View Full Version : SpyBot S&D seems to have damaged my XP Pro PC (Windows Search, power saving)
farmerbb
2013-10-29, 13:16
Ever since I upgraded to and ran 1.6.2 my power settings have stopped working - both screens stay live when I have been away for hours, and the Windows Search function no longer works. I get a popup box titled Search Companion, with the message Unexpected Error, Action could not be completed. Now I will have to reset my power saving, and hunt for some place where I can re-install a working version of Windows Search. Ask me if I am pleased. I use Windows Search a LOT. Anyone else seen these ?
No,I haven't noticed anybody else having those problems.
Could you please open Spybot,click Mode up top,select Advanced mode,(if a warning window comes up,please select "Yes"),then click Tools,View Reports,then click View Previous Reports.
The Spybot logfiles are dated(Checks.yymmdd-hhmm or Fixes.yymmdd-hhmm).Please select the Spybot Fixes logfile with the a date from around the time your problems first began and doubleclick it.It should open in the Spybot window.Rightclick somewhere in that window,and select "Select All".Then rightclick again,select Copy,then Paste the logfile here in a reply.
farmerbb
2013-10-29, 18:25
No,I haven't noticed anybody else having those problems.
Could you please open Spybot,click Mode up top,select Advanced mode,(if a warning window comes up,please select "Yes"),then click Tools,View Reports,then click View Previous Reports.
The Spybot logfiles are dated(Checks.yymmdd-hhmm or Fixes.yymmdd-hhmm).Please select the Spybot Fixes logfile with the a date from around the time your problems first began and doubleclick it.It should open in the Spybot window.Rightclick somewhere in that window,and select "Select All".Then rightclick again,select Copy,then Paste the logfile here in a reply.
OK, here is my best guess, as I had not run SpyBot S&D for a long time, and this is the oldest report file there is. I changed my name to "my name".
--- Report generated: 2013-10-26 05:12 ---
Microsoft.Windows.AppFirewallBypass: Settings (Registry value, fixed)
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\WINDOWS\system32\usmt\migwiz.exe
Microsoft.Windows.AppFirewallBypass: Settings (Registry value, fixed)
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\WINDOWS\system32\usmt\migwiz.exe
Search-Explorer: Interface (IPugiObj) (Registry key, fixed)
HKEY_LOCAL_MACHINE\Software\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
DoubleClick: Tracking cookie (Internet Explorer: my name) (Cookie, fixed)
--- Spybot - Search & Destroy version: 1.4 (build: 20050523) ---
2005-05-31 blindman.exe (1.0.0.1)
2005-05-31 SpybotSD.exe (1.4.0.3)
2005-05-31 TeaTimer.exe (1.4.0.2)
2006-04-04 unins000.exe (51.41.0.0)
2005-05-31 Update.exe (1.4.0.0)
2007-05-23 advcheck.dll (1.5.3.0)
2005-05-31 aports.dll (2.1.0.0)
2005-05-31 borlndmm.dll (7.0.4.453)
2005-05-31 delphimm.dll (7.0.4.453)
2005-05-31 SDHelper.dll (1.4.0.0)
2007-07-31 Tools.dll (2.1.2.0)
2005-05-31 UnzDll.dll (1.73.1.1)
2005-05-31 ZipDll.dll (1.73.2.0)
2009-01-13 Includes\Adware.sbi (*)
2009-01-20 Includes\AdwareC.sbi (*)
2009-01-15 Includes\Cookies.sbi (*)
2009-01-06 Includes\Dialer.sbi (*)
2009-01-13 Includes\DialerC.sbi (*)
2009-01-13 Includes\HeavyDuty.sbi (*)
2008-11-18 Includes\Hijackers.sbi (*)
2009-01-13 Includes\HijackersC.sbi (*)
2008-12-09 Includes\Keyloggers.sbi (*)
2009-01-20 Includes\KeyloggersC.sbi (*)
2008-11-18 Includes\Malware.sbi (*)
2009-01-21 Includes\MalwareC.sbi (*)
2003-03-16 Includes\plugin-ignore.ini
2008-12-16 Includes\PUPS.sbi (*)
2009-01-20 Includes\PUPSC.sbi (*)
2009-01-13 Includes\Revision.sbi (*)
2009-01-13 Includes\Security.sbi (*)
2009-01-20 Includes\SecurityC.sbi (*)
2008-06-03 Includes\Spybots.sbi (*)
2008-06-03 Includes\SpybotsC.sbi (*)
2009-01-20 Includes\Spyware.sbi (*)
2009-01-13 Includes\SpywareC.sbi (*)
2003-03-16 Includes\Temporary.sbi (*)
2008-06-03 Includes\Tracks.uti
2009-01-21 Includes\Trojans.sbi (*)
2009-01-21 Includes\TrojansC.sbi (*)
2007-06-06 Plugins\TCPIPAddress.dll
Thanks for posting your logfile. :)
This logfile is for Spybot 1.4.I see your report generated date is from October of this year:
--- Report generated: 2013-10-26 05:12 ---
I no longer have the old version of Spybot to check,but I believe that the "Report Generated" date is from when you did the actual scan.Is that correct,is this a logfile from a couple of days ago?
farmerbb
2013-10-30, 10:25
Thanks for posting your logfile. :)
This logfile is for Spybot 1.4.I see your report generated date is from October of this year:
I no longer have the old version of Spybot to check,but I believe that the "Report Generated" date is from when you did the actual scan.Is that correct,is this a logfile from a couple of days ago?
I am curious that you say this is an old version of SPyBot. I had not run SPyBot on this drive, until I got the latest version. How can I have a really old version then ? From a previous owner of the drive ? Wouldn't such a version (if it existed) be over-written by an update ? The logfileI submitted was the oldest that appears in the list. Anyway, my Windows Search is still corrupted, even after a hard re-boot. I found a Windows web site
http://support.microsoft.com/mats/windows_search
which seems to say it can fix Windows Search, but I ran it, and it has not helped. This is really annoying. I use Search a lot.
Your windows search is the reason I had you post a logfile.I read online that the 'Unexpected Error, Action could not be completed' error you received sometimes happens when a related registry key is deleted accidentally.Spybot would not ordinarily delete that registry key,but it is possible if a false positive happened in a spybot scan.If that had happened,then it should have been easy to put the registry key back through recovery. :)
However,having said the above,just to be sure,if you noticed this item in your Spybot 1.4 scan:
Search-Explorer: Interface (IPugiObj) (Registry key, fixed)
HKEY_LOCAL_MACHINE\Software\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
That should not be related to your Windows XP search.I found it listed online as being related to AVG safe search,so recovering it will not help your Windows XP search problem.I wanted to let you know that to avoid confusion.
Spybot logfiles are kept in the All Users folder in Windows XP,so if there is another user on your computer,it's possible the logfile was from when they ran a scan with Spybot 1.4.
Too bad the fix-it from Microsoft wouldn't have worked,that would have been great. :)
I saw online that people with your same error tried reinstalling windows xp search,but it didn't seem to help.I did find a Microsoft article online that was helpful,but it involves registry editing,which may be difficult,depending on whether you're experienced with registry editing or not.
But in the meantime,instead of going with that,if you wouldn't mind,it would be better to check for the false positive,because if it's there,it's the easiest solution.
Could you post a newer Fixes.yymmdd-hhmm logfile?If you know the date your Windows XP search error started happening,and you ran a Spybot scan on that date,please post that one,or if you're unsure of when it started happening,just post a Fixes logfile from roughly when the error statrted happening.
farmerbb
2013-10-30, 16:47
Your windows search is the reason I had you post a logfile.I read online that the 'Unexpected Error, Action could not be completed' error you received sometimes happens when a related registry key is deleted accidentally.Spybot would not ordinarily delete that registry key,but it is possible if a false positive happened in a spybot scan.If that had happened,then it should have been easy to put the registry key back through recovery. :)
However,having said the above,just to be sure,if you noticed this item in your Spybot 1.4 scan:
That should not be related to your Windows XP search.I found it listed online as being related to AVG safe search,so recovering it will not help your Windows XP search problem.I wanted to let you know that to avoid confusion.
Spybot logfiles are kept in the All Users folder in Windows XP,so if there is another user on your computer,it's possible the logfile was from when they ran a scan with Spybot 1.4.
Too bad the fix-it from Microsoft wouldn't have worked,that would have been great. :)
I saw online that people with your same error tried reinstalling windows xp search,but it didn't seem to help.I did find a Microsoft article online that was helpful,but it involves registry editing,which may be difficult,depending on whether you're experienced with registry editing or not.
But in the meantime,instead of going with that,if you wouldn't mind,it would be better to check for the false positive,because if it's there,it's the easiest solution.
Could you post a newer Fixes.yymmdd-hhmm logfile?If you know the date your Windows XP search error started happening,and you ran a Spybot scan on that date,please post that one,or if you're unsure of when it started happening,just post a Fixes logfile from roughly when the error statrted happening.
Wow. A lot of stuff to respond to. The drive is in a used PC I bought to replace my original one, whose drive was damaged beyond repair when I turned it over to a remote "speed up" group. Despite all their attempts, it eventually would not even boot in safe mode. The "new" PC has XP Pro, SP3. You mention AVG - I have the paid version and run it daily, as I post files on the web, and want to help ensure I have no malware in my files.
I would take a chance with editing the registry, if I really knew what I was doing. I have opened one before, not sure if I changed anything.
Some extra points - first, I truly appreciate your trying to help. Much appreciated. Second, why does it take so many double clicks to get SpyBot to open ? First time gets an hourglass, and only the second time does it start up. Here is another Fixes file. not sure if it is different from what I attached earlier....
--- Report generated: 2013-10-26 17:36 ---
Delta.Toolbar: Settings (Registry value, fixed)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs
Win32.PowerSpy.af: Class ID (Registry key, fixed)
HKEY_CLASSES_ROOT\CLSID\{586A6352-87C8-11D1-8BE3-0000F8754DA1}
Fake.MS.BHO: Configuration file (INI Delete, fixed)
Fake.MS.BHO: Configuration file (INI Delete, fixed)
Fake.MS.BHO: Configuration file (INI Delete, fixed)
Fake.MS.BHO: Configuration file (INI Delete, fixed)
Fake.MS.BHO: Configuration file (INI Delete, fixed)
Win32.Navi.c: Autorun settings (INI Delete, fixed)
Fraud.WinUpd.prc: User settings (Registry change, fixed)
HKEY_USERS\S-1-5-21-583907252-1383384898-1177238915-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden!=W=0
Win32.AnCamera: Settings (Registry key, fixed)
HKEY_CLASSES_ROOT\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\
Win32.Undef: Settings (Registry change, fixed)
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall!=W=1
Win32.Undef: Settings (Registry change, fixed)
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall!=W=1
Fraud.XPDefender2013: Settings (Registry change, fixed)
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command\
Fraud.XPDefender2013: Settings (Registry change, fixed)
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\safemode\command\
Fraud.XPDefender2013: Settings (Registry change, fixed)
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command\
Win32.Toolbar.DosPop: Settings (Registry value, fixing failed)
HKEY_USERS\.DEFAULT\Control Panel\Desktop\SCRNSAVE.EXE
Win32.Toolbar.DosPop: Settings (Registry value, fixed)
HKEY_USERS\S-1-5-19\Control Panel\Desktop\SCRNSAVE.EXE
Win32.Toolbar.DosPop: Settings (Registry value, fixed)
HKEY_USERS\S-1-5-20\Control Panel\Desktop\SCRNSAVE.EXE
Win32.Toolbar.DosPop: Settings (Registry value, fixed)
HKEY_USERS\S-1-5-21-583907252-1383384898-1177238915-1004\Control Panel\Desktop\SCRNSAVE.EXE
Win32.Toolbar.DosPop: Settings (Registry value, fixed)
HKEY_USERS\S-1-5-18\Control Panel\Desktop\SCRNSAVE.EXE
--- Spybot - Search & Destroy version: 1.4 (build: 20050523) ---
2005-05-31 blindman.exe (1.0.0.1)
2005-05-31 SpybotSD.exe (1.4.0.3)
2005-05-31 TeaTimer.exe (1.4.0.2)
2006-04-04 unins000.exe (51.41.0.0)
2005-05-31 Update.exe (1.4.0.0)
2007-05-23 advcheck.dll (1.5.3.0)
2005-05-31 aports.dll (2.1.0.0)
2005-05-31 borlndmm.dll (7.0.4.453)
2005-05-31 delphimm.dll (7.0.4.453)
2005-05-31 SDHelper.dll (1.4.0.0)
2007-07-31 Tools.dll (2.1.2.0)
2005-05-31 UnzDll.dll (1.73.1.1)
2005-05-31 ZipDll.dll (1.73.2.0)
2013-04-11 Includes\Adware.sbi (*)
2013-10-22 Includes\AdwareC.sbi (*)
2010-08-13 Includes\Cookies.sbi (*)
2012-11-14 Includes\Dialer.sbi (*)
2013-04-11 Includes\DialerC.sbi (*)
2013-04-11 Includes\HeavyDuty.sbi (*)
2012-11-14 Includes\Hijackers.sbi (*)
2013-04-11 Includes\HijackersC.sbi (*)
2013-10-16 Includes\iPhone.sbi (*)
2013-06-25 Includes\Keyloggers.sbi (*)
2013-04-11 Includes\KeyloggersC.sbi (*)
2013-05-29 Includes\Malware.sbi (*)
2013-10-22 Includes\MalwareC.sbi (*)
2003-03-16 Includes\plugin-ignore.ini
2012-11-14 Includes\PUPS.sbi (*)
2013-10-22 Includes\PUPSC.sbi (*)
2010-01-25 Includes\Revision.sbi (*)
2012-11-14 Includes\Security.sbi (*)
2013-04-11 Includes\SecurityC.sbi (*)
2008-06-03 Includes\Spybots.sbi (*)
2008-06-03 Includes\SpybotsC.sbi (*)
2013-05-22 Includes\Spyware.sbi (*)
2013-08-06 Includes\SpywareC.sbi (*)
2003-03-16 Includes\Temporary.sbi (*)
2012-11-19 Includes\Tracks.uti
2013-01-16 Includes\Trojans.sbi (*)
2013-08-13 Includes\TrojansC-02.sbi (*)
2013-10-07 Includes\TrojansC-03.sbi (*)
2013-10-22 Includes\TrojansC-04.sbi (*)
2009-01-21 Includes\TrojansC.sbi (*)
2007-06-06 Plugins\TCPIPAddress.dll
In case it is of any help/value, I should mention I still have the problem I ended up talking to the remote help people about. My Internet access stops suddenly, sometimes several times a day, yet the packets sent/received are still chugging away, even if I close FF and TBird. When that happens......sorry, I don't need to bother you with a unrelated problem.
You're very welcome. :)
Yes,your fixes logfile is different from the one you posted earlier.It is for the Spybot 1.4 version still,though.We'll have to look into which version you have now later on,if you don't mind,as if you have version 1.4 it isn't supported anymore.And also try to see why it takes your Spybot a while to open.
But before getting to that,on the good news front I think your logfile may have what I was looking for:
Win32.AnCamera: Settings (Registry key, fixed)
HKEY_CLASSES_ROOT\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\
That's the good news first,onto the bad news:I've hit a bit of a snafu.
The detection I quoted is listed as unwanted.I will link you to some info on this site,and it's listed on other sites as well:
http://forums.spybot.info/showthread.php?68232-Manual-Removal-Guide-for-Win32-AnCamera
Delete the registry key "{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\" at "HKEY_CLASSES_ROOT\CLSID\"
That is the same as the detection I quoted above.
However,on the Microsoft page I mentioned before,the number in curly brackets I listed above is listed as a part of windows search:
http://support.microsoft.com/kb/816665
Type {e17d4fc0-5564-11d1-83f2-00a0c90dc849}, and then press ENTER.
Now in the page I listed above the number in curly brackets is located at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace.
The problem is Spybot located the number in curly brackets at HKEY_CLASSES_ROOT,so I can't tell if you actually had the malware or if it was a mistake.
http://pcsupport.about.com/od/termshm/g/hkey_classes_root.htm
Important: The HKEY_CLASSES_ROOT hive is actually combined data found in both the HKEY_LOCAL_MACHINE hive (HKEY_LOCAL_MACHINE\Software\Classes) and the HKEY_CURRENT_USER hive (HKEY_CURRENT_USER\Software\Classes). If a registry key resides in both locations, but conflicts in some way, the data found in HKEY_CURRENT_USER\Software\Classes is used in HKEY_CLASSES_ROOT.
So,I can't have you restore that from recovery,since you might be restoring malware.
You'll need to ask about it in the false positives forum to be sure.
Here's a link to the sticky topic for the false positives forum:
http://forums.spybot.info/showthread.php?19117-How-to-report-possible-False-Positives
Most info needed you provided here,so you can post the link to this topic as well.
And this is the false positives forum:
http://forums.spybot.info/forumdisplay.php?16-False-Positives
Please ask about it in there and wait for a reply.Once you get the reply,and they're all done with you,you can return here and we'll continue. :)
I checked on my Windows XP.Deleting the HKEY_CLASSES_ROOT\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849} resulted in a "Unexpected Error, Action could not be completed." message when using search for me,too.Looks like that might possibly be what happened here. :)
MOONSHOT
2013-12-03, 00:08
Ever since I upgraded to and ran 1.6.2 my power settings have stopped working - both screens stay live when I have been away for hours, and the Windows Search function no longer works. I get a popup box titled Search Companion, with the message Unexpected Error, Action could not be completed. Now I will have to reset my power saving, and hunt for some place where I can re-install a working version of Windows Search. Ask me if I am pleased. I use Windows Search a LOT. Anyone else seen these ?
Yes You are Not Alone
I did everything posable to track down why my Search Companion in XP Pro kept geting Damaged giving me the
"Unexpected Error, Action could not be completed."
Messege.
it caused me to reinstall Windows 3 times wile i lost Valuable data doing so :/
I Loved SpyBot & been useing it well over a decade, ..but Now Scared of IT & Will not Use or run it on my 4th Complete Reinstall
and Since my Search is just fine NOW,
I Have no idea what part about SpyBot is causing this
but i am not taking anymore chances & unsure when or if i'll ever feel Safe enough to risk useing SpyBot Agin.
IT'S Varry Sad because as i SAID ..
I Loved SpyBot which has done my many Various System's a lot of good Over the Many Years, THAT IS "Up Untill THIS" ;/,
PLEASE if You or Anyone Else who has anything else to add to this, & or any News from SpyBot of future information found of the resolution of this Problem & or when FIXED??
PLEASE Keep me Posted
feel FREE to post here to HELP Others as well as E-Mailing Me Directly.
Good Luck to all who'v been effected by this Horrable Issue, or Issues,
Signed MOONSHOT,
I forgot about this.
Moonshot,you can ask about this in the false positives forum.
This page gives instructions on how to report a false positive:
http://forums.spybot.info/showthread.php?19117-How-to-report-possible-False-Positives
This is the false positives forum:
http://forums.spybot.info/forumdisplay.php?16-False-Positives
If you don't have the info to follow the instructions where you currently aren't using Spybot,just posting a link to this post would work,too. :)
farmerbb
2013-12-09, 14:01
I am back after a period where I did not have time to look into this. I have to say I am quite annoyed that I am being redirected to a false positive forum. How the $%$#% am I expected to know that my question might be described as a false positive ? I seem to be not alone in having this problem, so why can the fix not be shown here ? I ran SpyBot in good faith, and my PC is now severely crippled due to it trashing a standard Windows function. I use that every day, or used to, when it worked. You tell me the resulkts are from SB 1.4 or so, yet when I start my current version it says clearly 1.6.2. This is getting really annoying. I am nervous about editing my registry, but will have a go, if the specific instructions can be posted here.
I just opened it again, and there is a Recovery button, under which is a Search-Explorer item, with what looks like a registry entry. I would post it here, but SB won't let me copy it. I would have to screen grab it as a jpg or something.
The reason I asked if you'd post this in the false positives forum is because I'm a spybot user,just the same as you are,and from what I can see I suspect this might be a false positive.I can't decide if this is a false positive or not,somebody from Team Spybot has to.So instead of looking at my post as something to be annoyed with,try thinking of it as me telling you that you can post in the false positives forum so that it can be determined if this is a false positive.I didn't intend for it to be interpreted as "you've posted in the wrong place.",I meant it as "hey,post in this place,and it can be looked at and fixed,in whichever way is best."
I just opened it again, and there is a Recovery button, under which is a Search-Explorer item, with what looks like a registry entry. I would post it here, but SB won't let me copy it. I would have to screen grab it as a jpg or something.
I mentioned that prior,and explained this:
The problem is Spybot located the number in curly brackets at HKEY_CLASSES_ROOT,so I can't tell if you actually had the malware or if it was a mistake.
http://pcsupport.about.com/od/termsh...asses_root.htm So,I can't have you restore that from recovery,since you might be restoring malware.
Hence asking you to post in the false positives forum.
You tell me the resulkts are from SB 1.4 or so, yet when I start my current version it says clearly 1.6.2. This is getting really annoying.
Your logfile is showing Spybot 1.4:
--- Spybot - Search & Destroy version: 1.4 (build: 20050523) ---
Perhaps you posted an older logfile.
I was going to run a scan on my XP to see if my search assistant was found and post it as my own false positive,but my XP had a bit of a crash and burn in the meantime,so I never got around to it.Since you are annoyed at posting in the false positives forum,I'll just go post a link to this topic in there.How's that?
farmerbb
2013-12-10, 10:10
I appreciate you are trying to help. But you are a fellow user. What burns me is that while this is the official forum for the company, they do not seem to care that more than one person has this problem. Do they not monitor their own fora ? With the title this one has, I would have expected to have some serious talent applied here. Not a word. I see no responses from a SpyBot employee saying "We are looking into this" or "We are aware of this, and there is a fix that we offer at site xx.yy.zz". I do software support myself, and if my software damaged the PC of a customer, I would be all over this issue, until a fix was found. And Microsoft ? I would think that if they knew some third party software damaged their OS to the point it could not be fixed by MS tools, their lawyers would be calling SpyBot.
Since I am in the middle of switching to another PC with more power, I won't bother following up your suggestions, thanks anyway. I don't have the time. This disk will be either reformatted or upgraded to Win7 and I will recommend against ever using SpyBot under XP Pro..