TrojansC.Sbi

[Monsoon]

I have just done a scan during which an error message flashed up that I should look at 'include errors.log' with regard to TrojansC.Sbi which turns out to give a line of text referring I think to 'Zlob' and what looks like an url. I have tried to e-mail off a question to S&D about this but that part of S&D refuses to identify that I have completed the spam prevention box correctly so I cant report the problem in that way. Does this mean that S&D has found but cant cure Zlob or that there is something more fundamental wrong. I have just taken the 13/6/07 update.

[md usa spybot fan]

Download the following update using the integrated update facility:
TCP/IP Settings plugin - !TCP/IP Settings plugin (65 KB) - 2007-06-06

[md usa spybot fan]

Monsoon:

Since this appears to be a relatively new problem and forums such as this are for the sharing of information, your feedback as to whether or not my suggestion worked would be appreciated.

[Cornbread]

I had the same problem though I saw the TCP/IP updated but didn't install it not knowing if I needed to. Updating the TCP/IP setting plug in fixed it and I am no longer receiving the error.

Thanks
C

[slick]

Thanks, md, that worked for me too.

[srxy1]

is there anyway I can download the "!TCP/IP Settings plugin" without having to use the intergrated download?

[md usa spybot fan]

srxy1:

The TCP/IP Settings plugin has not been added to the manual Downloads (http://www.spybot.info/en/download/index.html) Web page yet. In the interim you can:
Download the following file:
http://www.spybotupdates.biz/updates/files/plugtcpip.zip
Unzip (extract) plugtcpip.zip.
Move or copy the TCPIPAddress.dll file to:
C:\Program Files\Spybot - Search & Destroy\Plugins

[pastorwilliambarhorst]

I tried to click it also and got the same error code:
* Download the following file:
http://www.spybotupdates.biz/updates.../plugtcpip.zip
* Unzip (extract) plugtcpip.zip.
* Move or copy the TCPIPAddress.dll file to:
C:\Program Files\Spybot - Search & Destroy\Plugins

This is the error code we get:
Multiple Choices
The document name you requested (/updates.../plugtcpip.zip) could not be found on this server. However, we found documents with names similar to the one you requested.

Available documents:

* /updates/plugtcpip.zip (common basename)
What do I do to fix this on this persons pc? I am fixing the PC Remotely using Windows Live Messenger Remote Assistance

[md usa spybot fan]

pastorwilliambarhorst:

My link seems to work fine for me (but the one your post doesn't).

Are you clicking the link in my post or a copy of the link you made?

[srxy1]

srxy1:

The TCP/IP Settings plugin has not been added to the manual Downloads (http://www.spybot.info/en/download/index.html) Web page yet. In the interim you can:
Download the following file:
http://www.spybotupdates.biz/updates/files/plugtcpip.zip
Unzip (extract) plugtcpip.zip.
Move or copy the TCPIPAddress.dll file to:
C:\Program Files\Spybot - Search & Destroy\Plugins

Thanks a bunch MD....worked perfectly.

[md usa spybot fan]

srxy1:

Thank you for confirming that my temporary workaround actually works.

Hopefully the "TCP/IP Settings plugin" will be added to the Downloads (http://www.spybot.info/en/download/index.html) Web pages soon.

[md usa spybot fan]

The TCP/IP Settings plugin has been added to the Downloads (http://www.spybot.info/en/download/index.html) Web pages as the following item:
TCP/IP Plugin 1.0 - product description - product description
md5: 7FD95B7E814EA2F56AEACE3613B4A0E9

This adds capabilities to find and replace malicious network settings. Only needed if you do not want to use the update function integrated into Spybot-S&D.

[Jay_S]

The TCP/IP Settings plugin has been added to the Downloads (http://www.spybot.info/en/download/index.html) Web pages as the following item:
TCP/IP Plugin 1.0 - product description - product description
md5: 7FD95B7E814EA2F56AEACE3613B4A0E9

This adds capabilities to find and replace malicious network settings. Only needed if you do not want to use the update function integrated into Spybot-S&D.

Still not sure why the two are linked? Why is it necessary to install the TCP/IP Plugin to be able top apply the latest Trojans update file and not have an error? I'm glad that this will fix my error (was getting the same one), but don't understand the dependency. None of the other updates seemed to have a linkage to this one?

Jay S.

[md usa spybot fan]

Jay_S:

From the following pinned (Sticky) thread:
2007-06-06 ßTCP/IP Settings plugin
http://forums.spybot.info/showthread.php?t=14547


hi,

some malware (for instance Zlob.DNSChanger) are able to change the computer's TCP/IP settings. In case of Zlob.DNSChanger bad DNS Servers are entered.
The TCP/IP settings plugin enables Spybot to use new rules which can detect IP addresses entered by malware and exchange them with non harmful entries.

Further plugins will enable Spybot to increase its set of rules and rule parameters without the need for a new main update. Thus the plugins make Spybot more flexible.

[Jay_S]

Jay_S:

From the following pinned (Sticky) thread:
2007-06-06 ßTCP/IP Settings plugin
http://forums.spybot.info/showthread.php?t=14547

Thanks, but I'm still not sure why they're connected. From an earlier post of yours..

"This adds capabilities to find and replace malicious network settings. Only needed if you do not want to use the update function integrated into Spybot-S&D."

If it is only needed if you don't want to use the update function, why does the Trojans update have this error if you do use the update function? Also, shouldn't there be something on the TCP/IP plugin that indicates it is a required update if you want to run through the Trojans update cleanly?

Jay S.

[md usa spybot fan]

Jay_S:


Thanks, but I'm still not sure why they're connected. From an earlier post of yours..

"This adds capabilities to find and replace malicious network settings. Only needed if you do not want to use the update function integrated into Spybot-S&D."

If it is only needed if you don't want to use the update function, why does the Trojans update have this error if you do use the update function?
You need the TCP/IP plugin with the new rule set included in beta updates on 2007-06-06 and regular updates on 2007-06-13 or else you will get an error.


…
The TCP/IP settings plugin enables Spybot to use new rules which can detect IP addresses entered by malware and exchange them with non harmful entries. …
To download and install the TCP/IP plugin you either have to:
Download the following update using the integrated update facility:
TCP/IP Settings plugin - !TCP/IP Settings plugin (65 KB) - 2007-06-06

--- or (if you do not use the integrated update facility) ---


Download and execute the following item from the Downloads (http://www.spybot.info/en/download/index.html) Web page:
TCP/IP Plugin 1.0 - product description - product description
md5: 7FD95B7E814EA2F56AEACE3613B4A0E9

This adds capabilities to find and replace malicious network settings. Only needed if you do not want to use the update function integrated into Spybot-S&D.

Also, shouldn't there be something on the TCP/IP plugin that indicates it is a required update if you want to run through the Trojans update cleanly?
Possibly, but I don't any control over that. I imagine that it is assumed that you download all the updates listed and not pick and choose among them. How do you suggest that be accomplished? Change the update from:
TCP/IP Settings plugin - !TCP/IP Settings plugin (65 KB) - 2007-06-06
To:
TCP/IP Settings plugin - !TCP/IP Settings plugin (65 KB) (Required update if you want to run through the Trojans update cleanly) - 2007-06-06

[Jay_S]

Jay_S:


You need the TCP/IP plugin with the new rule set included in beta updates on 2007-06-06 and regular updates on 2007-06-13 or else you will get an error.


To download and install the TCP/IP plugin you either have to:
Download the following update using the integrated update facility:
TCP/IP Settings plugin - !TCP/IP Settings plugin (65 KB) - 2007-06-06

--- or (if you do not use the integrated update facility) ---


Download and execute the following item from the Downloads (http://www.spybot.info/en/download/index.html) Web page:
TCP/IP Plugin 1.0 - product description - product description
md5: 7FD95B7E814EA2F56AEACE3613B4A0E9

This adds capabilities to find and replace malicious network settings. Only needed if you do not want to use the update function integrated into Spybot-S&D.

Possibly, but I don't any control over that. I imagine that it is assumed that you download all the updates listed and not pick and choose among them. How do you suggest that be accomplished? Change the update from:
TCP/IP Settings plugin - !TCP/IP Settings plugin (65 KB) - 2007-06-06
To:
TCP/IP Settings plugin - !TCP/IP Settings plugin (65 KB) (Required update if you want to run through the Trojans update cleanly) - 2007-06-06

I suppose (to your last point) something like that would be helpful. I'm not the only one that didn't download the TCP/IP update initially. Since they are selectable, this was a situation where one option required another.

Jay S.

[md usa spybot fan]

Also, shouldn't there be something on the TCP/IP plugin that indicates it is a required update if you want to run through the Trojans update cleanly?


How do you suggest that be accomplished? Change the update from:
TCP/IP Settings plugin - !TCP/IP Settings plugin (65 KB) - 2007-06-06
To:
TCP/IP Settings plugin - !TCP/IP Settings plugin (65 KB) (Required update if you want to run through the Trojans update cleanly) - 2007-06-06


I suppose (to your last point) something like that would be helpful.Then suggest it, because I certainly won't.

[bitman]

This is just another situation that points up that there are two major types of users, the type that care what each update file does and those who just want it to work. Unfortunately, both types tend to make bad decisions in cases such as this as has been clearly displayed here.

When this update released, I simply installed it because I knew that Team Spybot didn't release it for no reason and it had some purpose, so I never had this problem. However, when everyone started asking about it, I used FileAlyzer to investigate the TCP/IP Settings plugin and quickly understood what it did, though I thought the name itself made that fairly clear in the first place.

Whether you use a specific portion of the program or not, you should always download all updates, since there are often dependancies and you can always disable any optional components separately anyway. This is important in case you ever choose later to enable one of these other modules such as TeaTimer, since it might be out of date otherwise.

Personally, I believe it's time to admit that most users of Spybot S&D are no longer knowledgeable programmers and simply hide the update 'list' and automatically download them all. Only the language specific optional updates should be listed, by language title only, with all required files updated for each language selected. This is the simplest way to keep everyone from making useless mistakes that simply cause issues for themselves and add to the support burden.

Bitman

[tiger1941]

Download the following update using the integrated update facility:
TCP/IP Settings plugin - !TCP/IP Settings plugin (65 KB) - 2007-06-06

Sorry, but I am old and not tech savvy. I have this same problem, how do I implement the above fix?

Please, if you respond, I will need simple step by step insructions!

Many thanks.

[tiger1941]

Sorry, but I am old and not tech savvy. I have this same problem, how do I implement the above fix?

Please, if you respond, I will need simple step by step insructions!

Many thanks.

Please ignore my previous post!

I seem to have resolved the problem by installing the latest version (1.5.2).

Sorry to have bothered you.

Regards

[Buck Wheat]

Received the TrojanC.sbi warning last evening while running a pre-WWI version of Spybot. Tried downloading the fix specifically aimed at TrojanC.sbi, then ran SB and received the same warning msg. Bottom line: just download the entire 1.5.2 package and the problem goes away. :clown::bighug:

[tiger1941]

Received the TrojanC.sbi warning last evening while running a pre-WWI version of Spybot. Tried downloading the fix specifically aimed at TrojanC.sbi, then ran SB and received the same warning msg. Bottom line: just download the entire 1.5.2 package and the problem goes away. :clown::bighug:

Thanks for your reply!

Yes, updating to the latest version resolves the problem, as I indicated in the post above yours.

Regards

[ME_2&]

Had the same(?) prob yesterday with my 'old' SSD1.5.1.17beta (have been running it for comparison with 1.5.2.20 on my WinME machine .. mostly to dispel any doubts as to compatibility with unsupported OS').

Include errors.log
080409 15:57:35 C:\PROGRAM FILES\SSD15117B\Includes\TrojansC.sbi | Zlob.DNSChanger.rtk | <$FILE_EXE>

.. and after four go`rounds (including a disk revert + 'known-good' dl'd 080409 update) of various 'fixes'-that-didn't, decided to uninstall the beta (it served well, but was about half as fast on the scantimes as v1.5.2.20). A few minor adjustments and I'm looking forward happily (:

Thank you SSD, especially for support of the 'unsupported' - if only others would be so kind (;

[jim_khana]

Please ignore my previous post!

I seem to have resolved the problem by installing the latest version (1.5.2).

Sorry to have bothered you.

Regards

Hello,
First time poster,would like to ask do I remove Spybot 1.4 from my PC before I download latest version(1.5.2) as I also have the trojan problem,

Thanks in anticaption,
Jim

[md usa spybot fan]

jim_khana:


... do I remove Spybot 1.4 from my PC before I download latest version(1.5.2) ...
I personally recommend that you do. See my recommendation for how in post# 10 (http://forums.spybot.info/showpost.php?p=181186&postcount=10) of this thread:
Probem after d/l'ing updates today
http://forums.spybot.info/showthread.php?t=26635

[jim_khana]

jim_khana:


I personally recommend that you do. See my recommendation for how in post# 10 (http://forums.spybot.info/showpost.php?p=181186&postcount=10) of this thread:
Probem after d/l'ing updates today
http://forums.spybot.info/showthread.php?t=26635

Many thanks for your help. I managed to delete Spybot 1.4 version but am unable to download the 1.5 version,something about "bad checksum"which I do not understand so have gone with another Spyware programme which I could understand and found easy to download,

Thanks,Jim.

[Terminator]

Bad Checksum Just means the Download got corrupted or the server was down, either wait a few minutes and try again or try another server/site e.g. filehippo.com.

[bmason]

For the first time today I have been getting this problem with trojanc.sbi file in the errors.log.

I've tried the solutions suggested in the faq and here -- updating and rerunning, then downloading the tcpip plugin and extracting.

Any one can help?

Bob Mason

[cindi28]

Download the following update using the integrated update facility:
TCP/IP Settings plugin - !TCP/IP Settings plugin (65 KB) - 2007-06-06


I am brand new, can you tell me how to do the info you provided above? How to download, what is/where is integrated update facility? thank you

[md usa spybot fan]

cindi28:

I wrote that on 2007-06-14 in response Monsoon's problem and it most likely will not fix the current problem that you are having.

Is the problem you are having?
"There were problems in the include file C:/program files/spybot.search_destroy/includes/trojansC.sbi" See "includes errors.log" for details.
Are you running Spybot 1.4 and did the problem started after the 2008-04-09 updates?

If so, upgrading to Spybot 1.5.2 will solve the problem.

[bloomcounty]

cindi28:
Is the problem you are having?
"There were problems in the include file C:/program files/spybot.search_destroy/includes/trojansC.sbi" See "includes errors.log" for details.
Are you running Spybot 1.4 and did the problem started after the 2008-04-09 updates?

If so, upgrading to Spybot 1.5.2 will solve the problem.

Hope it's okay to post on this thread...

This is the exact problem I just started having today. It did start after the last updates. I am using Spybot 1.4, as I have read of a number of issues in regards to 1.5, so I wanted to stick with 1.4 for as long as it's being updated/supported. I assume this is still the case since I can still download updates, is that correct?

Questions:

1. Is the only way to fix this issue to update to 1.5.2?

2. What exactly is the issue? Is it problematic or harmful to my computer?

3. Will there be an update to 1.4 that will fix the issue if you still want to use 1.4?

4. If it won't be fixed in 1.4, is there any harm in just letting the error happen and still using 1.4 for the time being?

5. If it's absolutely necessary to update to 1.5.2, what is the best way to do this? I notice that when I check for updates, there is this update:

Main Update 1.5.2 !Main Application update, release 3 (284KB)

However, I do see that earlier in this thread, it's said to do it this way:

http://forums.spybot.info/showpost.php?p=181186&postcount=10

...if that's the case, then why is the update available within 1.4 when you check for updates if that's a bad way to do it?

Sorry if some of these questions are repeats -- I just want to make sure I do the right thing and not mess up my computer. :) Thanks so much for the help!

[bundy1]

also receiving this error with version 1.4. If possible i'd like to keep using this version because im happy with it. If any of the devs would respond to whether or not this will be fixed (just some sort of acknowledgment), that would be greatly appreciated.

If not, then i have no choice but to update which im not particularly keen on doing.

cheers

[bloomcounty]

I'd like to add an additional question to my post above:

6. Is there a way to get rid of that last update that isn't compatible with 1.4 and just stick with that (and have it work properly) for now?

And, again, is this error we're getting harmful in any way to our computer or make us vulnerable to anything?

Thanks! Hope to hear from one of the helpful developers soon! :)

[spybotsandra]

Hello,

We have added some new detection routines for our new version 1.5.
The old versions can't handle with this new routines yet.
So please upgrade to the Spybot - Search & Destroy 1.5.2.
This should fix it.
Here is the download link:
http://www.safer-networking.org/en/mirrors/index.html
Please do not forget to update afterwards.

Best regards
Sandra
Team Spybot

[md usa spybot fan]

Bloomcounty:


… Hope to hear from one of the helpful developers soon! :)
I am not a developer and since you apparently what a response "… from one of the helpful developers ...", I am reluctant to answer your questions. However, since you pointed to my recommendation in one of your queries, I will answer that question:


5. If it's absolutely necessary to update to 1.5.2, what is the best way to do this? I notice that when I check for updates, there is this update:

Main Update 1.5.2 !Main Application update, release 3 (284KB)

However, I do see that earlier in this thread, it's said to do it this way:

http://forums.spybot.info/showpost.php?p=181186&postcount=10

...if that's the case, then why is the update available within 1.4 when you check for updates if that's a bad way to do it?
After Spybot 1.4 was released people using Spybot 1.3 complained that they were not aware that a new version existed and requested that Spybot should include the ability to upgrade from within the intergraded update facility. The developers accommodated that request in the upgrade from Spybot 1.4 to Spybot 1.5.

My recommendation is that you uninstall Spybot 1.4 (or even earlier versions of Spybot 1.5 like Spybot 1.5 betas as well as the original Spybot 1.5) prior to the installation of Spybot 1.5.2.20) according to the instruction you referenced. There are several reasons I recommend this:
Spybot 1.5 uses some different registry entries than those used in Spybot 1.4. Without deleting those registry entries they will become orphaned and just be wasteful entries.
Spybot 1.4 and early versions of Spybot 1.5 (before Spybot 1.5.2.20) immunized in more registry hives than Spybot 1.5.2.20 does. Therefore even doing an immunization "Undo" under Spybot 1.5.2.20 will not remove those registry entries so they must be removed before installing the new version.
Because of the way Spybot 1.5.2.20 is identified in the systems Add/Remove Programs facility, installing Spybot 1.5.2.20 without deleting prior versions can cause multiple entries of Spybot in the systems Add/Remove Programs facility. This has not only caused confusion but also has lead some people to inadvertent uninstall their new Spybot 1.5.2.20.
In addition if something goes wrong during the execution of the upgrade program (sbsd152upd.exe) some people have reported having a difficult time recovering from the failure.

Hence my recommendation.

[bloomcounty]

Thank you for the reply. No offense meant by asking for help from a developer. I thought that's what all of you were. Sorry! I guess I just meant spybot experts! :)

I don't wish to update to 1.5.2 at this time. For the time being, I will probably just keep 1.4 on my computer as it is. However, it now contains the update that isn't compatible, giving me the error message (as explained above).

So I was hoping I could still get these questions answered:

1a. Is keeping Spybot 1.4 with this incompatible update harmful to my computer in any way?

1b. Is there any harm in just letting the error happen and still using 1.4 for the time being, as is?

2. Is there a way to "get rid of" the update in question that isn't compatible with 1.4?

3. Re: The little registry clean-up thing to run when uninstalling... Does this change/effect *anything* other than Spybot entries? Will it mess up anything for my AVG Free A/V and Antispyware, ZoneAlarm Free, or SuperAntiSpyware? (I opened the file in notepad to see the "code", and while it looks like most of the things listed are Spybot related, some don't mention Spybot -- so that's why I ask.)

Looking forward to hearing back. Thanks for the help.

[glennhubbster]

I have the same problem, have opened the zip and found two elements.

http://img364.imageshack.us/img364/2553/noname1xr1.th.png (http://img364.imageshack.us/my.php?image=noname1xr1.png)

Can I can select them as they are, copy them and paste them somewhere else?

And where do I paste the first one?

Thanks.

Edit: No. I can't have this problem because I see that it's from 2007!
Will scan again and record the error exactly.
I've also noticed that I've posted this in the wrong thread.
Please remove (don't know how to!). Sorry!