S&D loads only partway, "Access Violation" error, nothing scanned

[gophersnake]

I've been running Spybot S&D for almost five years now, through several versions. I'm still on the same computer but recently had to reinstall Windows to a new hard drive when my old one became erratic. That was when the trouble started.

Here's what consistently happens:

-- I click on the Desktop shortcut to "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe"

-- After a while, maybe 5 or 10 seconds, the usual low, wide "Loading Spybot - Search & Destroy..." window appears and the blue progress "bar" begins growing from left to right.

-- In the past, when SpybotSD was loading normally, it used to take quite a while, maybe 30 seconds, for the progress bar to extend all the way across. Instead, after only a few seconds (and with the bar only 4 squares long), it hesitates for a moment, then a dialog pops up:

-----------------------------------
Error
(X)
Access violation at address 007B6945 in module 'SPYBOTSD.EXE'. Read of address 5976C4C2
[OK]
-----------------------------------

After I click the "OK" button the bar quickly grows by two more blocks, then disappears and the Spybot S&D main window opens -- a much shorter loading time than normal. If I click "Check for problems", the scan is ridiculously brief (a second or so) and the logfile reports that 0 objects were actually scanned.

-- If I go (in Advanced Mode) to Settings | File sets, the white box where I'd expect to see the file sets is utterly empty. If I click on "(?) Help" I get the error message:

------------------------------
Help
Cannot open the file: ::/html/filesets.html
[OK]
------------------------------

There's a similar response to the "(?) Help" on the Settings page except that the file named is "::/html/settings.html". I've never found a file with either name on either my previous system or my current one.

I've tried (several times now) uninstalling, then reinstalling Spybot S&D 1.6.2 -- by starting directly with the 1.6.2 installer (spybotsd162.exe); by starting with 1.6.0 (spybotsd160.exe) and letting it update to 1.6.2; and by running the most recently loaded 1.6.2 installer (setup-spybotsd162.exe). I continue to get the same error, at the same stage of loading, with the same addresses named. At one point, when I'd just installed 1.6.0 but not yet updated to 1.6.2, the error dialog popped up at the same point but the addresses were different: 007802C3 and FFFFFFFF, respectively.

This problem never happened on my original Windows system. It happened a few times right after I moved to the new hard drive but one of the uninstall-reinstalls seemed to clear it up. Then, in the course of trying to install Windows to my newly-added D: drive I apparently changed something on this C: drive. When I "reinstalled" Windows on C:, almost everything else worked (only AVG wanted its license key again) but Spybot S&D hasn't loaded normally since.

I remember that toward the end of that one successful update/download/install maybe a week ago, several things popped up that I've never seen during any of the unsuccessful ones. A "Legal Stuff" window may have among them; in fact, I remember thinking to myself when I saw it, that that download must be working better than my other attempts.

In a post from a little more than a month ago (http://forums.spybot.info/showthread...582#post294582), someone suggests testing for SpybotSD.exe corruption as follows:

Look for a randomly named file with a .scr extension (JLOSSAOBEIIZCOIQOD.scr for example) that is the same size as the SpybotSD.exe file. ... Double click on the randomly named file with a .scr extension and see if Spybot executes.

Mine, C:\Program Files\Spybot - Search & Destroy\CIMVTQI.scr, does execute exactly like SpybotSD.exe, access violation and all.

How do I get the use of Spybot S&D back?

------------------------
Dell Precision 220, Pentium 3, 733 MHz, 265 MB RAM
Windows 98SE
I browse with Firefox 2.0.0.20, hardly ever with IE.

[gophersnake]

When I click "Check for problems" in the crippled version of Spybot S&D that actually comes up, there's a few seconds' delay, then the status bar says:

Running bot-check (29/0: Firefox - Software (default) - Bookmark)

When S&D was working normally this phase used to take a long time, perhaps 10 minutes, with no obvious activity shown onscreen. This time it takes a couple of minutes, then I get the message:

0 problems found (02:38)

The "File Sets" pulldown shows:

 
[x] Select all available checks
[ ] Most active malware
[x] Minimal spyware check
[x] Spyware check only
[x] Usage tracks check only
[x] User defined combination
[ ] Store this combination as user defined

Clicking "View report" gets me another Access Violation error -- in SPYBOTSD.EXE at 007802E0, read of FFFFFFFF.

Clicking "View previous report" gets me the identical error message.

The Checks.090412-1228.log file says:

12.04.2009 12:28:29 - ##### check started #####
12.04.2009 12:28:29 - ### Version: 1.6.2
12.04.2009 12:28:29 - ### Date: 4/12/09 12:28:29 PM
12.04.2009 12:28:29 - ##### checking bots #####
12.04.2009 12:31:06 - ##### check finished #####

The Checks.090412-1231.txt file says:

--- Report generated: 2009-04-12 12:31 ---


--- Spybot - Search & Destroy version: 1.6.2  (build: 20090126) ---

2009-04-11 unins000.exe (51.49.0.0)
2009-01-26 blindman.exe (1.0.0.8)
2009-01-26 SDMain.exe (1.0.0.6)
2008-07-07 SDWinSec.exe (1.0.0.12)
2009-01-26 Update.exe (1.6.0.7)
2009-01-26 SDUpdate.exe (1.6.0.12)
2009-01-26 SpybotSD.exe (1.6.2.46)
2009-01-26 TeaTimer.exe (1.6.4.26)
2009-01-26 SDFiles.exe (1.6.1.7)
2009-01-26 advcheck.dll (1.6.2.15)
2009-01-26 SDHelper.dll (1.6.2.14)
2008-06-14 DelZip179.dll (1.79.11.1)
2007-04-02 aports.dll (2.1.0.0)
2008-06-19 sqlite3.dll
2009-01-16 UninsSrv.dll (1.0.0.0)
2009-01-26 Tools.dll (2.1.6.10)
2009-01-22 Includes\Cookies.sbi
2009-01-22 Includes\Revision.sbi
2009-04-07 Includes\Tracks.uti
2009-03-31 Includes\Dialer.sbi
2009-02-10 Includes\Hijackers.sbi
2009-03-17 Includes\Keyloggers.sbi
2004-11-29 Includes\LSP.sbi
2009-04-07 Includes\Malware.sbi
2009-03-25 Includes\PUPS.sbi
2009-01-13 Includes\Security.sbi
2008-06-03 Includes\Spybots.sbi
2009-04-07 Includes\Spyware.sbi
2009-03-25 Includes\Adware.sbi
2009-04-07 Includes\TrojansC.sbi
2009-04-08 Includes\Trojans.sbi
2008-06-03 Includes\SpybotsC.sbi
2009-03-23 Includes\SecurityC.sbi
2009-03-31 Includes\PUPSC.sbi
2009-04-07 Includes\MalwareC.sbi
2009-03-17 Includes\KeyloggersC.sbi
2009-03-03 Includes\HijackersC.sbi
2009-03-25 Includes\DialerC.sbi
2009-01-22 Includes\HeavyDuty.sbi
2009-03-25 Includes\AdwareC.sbi
2009-04-07 Includes\SpywareC.sbi
2007-12-24 Plugins\TCPIPAddress.dll
2008-03-04 Plugins\Chai.dll
2008-03-05 Plugins\Fennel.dll
2008-02-26 Plugins\Mate.dll

I just verified that all the files named in the Checks.090412-1231.txt file do exist in the respective folders.

By the way, I've been using AVG even longer than I've been using Spybot S&D and the two seem never to have interfered with each other. For some of my attempted downloads and reinstalls I did try turning AVG off but the result was still the same.

[Matt]

Hi gophersnake,

to Safer Networking Forums.

Do you have Sings of Malware?

[gophersnake]

Thanks, Matt!

I haven't noticed any of the symptoms on that list. An AVG scan yesterday turned up nothing. Before moving to this hard drive I'd been scanning weekly with both AVG and Spybot S&S but it had been over a year since Spybot S&D had found so much as a tracking cookie. The number of sites whose cookies I'm blocking via Firefox has stayed at 24 since January 2008.

In recent months it's been taking longer and longer to get Firefox to display the list of blocked cookies. Sometimes when I do this, a notice will come up that a script is running slowly or something. The last time I tried, maybe a week ago, I never did get a look at the actual list.

So I have no clear evidence that I've ever had any significant malware on this computer. On the other hand, it's only been a little over 2 weeks since I started installing Windows and recreating my system on this drive. When anything unusual happens, I still tend to think of system settings, missing files, or installation problems before malware.

I do have Hijack This logs from yesterday and today, if I ever find anyone who wants to look at them.

[gophersnake]

I just tried starting Windows in Safe Mode -- something I hate to do because I have a lot of icons on my desktop, the low-resolution safe-mode display scrambles them, and it takes me half an hour to get them back in place.

In Safe Mode, two things happen differently:

-- Loading of Spybot S&D continues smoothly, without error messages, past the point where it had been stopping.

-- When the progress bar is almost to the far end, only enough white space left for maybe half of another block, the display seems to freeze. When I move the mouse pointer over it, it turns into an hourglass. When I press Ctrl-Alt-Del, the Close Program window says Spybot S&D is "not responding".

The above happened twice in a row before I shut down Windows and went back to normal mode. Do I have to restart Windows in step-by-step mode fifty times, loading one more driver each time, to find out which one is making the difference? (Do I want Spybot S&D that badly?)

[gophersnake]

After having tried pretty much everything else (most of it several times), I thought I'd see what DrWatson could tell me. I'd start it, I thought; Spybot would be sure to crash for me as usual; and if the crash triggered DrWatson, presumably I'd get a log file to study.

So I got DrWatson running in the background and started Spybot. It didn't crash. It loaded all the way, offered to download updates, then (when I started it again afterwards) showed a normal-looking fileset in place and did a normal-looking scan (around 500,000 items) for me.

That was this morning. This evening I tried Spybot again without DrWatson. Crash, same place, same error message with the same addresses, no fileset.

I tried it again with DrWatson. Normal load, normal-looking fileset.

So far my only guess is that DrWatson is loading some driver or other resource that Spybot needs but can't find on its own. Any way to figure out what it could be?

By the way, Matt asked (04-12-09, 01:12 PM) if I had signs of malware. According to today's Spybot (and AVG) scans: no.

[Matt]

Hi gophersnake,

thank you for this update.

Well, on the one hand, I'm happy that you could find a solution, but on the other hand, it's not really satisfying, I know.

I'll ask for help.

[gophersnake]

Last night I tried Googling on [spybot watson] and found a few vague mentions from about a year ago of similar problems with earlier releases of Spybot, with DrWatson as the reported solution:

Spybot Problem - A Workaround, Windows Users Group Network, Feb 24, 2008

Spybot S&D on Windows 98, Plusnet Forum, 30/03/2008

Searching this forum, so far I've found exactly one thread obviously referring to the same phenomenon: To Win98SE Die-Hard Users, If SpyBot 1.5.2 Won't Start, Run Dr. Watson First! started by j80r50m 02-23-08.

So it's apparently not completely unheard of, just not very common.

When I first started my round of uninstall-reinstalls, the uninstaller asked me to submit a message explaining why I was uninstalling -- so I did, adding my e-mail at the bottom. Two days ago I was surprised to receive a reply from a Team Spybot member (suggesting mostly that I lighten the load on my system by closing unneeded programs, deleting cache and cookies, etc.) I've e-mailed her back a description of my accidental solution.

[Stocky]

Trying to load 162 on a 98se PC... I'm not on line with that pc and won't be for a week or so.
I'm using an EXE. version , not iso or zip...

I get through what I remember as normal in the load...
and then at the very end get a box saying it's gathering some information...
which stays open and gathers nothing, .....
Could I be needing definitions... or whatever???

I'm guessing I should use 162 for a 98se.... anything else too out there???

Do I need another download... of something??

Thanks,
Stocky

[gophersnake]

These Spybot problems started as soon as I installed Windows 98SE from scratch (same machine, new hard drive).

While I was discussing my options for the reinstall (or a possible cloning, before the old hard drive had failed completely), the subject of Windows service packs came up. It turned out that after Microsoft had stopped offering new support for 98SE, they'd also withdrawn their official service packs and the only alternative seemed to be this: Unofficial Windows 98 SE Service Pack.

It sounded kind of drastic to me so although I downloaded it early on, I spent another week or so pondering the best way to back up my system before installation, in case I didn't like the result. It was during that week that I was first unable to get Spybot to run right. When I finally installed the Service Pack it acted pretty harmless, though one of the installation logs it left me seemed to be saying that a number of items (not specified, at least in terms I could understand) hadn't actually been installed. When I uninstalled, downloaded and reinstalled Spybot S&D later that week, it turned out to work normally again.

I bought a second new hard drive and tried to install Windows to it while my first one was still the boot drive. The result was a mess where Windows was still booting from the first drive, then coming up on the second drive with none of my drivers or anything else in place. To get out of it, I disabled the second drive and reinstalled Windows to the first. My drivers, apps, and many of my settings survived but apparently not the Service Pack. Next time I tried to run Spybot (and a few other things I'd had working earlier), they didn't run right any more. I got the others fixed (with a certain amount of trouble) and eventually stumbled on the Dr. Watson workaround for Spybot. It took me another week or so to figure out that the Service Pack really had left me with some newer files which the Windows reinstall had later replaced with the original 4/23/99 versions.

A few days ago I reinstalled the Service Pack -- just the main program this time, to avoid some options like the "2000 color scheme" (replaces my custom Desktop settings) and Metapad (overwrites Windows Notepad without saving or even asking) that I'd found I didn't like. Now Spybot S&D comes up normally again without the need for Dr. Watson -- so it seems to have been the Service Pack all along.

I bought this computer used in 2005 and don't know its full history, but I suspect the previous user must have installed one or more Service Packs that I never found out about.