dslreports logo
 
    All Forums Hot Topics Gallery
spc
Search similar:


uniqs
643
spooler0
Premium Member
join:2004-11-17

spooler0

Premium Member

MSFT Anti-spyware vs. Spybot re: 139mm.com

Click for full size
Click for full size
Here's a strange problem:

I've got two almost identical computers with Win XP SP-2 and the same basic software on each. One is a little older, kept clean, and used mostly for backup - not day to day web surfing.

MSFT AS, Spybot, Ad-Aware, Spyware Blaster, Spyware Guard, A-2, McAfee, ZA, etc. are on both machines and kept current.

Just now updated all of the above and ran new scans. All was fine on the computer used for day to day web surfing, but on the second machine, a glitch occurred when running Spybot after trying to immunize the machine to add the newer blocked entries from the Spybot update.

The warning MSFT Anti-spyware pops up is shown in the captures attached. It says something (presumably Spybot) was trying to add 139mm.com to the IE trusted zones. I allowed it to block the entry and found this earlier thread on the item.

»hjt log: weird problem

Has anyone else experienced this and what is the recommended course of action?

Should the blocked item be unblocked in MSFT Anti-Spyware?

Why would Spybot be adding that item to the trusted zone rather than to the list of restricted sites in IE?

And if it is not attempting to do so, why would MSFT AS be showing the blocking alert?

Finally, why would this happen on one comp but not the sister machine when both were updated at the same time?

Here are a few google links on 139mm.com:

»securityresponse.symante ··· ner.html

»forums.net-integration.n ··· ic=26731

»www.techsupportforum.com ··· st168378
latefersuppe
join:2002-11-12
Orlando, FL

1 recommendation

latefersuppe

Member

It's a bug in MSAS - the entry that Spybot is adding to the hosts file is actually a blocker,
"127.0.0.1 www.139mm.com"
which will send any requests (in or out) back to localhost, i.e - the bitbucket:)

WFO
Premium Member
join:2001-08-27
San Ramon, CA

1 recommendation

WFO to spooler0

Premium Member

to spooler0
The same thing happened to me only I'm using Giant. This is the 2nd time it confused items being added to the blocked list as being added to the trusted zone.

If you allow it through MS and check your trusted zone afterwards, you will find it isn't there.:)

anonamous
@optusnet.com

anonamous to spooler0

Anon

to spooler0
It happened to me. MSAS said 139mm.com was trying to be added to the safe list. At 1st i didn't know why MSAS said this. I found out just after it happened that the W32.funner worm adds the same site to the hosts file so i was a bit worried.

When i immunised spybot after i updated it happened but i didnt know until i went to immunise like the next day and it said 1 additional protection possible.