Problems in Spybot S&D Includes-trojanC

[Lancer]

Lancer:

It is difficult to help you. You indicated "Same problem here". Assuming that you are referring to GEEWIZ's post, neither you nor GEEWIZ have indicated what the error message you are getting nor the content of the "Include errors.log" if that is applicable to the error message.

The only thing that I can offer is that using Spybot 1.5.2.20 there have been no new plugins offered for downloading and using the current 2008-05-29 detection rule updates the scan seems to run fine.

Error message = "There were problems in the include file C:\Program Files\Spybot - Search Destroy\Includes\TrojansC.sbi"

My Include errors.log:

C:\Program Files\Spybot - Search & Destroy\Includes\TrojansC.sbi | Delf.Spool.cn | <$SYSDIR>\ntdoss04.sys
C:\Program Files\Spybot - Search & Destroy\Includes\TrojansC.sbi | Delf.Spool.cn | <$SYSDIR>\ntdoss04.sys

Where can I get the May 29, 2008 update? The program says I am up to date with May 28, 2008, which is the same as what is listed at http://spybot.info/en/updatehistory/index.html

[md usa spybot fan]

Lancer:

My mistake. The latest updates were 2008-05-28.

__________

The rule set for the Delf.Spool.cn detection does not appear to use the Anti-rootkit plugins. You can try to eliminate the error by running the scan without scanning for "Delf.Spool.cn":

• Go into Spybot > Mode > Advanced mode > Settings > Ignore products.
• Locate the item that you what to exclude from the scan ("Delf.Spool.cn") and check it.

[Lancer]

Thank you md, I will try it.

[Lancer]

Excluding Delf.Spool.cn stops the error. I'll be watching the "Detection rules for Delf.Spool.cn and/or the file ntdoss04.sys" thread in False Positives for new information. Thank you md.

[hokiewolf]

I am getting the message about TrojansC.sbi or something similar and it tells me to check my Includes errors.log I am using Spybot 1.4 with the latest definitions and don't recall getting these messages when I ran a scan about a month ago(4/26/08 to be precise).

C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Zlob.DNSChanger | (85\.255\.11[0-9]\.[1-2]?[0-9]{1,2}[,]?\s?)+(85\.255\.11[0-9]\.[1-2]?[0-9]{1,2}[,]?\s?)+
C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Zlob.DNSChanger | (85\.255\.11[0-9]\.[1-2]?[0-9]{1,2}[,]?\s?)+(85\.255\.11[0-9]\.[1-2]?[0-9]{1,2}[,]?\s?)+
C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Agent.frl | <$FILE_SYSTEM>
C:\Program Files\Spybot - Search & Destroy\Includes\Trojans.sbi | Win32.Agent.frl | <$FILE_EXE>
C:\Program Files\Spybot - Search & Destroy\Includes\TrojansC.sbi | Delf.Spool.cn | <$SYSDIR>\ntdoss04.sys
C:\Program Files\Spybot - Search & Destroy\Includes\TrojansC.sbi | Zlob.DNSChanger | <$FILE_EXE>
C:\Program Files\Spybot - Search & Destroy\Includes\TrojansC.sbi | Zlob.DNSChanger | <$FILE_EXE>
C:\Program Files\Spybot - Search & Destroy\Includes\TrojansC.sbi | Zlob.DNSChanger.rtk | <$FILE_EXE>

[md usa spybot fan]

hokiewolf:

Upgrading to Spybot 1.5.2 will solve the problem (Mirror selection - The home of Spybot-S&D!).

The current errors with the Trojans.sbi and TrojansC.sbi files that started with the 2008-04-09 updates are caused by new detection rules that are incompatible with versions of Spybot prior to 1.5.2. These new detection rules use the new Anti-Rootkit plugins #1, #2 and #3 that only have been offered as updates to Spybot 1.5.2. If you upgrade to Spybot 1.5.2 you will not only eliminate the error messages but in also will be performing rootkit searches while doing a Spybot "Check for problems".

If there is a reason that you cannot upgrade to Spybot 1.5.2, you can try the Anti-Rootkit plugins #1, #2 and #3 with Spybot 1.4, but they are not officially supported. From post #11 in the following thread:

• Problems in Spybot S&D Includes-trojanC
  http://forums.spybot.info/showthread.php?t=27194

Well, you can download the manual installer for the newest anti-rootkit plugins and install them on 1.4 as well. They do have a compatibility mode when loaded by 1.4, but not with official support

Note: "... but not with official support ".

The downloads for the Anti-Rootkit plugins are on the following Web page:

• Downloads - The home of Spybot-S&D!
  http://www.spybot.info/en/download/index.html

This item:

• Anti rootkit plugins 1.0 - product description
  md5: EE7278BC89D4557CFD7127EACC37EE70
  
  Supported only for version 1.5.2 or above!
  This adds improved capabilities to find rootkits. Only needed if you do not want to use the update function integrated into Spybot-S&D.

Please note: Supported only for version 1.5.2 or above!

The direct download link is:

• http://www.spybotupdates.com/files/spybotsd_plugins.exe

__________

Note: If you continue to run Spybot 1.4, the following error most likely will not be corrected with the plugins:

C:\Program Files\Spybot - Search & Destroy\Includes\TrojansC.sbi | Delf.Spool.cn | <$SYSDIR>\ntdoss04.sys

To prevent that error for the time being you can exclude it from the scan. See this post.