Spybot S&D acting weird

[Garrec]

I clicked on my quicklaunch button to open up Firefox, and suddenly I get a warning on my screen from my McAfee firewall. The warning says:

"The application Spybot - Search & Destroy is requesting to act like a server and accept incoming connections."

Because of this highly suspicious notice, I blocked the program's access. Thinking it might have been caused by some kind of automatic update service, I unblocked the program, and checked for updates. There were none. When I normally update the program, my firewall notice says that the program "is requesting outbound access to the Internet"

I don't know why it would try to act as a server. Is this normal behavior? Is this a hacked version?

I saw a news article on MSN about spyware, and I followed the link to S&D's website, where I downloaded it. I downloaded this file, even though it was the same version of what I had before, to try and ensure that it was from a legit site and was safe to use. Does anyone know what's going on?

[hammocksleeper]

I don't know what's going on, but Spybot doesn't need an internet connection to check and delete spyware, which I think you know. Just keep it blocked until someone else offers a better explanation.

[Basan]

Follow this thread link (http://www.warboards.org/showthread.php?t=4133) n' get it from there. It shouldn't present any problems... It didn't 2 me. :)
But I don't have McAfee either. :confused:

[Garrec]

Follow this thread link n' get it from there.
That's actually the site that I got it from. I re-downloaded the file from a different mirror, then did a file comparison with my old install file. Both are exactly the same. Thanks anyway, though.

Even with anti-spyware programs, I only allow them access to the outside world when I'm updating my files, and then I remove their entry from the allowed list afterwards. My firewall doesn't have an "ask every time" option, so by removing a program's entry, it will come up with a notice if the program tries any unauthorized access. This is how I caught this strange behavior.

Since then, I've run a virus scan and a full scan by Lavasoft's Ad-Aware, and both came up blank.

[Neo]

Uninstall Spybot completly -- delete its directory afterwards, everything, then go back to Spybot's homepage and download a new version, then run it, and update it.

There is no reason IT should be asking for server access, but maybe theres another program on your computer under the name "spybot" and is asking for server access O_o;;

-Neo

[Garrec]

Thanks for the advice, Neo. I uninstalled, deleted the directory, deleted all registry entries containing "spybot", and did a file search for any other files named spybot, either hidden or otherwise. I went to the site, and re-downloaded a new installer.

However, when I went to update it, I got a curious warning from my firewall. My McAfee firewall displayed a green alert, unlike the red, critical alert it had given me earlier. It said "The program Spybot - Search & Destroy has been automatically granted access to the Internet" and "Application allowed because McAfee recognizes this application". I have done nothing to report this program as safe to McAfee. Maybe it's a clean version. But I'm not taking any chances. I'll be carefully watching this program for any more unauthorized access.

[Neo]

I guess that mcafee keeps an online db of ok programs or something?

Who knows, usually though firewalls WILL complain if the file has changed, so just keep an eye out.

-Neo