Secure Domains).

Still no such issue with XP 32 bit or W7 RC 64 bit, only XP 64 bit!

Also noted that it takes 50 seconds to exit SS&D on XP 64 bit while it "unloads user registry hives." This takes less than 1 second with XP 32 bit and W7 RC 64 bit.

And in case you are wondering, I have completed full virus scans (Avast), Live Onecare scan, rootkit scan (Sophos), HJT (all with a clean bill of health).
 
Last edited:
You must log in or register to reply here.
Back
Top