Spy Bot Changed itself

[AmericanPoet]

Hello,
I'm a first time member, but I have been using SpyBot S&D for some time love it, I have a problem, I just did a fresh windows install, I formated my harddrive and put WinXP Pro on, the very first thing I installed was S&D which I downloaded the install directly from your official web site. On the launch of the program a box popped up that says
"The application has changed since it was created. Since SpyBot does not change itself, we recomend you check your system for malware and viruses instantly!"
:scratch:
I don't see how i could have any malware or viruses since i just installed winxp on my pc!!! HELP!!!!! I had this problem before, I thought that redoing windows would fix it. I GUESS NOT. :eek:

[JeanInMontana]

Hey samething has been happening to me for a while now. I know I'm not infected but get that popup every time I open the program. Let's hope someone gives us a clue.:bigthumb:

[spybotsandra]

Hello,

This is a little bug in the current version.
We have already been able to locate and fix it.
The fix will be downloadable with our next program upgrade.
We hope that it will be available soon.
If you do not want to wait please try this link:
http://www.safer-networking.org/files/temp/sbsd141pefix.zip
This is a beta version of Spybot-S&D where this bug should be fixed.
This zip file contains the exe file. Just copy it to your Spybot-S&D folder over the old spybot file.

Best regards
Sandra
Team Spybot

[tetonbob]

I have a user at my home forum with this same issue.....

Thanks, Sandra! :bigthumb:

[AmericanPoet]

thank you very much for the reply, I will try the fix and let you know if it works:bigthumb:

[Jamespb]

Hello Sandra fromTeam Spybot
your Beta EXE worked perfectly
Thanks

[spybotsandra]

Hello,

Thanks. Glad to hear. :)

Best regards
Sandra
Team Spybot

[spirit_in_exile]

lemme just say, hi all, new to the forums, but not to spybot...

i encountered this prob shortly after upgrading the RAM on my machine, and thus the winxp activation as is required by winxp when making significant hardware changes. from what i've read in other posts, hardware changes seem to have triggered this error. but i'm just not sure.

i read in another post/thread(/forum?) regarding this issue that spybot performs a few types of self-checks to identify unauthorized attempts to change the spybot program, presumably a nasty tactic employed by some types of malware. for the purposes of doin a truly "clean" reinstall, (barring a complete windows reinstall), in the hopes of solving this issue, i'd like a list of ALL registry entries concerning spybot that are created during install, particularly ones that are related to this integrity check. that way i can yank `em and make like spybot was truly never there.

i've prowled my registry and deleted all entries related to "spybot," "pepimk," "safer networking," and the like, killed them (cept for the file/folderalyze and regalyze ones), rebooted, and reinstalled, still a no-go, applied beta exe, and STILL a no-go.

i'm running winxp w/sp2, fully patched and updated, clean as a whistle otherwise, verified by source after source. system restore is off. various other tweaks applied, but none that have ever conflicted with spybot before the RAM upgrade.

i look forward to hearing from someone on this.

[md usa spybot fan]

spirit_in_exile:

I suggest that you try the beta program that spybotsandra (http://forums.spybot.info/member.php?u=5) published in post #3 above:
http://www.safer-networking.org/files/temp/sbsd141pefix.zip

… in the hopes of solving this issue, i'd like a list of ALL registry entries concerning spybot that are created during install …
If you want to make sure that all the registry entries that Spybot-S&D added during installation are removed, there is a .reg file available on the safer-networking.org WEB site that can do that. See the following article:
FAQ - Frequently Asked Questions
How to uninstall?
http://www.safer-networking.org/en/faq/27.html
The direct download link is:
this very small fix (http://www.safer-networking.org/files/remove-spybotsd-settings.reg)
Download the file.
Double click on it
Answer Yes then OK


… i'd like a list of ALL registry entries concerning spybot that are created during install, particularly ones that are related to this integrity check.
If there were such a registry entry, publishing it could defeat the purpose and allow manipulation of SpybotSD.exe.

[spirit_in_exile]

I suggest that you try the beta program that spybotsandra (http://forums.spybot.info/member.php?u=5) published in post #3 above:
http://www.safer-networking.org/files/temp/sbsd141pefix.zip


as stated in the title block just above the body of my initial post, the "beta exe didnt do the trick for me"

i shall try the registry entry provided, with a complete uninstall/reboot, then reinstall, and (if need be) the beta exe again, and report back.



If there were such a registry entry, publishing it could defeat the purpose and allow manipulation of SpybotSD.exe.

and while i understand the need for a degree of discretion regarding publishing the specifics of spybot's integrity check scheme, it seems to me that i ought to be able to utterly remove every aspect of any software that i choose to install on my system. the inability to remove such items constitutes either (a) a sloppy uninstaller, or (b) behavior not unlike to the products spybot is here to protect us against, in that many leave little unadvertised traces of themselves for whatever reason.

hopefully, though, this will help. i'll let y'all know.

EDIT: tried uninstall, followed by registry entries removal, then restart, then manual deletion of program files>spybot and docs&settings>all users>app data>spybot folders (curiously left untouched by uninstall). then ran ccleaner temp folder cleanup and registry fixes, then registry mechanic scan and all fixes, then rebooted AGAIN. then fresh-installed spybot, ran it, and BAM! the lovely error. applied beta spybot exe file, cleared prefetch and all temp files, rebooted, re-ran spybot, and BAM! error.

this error is only gonna go away when i can either remove whatever clandestine integrity checking regkey(s) are stashed in my registry, or when a new spybot release handles hardware upgrades better. of course there's always a clean winxp install to consider... but i'd just as soon not.

[bitman]

Though I'm not privy to the specifics of how this check is performed, I highly doubt there is a registry entry involved, since this could be easily discovered and manipulated.

I instead suspect that it's a verification of the SpybotSd.exe file itself using a computed checksum or md5 hash, compared against the same value stored within the file itself. I believe the 'little bug' mentioned by spybotsandra is a problem performing this computation on some systems. This suspicion comes from a similar problem that we've seen in the past with such computations in another Safer-Networking program called FileAlyzer.

I'm not certain what causes this issue only on some systems, but here are the computed values for the Beta 141pefix SpybotSD.exe file version you are testing.

CRC-32: 7CAE297B
MD5: 4B624999B5AE777192DBEC90E88B72D1
SHA1: DA097ED7C8B6D4C12EA4C7132B3570FE1800CC6E

If these aren't changed then it's highly unlikely the file itself has changed. I'm not aware how the internal computation is performed, so I don't know what could cause it to fail, especially only on some systems.

In either case, I don't believe re-installing Spybot itself has ever fixed it, though obviously the new beta version has for some. The other possibility is that you do have something changing the Spybot program and the warning is actually correct, in which case the numbers above ahouldn't match with your's.

Bitman

< Edit > Do your Windows/Microsoft Updates operate properly?

[spirit_in_exile]

i checked the crc thru filealyzer. the hash for my download of the beta exe was off, so i downloaded again. again, the hash came back wrong when checked. so i began hunting for reasons my crc computations might be off. some informative sites led me to the hardware malfunction possibility, which has been known to cause big problems with crc checksums. the two most common seem to be: 1.) bad ide cables, or 2.) bad ram. i disabled the fast-boot bios option to let it run through the board's memory test, and sure enough, the memory failed the test. after a boot-level checkup from a windows memory diagnostic disk, it's official: one or both of the 2x512 of ram i just bought from tigerdirect are crap.

after downgrading back to my trusty kingston 2x256 (glad i didn't sell it!) all is well again with spybot, as i suppose it can now perform it's self-check correctly.

thanks a bunch for directing me to the culprit of this annoyance... i'm off to seek a refund from a very bad kitty...

[bitman]

Thanks to you for returning to report the cause. Now we know that the small number of these we've seen are likely hardware issues, especially when recent changes like RAM have occured.

Could you please post the site(s) where you found the hardware malfunction information relating to crc checksums? It'd be great to be able to reference this thread and your discovery to help others understand the issue in the future.

Thanks,
Bitman

[spirit_in_exile]

While googling around for local causes of crc inconsistencies, the 1st site that I hit that caught my eye was this: http://errorcrc.windowsreinstall.com/ . I found many more forum discussions on the topic, but I think that this one really drove home the issue, probably because of it's ominous name and my growing fear that a "Windows Reinstall" was exactly what was in store for me at the time.

Of course, that wasn't the case. Now I begin the long dance of trying to get my money back on that crappy 2x512 of RAM!