Spybots trying to make an outbound connection?

M

momnewbie

New member
Hi,
I've been a spybots user for years now and am very pleased to have been able to use it to make sure my machine is more secure.
A couple of problems have developed just recently and I couldn't see any reference to them in any other posts - my apologies if I've missed them and they've already been dealt with.
Lately when I update, the progress bar at the bottom of the spybots window moves along steadily and reaches the end just as a green checkmark appears against the updated item, however the small window which shows information being added to a windows file continues to show information being added. (I think this is a windows application). This has only happened over the last few months: is there any way to fix it, please?
Something else happened today which bothers me a little more. The window continued to show the updating process and then my firewall (Sygate) asked me if I wanted Spybots to connect to 80.190.250.239, which was "something" .de. Do I have a corrupt file? This has never happened before and I am concerned about it.
Any further info would be appreciated.
I'm running Win98SE, with Sygate 5.5, AVGfree and I had just checked my machine with A-squared.
Thanks,
Momnewbie
 
momnewbie said:
Spybots trying to make an outbound connection?

Something else happened today which bothers me a little more. The window continued to show the updating process and then my firewall (Sygate) asked me if I wanted Spybots to connect to 80.190.250.239, which was "something" .de. Do I have a corrupt file? This has never happened before and I am concerned about it.
Click to expand...
Go into Spybot > Update > click on Show Log > page down to the events at the time you were asked if you wanted to allow Spybot to connect to 80.190.250.239. Where the downloads coming from www.see-cure.de?
  • Host Name : www.see-cure.de
    IP Address : 80.190.250.239
    Location : Germany
The updates starts with a download of a control file download from:
The 2006-01-06 updates themselves can be downloaded from any of the following sites:
You have to make a outbound connection in order to update!
 
Sorry for not making myself clear. I do understand what you say about Spybot having to make a connection to update, but in the spybots window, the green checkmark had appeared and the progress bar across the bottom had been completed and disappeared; I assume that this must mean the updating process has finished; it always used to be so. The windows "updating file" continued to show (as it has done for a while now) *then* my firewall alerted me that spybot wanted to make an outbound connection and it also informed me that it had changed since it last connected to the internet.
I am aware that after any program updates, my firewall informs me that the program has changed - this often happens with my anti-virus program - so that is not my concern. It was the fact that spybot had made the connection for updates, I had instructed it to download the updates which it had apparently completed, and then it tried again to make a connection, uninitiated by me, in its altered state.
Is this any cause for concern?:confused:
Thanks,
Momnewbie
 
update logs

I forgot to say, I checked the Spybot update logs which show that the updated info was downloaded at 15.20 from security.kolla.de and my firewall log shows that the outbound connection was attempted at 15.24. I have a fast broadband connection and updates normally take up to 1 minute to complete.
Hope that helps a little more.
Momnewbie
 
Your original query was concerning:
momnewbie said:
… and then my firewall (Sygate) asked me if I wanted Spybots to connect to 80.190.250.239, which was "something" .de.
Click to expand...
Which I attempted to indicate was a download server:
  • Host Name : www.see-cure.de
    IP Address : 80.190.250.239
    Location : Germany
Now you indicate:
momnewbie said:
… I checked the Spybot update logs which show that the updated info was downloaded at 15.20 from security.kolla.de and my firewall log shows that the outbound connection was attempted at 15.24. ...
Click to expand...
I attempted to indicate the update process starts with a download of a control file from either security.kolla.de or www.safer-networking.org (please see Note #1). The download from these sites is not the updates themselves, it is the control file (spybotsd.ini) that is used by SpybotSD.exe to determine if any updates are required. It is only after the spybotsd.ini file has been received and processed by SpybotSD.exe that any possible updates are presented (displayed) to you for selection and download.
security.kolla.de is:
  • Host Name: security.kolla.de
    IP Address: 212.227.80.166
    Location: Germany
Therefore any timestamps in the Spybot Update downloads.log (Spybot > Update > click on Show Log) concerning security.kolla.de are irrelevant because they proceeded your attempt to download the actual updates.

If you allowed the firewall notification there should be additional entries in Spybot’s "Update downloads.log" that show entries concerning www.see-cure.de after the 15.24.

Note #1: Since you indicate that security.kolla.de is being contacted I must assume that you are using a back level version of Spybot S&D. I strongly suggest that upgrade to Spybot S&D 1.4 unless you are running on a Windows 95 system.
 
Last edited:
It finally dawns . . .

Thanks MD; now I understand! Perhaps this has happened before and I haven't noticed, or maybe I just haven't run the program since the last update, hence the change. OK, I can cross that worry from my list.
I've obviously missed a notification that a newer version is available so I'll download v 1.4 and put it on to my machine.
Thanks for your help.
Momnewbie
 
You must log in or register to reply here.
Back
Top