Results 1 to 10 of 10

Thread: sqlite3.dll and the Programs folder?

  1. #1
    Junior Member
    Join Date
    Nov 2005
    Posts
    10

    Default sqlite3.dll and the Programs folder?

    Today's update, 12/26/2007, flags odd items...

    system32\sqlite3.dll on one machine: XP MCE 2005 - IE7/Opera 9.25 - Spybot 1.5.1.15



    The Start Menu\Programs folder on a different machine: XP Home - IE7/Opera 9.25 - Spybot 1.5.1.15



    False Positives?
    Last edited by dadkins; 2007-12-26 at 17:32.

  2. #2
    Member of Team Spybot tashi's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    30,956

    Default

    Hello.

    I made a note for the team, thanks.
    Microsoft MVP Reconnect 2018-
    Windows Insider MVP 2016-2018
    Microsoft Consumer Security MVP 2006-2016

  3. #3
    Junior Member rassilon's Avatar
    Join Date
    Dec 2007
    Posts
    3

    Default

    My PC reports the same trace. SQLITE3.DLL is a valid file, installed as part of the Python programming language used in many applications.

    I suspect this is a bug, as the file appears to match the original found on my Poser 6 installation disc.

  4. #4
    Junior Member
    Join Date
    Nov 2005
    Posts
    10

    Default

    Thanks Guys!

  5. #5
    Senior Member Yodama's Avatar
    Join Date
    Oct 2005
    Location
    Buchenheim
    Posts
    1,110

    Default

    thank you for reporting this.
    both item will be treated as false positves and removed from detection with the next update scheduled for next wednesday.
    born in the shadow to die in the shadow, that is the fate of the shinobi

    Spybot S&D Downloads

    Please help us improve Spybot and download our distributed testing client.

  6. #6
    Junior Member
    Join Date
    Nov 2005
    Posts
    10

    Default

    Thanks Yodama!

  7. #7
    Junior Member
    Join Date
    Jan 2008
    Location
    San Francisco
    Posts
    5

    Post Multiple runonce entries from sqlite3.dll removal

    Had not read about sqlite3.dll false positive. If I had I would probably not have accepted removal on Win2K SP2 system last night. Unfortunately I did accept and then shut down. When I attempted to boot this morning (Wed), got past splash screen first time then got background but never got to desktop. After several hours of fairly constant disk activity and seeing no desktop icons or taskbar, I rebooted in safe mode, disabled all startup entries using msconfig, rebooted and got desktop this time but still had unexplained disk activity and bizarre behavior with task bar moving from bot to top of screen and numerous instances of SDDelFile.exe failed to execute notifications and dialog boxes to accept. After OKing maybe 15 I was able to gain enough control thru CAD to shutdown and rebooted in safe mode again. Upon closer inspection I discovered hundreds of runonce entries in the registry to delete sqlite3.dll - 64 in HKEY_LOCAL_MACHINE and 597 in HKEY_CURRENT_USER hive. Details follow: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
    had 64 entries of form
    SpybotDeletingE3664 "C:\Program Files\Spybot - Search & Destroy\SDDelFile.exe" "C:\WINNT\system32\sqlite3.dll_old"
    The SpybotDeletingE... numbers vary of course.
    AND in addition in
    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Runonce]
    I found 597 entries of same form except with SpybotDeletingF... preceding each entry number.

    Apparently one of these succeeded because there was no sqlite3.dll or sqlite3.dll_old to be found in \WINNT\System32.

    This was the third time I had run Spybot on this system. Altogether I have run it only two other times on a WinXP system. So I am not what you would call an experienced Spybot user. I certainly never expected to encounter this kind of disaster. Any suggestions about what to do would be appreciated. I could just delete all the RunOnce entries in both hives but without having a theory about how they got there, why they multiplied and whether they would return even if deleted I am in a quandry. I sent a brief description of early symptoms to support using the web mailer with the same email address.

    Can anyone help me out here?

    Thanks

  8. #8
    Junior Member
    Join Date
    Jan 2008
    Location
    San Francisco
    Posts
    5

    Post Multiple runonce entries from sqlite3.dll removal

    Additional Info:

    The version of 1.5 I had installed was from Spybotsd15he-beta2.exe which TEAM Spybot provided to me on Ticket 183282213 to replace the released version which suffered from very slow and long startup time problems the first time I attempted to use it on the same Win2K SP2 system referred to in prior post.

    In addition, Team Spybot has now responded to the first of two earlier preliminary webmail reports with Ticket 702980843 recommending deletion of HKEY_CLASSES_ROOT*shellsddelfile and referring to forums.spybot.info/showthread.php?t=20388

    A subsequent web mail added more information and my post above contains the latest info. Have responded to Ticket 702980843 with reference to subsequent webmail and this thread asking whether the proposed solution still applies and asking what else should be done to eliminate reported large number of RunOnce entries which system will attempt to run when I reboot not in safe mode.

    Thos

  9. #9
    Junior Member rassilon's Avatar
    Join Date
    Dec 2007
    Posts
    3

    Default

    Spybot 1.5.1.15 still reports a false positive for c:\windows\system32\sqlite3.dll

    Fortunately, I saw this thread before I quarantined the file.
    Last edited by rassilon; 2008-01-23 at 19:38.

  10. #10
    Junior Member rassilon's Avatar
    Join Date
    Dec 2007
    Posts
    3

    Default

    Please disregard the above. After updating definitions the false positive went away. It's my fault. I've been spoiled by automatic updates and didn't notice that Spybot doesn't have one. All is well.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •