JorgeA

rilef, Thank you very much for the details about .NET, and for the links to MDGx's site. Judging from Microsoft's own notes, none of those remaining four looked to be necessary, but then I come to this forum to learn what's what. I've visited the mdgx.com site several times, and everything looks so tempting, but being there I feel a little like a guppy out in the ocean. Your notes are very helpful. Unless warned off, I think I'll get the MDIE6CU.EXE that you recommend, and the Daylight Savings Time update. Also, I see that the Unofficial SP2 version 3.0 is at the "beta" stage. If I were to download SP2, should I go for the latest stable release, 2.1a? Thanks again! --JorgeA

wsxedcrfv, Thanks! So far it looks like nobody thinks that the .NET download is worth it. I'm not sure how installing it would affect this machine (whether it's resident or called up as needed), but the little notebook came with an astounding 48MB of RAM and I sure don't want to strain it. Just yesterday I received a 64MB memory module to take it to the maximum that the specs claim it'll take, a grand total of 80MB. (There's 16MB built in. The case proudly says that the computer was "Designed for Microsoft Windows 95" !!) DirectX -- I've downloaded two updates from Microsoft related to DirectX, the "DirectX 9.0c End-User Runtime" and the "Security Update for DirectX 9" (KB904706). I'm not real clear on what DirectX is supposed to be or do (something else to look up!), so please let me know if I answered your question. --JorgeA

Hello, I recently performed a clean installation of Windows 98 Second Edition on a new hard disk for an old notebook computer that had come with a powerhouse 1.5GB hard drive. (In case you're wondering -- no, it's not the same PC as the one we've been discussing in the long thread having to do with Spybot Search & Destroy. That one's a Dell tower with Windows 98 Standard Edition.) For this non-expert it was a bit of a technical challenge, as the computer has a slot for EITHER s floppy disk drive OR a CD-ROM drive, and having been purchased on eBay several years ago it only had the floppy drive. After some investigation, I theorized that in principle it should be possible to: 1) copy the CAB files from the original HD to a USB thumb drive; 2) create a bootable (system) floppy diskette; 3) place DOS drivers for USB (drive and controller) on the floppy; 4) replace the hard disk; then 5) reboot with the floppy and copy the CAB files to the new HD off the USB thumb drive; and finally 6) install Win98SE fresh on the new HD. It all worked like a charm! While I admit that that might not sound very impressive to the Windows 98 connoisseurs here, doing this gave me a real sense of accomplishment, as I had never tried anything like it before. I feel like I graduated from some (primitive) level of computing expertise to the next (less primitive) level. Anyway, I've been downloading the available Microsoft critical and other updates to Win98SE, and I would like your advice. There are four remaining non-critical updates: Microsoft .NET Framework version 1.1; Internet Explorer Navigation Sound Update; the Euro Conversion Tool; and the Mapped Drives Shutdown Update. (I don't have a need for the multi-language features updates.) So the question is -- Do you recommend downloading any or all of these four, or can/should I ignore them? I know that there are many neat items available on this forum (or through it) that one could add to enhance Windows 98. I'll ask about those in due time, but for now I'd like to know what you think I should do about these ones from MS in particular. Thanks very much in advance for your advice! --JorgeA

Prozactive, You're right that the current Spybot is loading faster even though the definitions files are bigger. FWIW, I think I read somewhere that they're starting to incorporate some features from the upcoming 2.0 version. Check out my reply to rilef for my experience with earlier versions of Spybot. I know that there's a lot of dissatisfaction with Symantec products, but for better or worse I renewed the "marriage," this time with Norton 360, when I got my Vista machine. It's annoying that the online backup feature miscounts how much stuff I have on their server, and that it keeps trying to sell me more backup space, but otherwise I'm happy with N360. It puts together a whole slew of security and housekeeping functions in one integrated package. Maybe it WAS that other thread that I was thinking of when I gave you the shoutout, but that's O.K. -- I'll look into your suggestion anyway! Thanks again. --JorgeA

rilef, Thanks for the links! After uninstalling Spybot 1.6.2.46 and deleting the directories it leaves behind, I downloaded Spybot 1.4, skipping the immediate update during installation in order to avoid downloading the main program update. (A couple of weeks ago I'd tried the 1.5 generation, and for me it had the exact same problem as the newest version.) It seemed to download the definition files updates without a hitch, but when I started a manual scan, it showed only 185,064 items in its total at the bottom, not the 1.29 million that I'd been seeing with 1.6. And then the scan paused several times to report that, "There were problems in the include file" with various .SBI listings, and then asking me to "See 'Include errors.log' for details." (That wasn't very helpful, just a list of paths with no elaboration.) Looks like I'll be investigating your suggestion of SuperAntiSpyware in addition to the other ones folks have proposed in this thread. --JorgeA

georg, Thanks once more for the additional info and new links! I downloaded the version of Process Explorer that you recommended, and checked out the data it returned. Nothing there looks suspicious -- mostly Microsoft stuff. A couple of items were for my HP scanner. (Come to think of it, and FWIW, several years ago the scanner one day stopped working through the USB connection. I let it sit connected uselessly for quite some time, till last summer I tried reviving it via the parallel port, and now it works again. Everything else that I put in the PC's USB port works fine, so it was the scanner and not the port.) I chickened out on tinkering with the Registry, lest I cause real harm; but I did do a new profile of Spybot under Dependency Walker after eliminating every reference I could find to Symantec in the hard disk directories. This time the ADVCHECK.DLL first-chance exceptions were legion, but once again no second-chance exceptions that I could find. There were a number of errors in red, where with a code 126 DW said that it could not find a certain DLL, but the odd thing was that in every case, just one or two lines previous it had reported loading that same DLL (at a slightly different address). My understanding of this is limited but, from what I can tell in the log, nothing in particular went wrong just as Spybot was crashing. (I saved the log just in case.) "Tenacious" is a nice word, and I guess that I've been so. But I'm about ready now to throw in the towel, reinstall Norton SystemWorks, consign Spybot on that PC to oblivion, and investigate the alternative anti-malware programs that you, Prozactive, and rilef have recommended. The problem has proved to be even more stubborn than me. Still, I count all of this as time well spent, as with your help I sure have learned a lot. --JorgeA

georg, O.K., here's where we stand. As I reported last night, I removed NIS using Add/Remove Programs, then rebooted, then ran another Spybot scan. That didn't solve the original problem, so I used the Norton Removal Tool, then rebooted and ran a new scan. That didn't solve the problem either, so I manually went through all my directories looking for vestiges of Symantec materials, and deleted every one that I found, even the empty folders. Then I rebooted and ran Spybot again to see if that finally took care of the problem. It didn't. Amazing!! ASOEHOOK.DLL is long gone, and yet.... Short of radical measures, I have two more things to try. I'll search the Registry for traces of Norton/Symantec, eliminate them (hopefully in a safe manner), then reboot and run one more scan, using Dependency Walker to log the operation to see what's mucking up the works now. --JorgeA

georg, Thanks very much for another post full of useful information. I'm not sure how I missed the notification, but I'm glad I visited the site tonight! I've removed NIS using Add/Remove Programs. We'll see if that works to obliterate it. Overnight I'm running a Spybot scan to see if it finally completes the process without crashing. If not, then I'll use the Norton Removal Tool and try another SSD scan. The only reason I didn't just go ahead and use the NRT in the first place is that I also have SystemWorks on the PC, and NRT would remove that too. But if I have to I'll do it, and then reinstall NSW. --JorgeA

georg, Thanks very much for the information. I may not be the world's most expert computer user (I rate myself as intermediate and learning), but I do hate it when vendors try to make things "simple" for me by automating more and more functions. That "simply" makes the process less flexible, as far as I'm concerned. We realized this when my wife bought an iPod and we struggled to figure out how to work with iTunes (she only wanted the player for the occasional talk-show download, not to organize thousands of songs). As a result, for myself I bought a Sansa Fuze to which I can just download files individually as if it were a disk, and then play them. (You can put files on an iPod independently of iTunes, but it won't let you play them on the iPod.) I appreciate the Fuze's lack of automation. Anyway, that's a longwinded way of saying that I prefer flexibility even at the cost of extra work, and to judge from your report it looks like in this case Symantec sinned in the opposite direction. Short of disabling ASOEHOOK.DLL (which, you're right, it did not allow me to do), I renamed it in Safe Mode (with a .OLD extension) and rebooted. I do get an error message as NIS is loading, but I tell it to go on. Unfortunately, that didn't help the Spybot issue (same old error). My next step may be to uninstall NIS altogether and see how Spybot behaves then. But I do note your caveat about getting rid completely of Symantec products. We'll find out soon! --JorgeA

athome, That's a great idea! I'll try it. Regarding scanning in Safe Mode, I've tried that and unfortunately it hasn't helped. And I do have Norton 360 and Spybot working together well (apparently!) on my Vista machine. I have a short thread going on over at the Safer Netowrking forum, asking about the latest round of warnings from the Symantec community about running Spybot at the same time as Norton products. But I will definitely try having Spybot scan at startup, and see what happens. Thanks for the tip! --JorgeA

Yes. Unregister it with regsvr32 /u and change its extension to, say, .off... That should be enough, and is easily reversible! dencorso,, Well, when it comes to Norton, apparently nothing is as simple as it sounds. I tried the REGSVR32.EXE utility, and it returned the following message: "asoehook.dll was loaded, but the DllUnregisterServer entry point was not found. "DllUnregisterServer may not be exported, or a corrupt version of asoehook.dll may be in memory. Consider using PView to detect and remove it." Two questions -- 1) What does it mean when it says that the "entry point was not found," and that the unregister server "may not be exported"? 2) What do we do now? "Find Files" didn't come up with anything called PView on my computer. Still plugging away, --JorgeA

Yes. Unregister it with regsvr32 /u and change its extension to, say, .off... That should be enough, and is easily reversible! dencorso, This forum is just great, there are so many knowledgeable people in it who are willing to share their knowledge. Thank you. --JorgeA

georg, Would I be correct in surmising that the answer is that Spybot works on Windows 98 -- but not when Norton Internet Security is on the system? The odd thing is that they seemed to work well together for 4-5 years, and then NOT, all of a sudden. I checked out the Wikipedia entry you cited, and noticed that PC Magazine downgraded its rating for Spybot in the same year (2008) that Spybot stopped working fully for me. Wonder if there is any connection there. Last night I spent time navigating the DW Help files, and came across the same texts you cited regarding first chance exceptions. Unfortunately, the question remains opaque to me since, as I understand the explanations, a "First chance exception" is no big deal until and unless you get a "second chance exception." And that's the thing -- at the end of the Spybot scan, I was getting tons of "firsts," but NO "second chance exceptions." Perhaps you or an observer can throw light on the subject. In view of the ASOEHOOK.DLL issue, as a test I've disabled Norton's antispam and e-mail scanning features (I no longer do e-mail on that PC anyway), and have been running a series of SSD scans to see what happens. For faster results I started with a very limited file set and then have been adding more each time. So far, every time the whole screen has frozen at the end, requiring a cold reboot. (When I was running full scans, it wouldn't freeze the computer, just give the illegal operation message.) If that doesn't do the trick, I may delete that DLL and see what happens. (Is there any other way to disable it, short of uninstalling NIS?) Anyway, I want to thank you for all the time and information that you've put into this over the past couple of weeks. It's been a very educational experience for me, and I appreciate it. Gratefully, --JorgeA

georg, I took a look at the DW log for Spybot. Before I start making changes to the Registry as suggested in your Post #82, maybe we can examine some of DW's output fur further guidance. To give you some background, I loaded DW and then profiled SSD. SSD was set to scan all files except Usage Tracks and the biggest chunks, the Trojans. That scan was finished in about 18 minutes (although I had to step out of the office and returned at about 41 minutes) and yielded a log that Word processes as 272 pages in length. There were a lot of lines in red. (Other programs that I tried, such as Word and CompuServe 4.02, also returned some lines in red but they've never given me any problems). Here are two representative samples: 00:00:02.465: DllMain(0x65340000, DLL_PROCESS_ATTACH, 0x00000001) in "c:\windows\system\OLEAUT32.DLL" called by thread 1. 00:00:02.473: GetProcAddress(0xBFF70000 [c:\windows\system\KERNEL32.DLL], "IsTNT") called from "c:\windows\system\OLEAUT32.DLL" at address 0x653B3A52 and returned NULL by thread 1. Error: The specified module could not be found (126). 00:00:02.503: GetProcAddress(0xBFF70000 [c:\windows\system\KERNEL32.DLL], "IsProcessorFeaturePresent") called from "c:\windows\system\OLEAUT32.DLL" at address 0x653B6C0B and returned 0x83950258 by thread 1. and -- 00:00:03.812: LoadLibraryA("gdi32.dll") called from "c:\windows\system\MSIMG32.DLL" at address 0x0041137F by thread 1. 00:00:03.816: LoadLibraryA("gdi32.dll") returned 0xBFF20000 by thread 1. 00:00:03.823: GetProcAddress(0xBFF20000 [c:\windows\system\GDI32.DLL], "GdiTransparentBlt") called from "c:\windows\system\MSIMG32.DLL" at address 0x0041138F and returned NULL by thread 1. Error: The specified module could not be found (126). 00:00:03.832: GetProcAddress(0xBFF20000 [c:\windows\system\GDI32.DLL], "GdiGradientFill") called from "c:\windows\system\MSIMG32.DLL" at address 0x004113AA and returned NULL by thread 1. Error: The specified module could not be found (126). 00:00:03.841: GetProcAddress(0xBFF20000 [c:\windows\system\GDI32.DLL], "GdiAlphaBlend") called from "c:\windows\system\MSIMG32.DLL" at address 0x004113C5 and returned NULL by thread 1. Error: The specified module could not be found (126). 00:00:03.846: DllMain(0x00410000, DLL_PROCESS_ATTACH, 0x00000000) in "c:\windows\system\MSIMG32.DLL" returned 1 (0x1) by thread 1. 00:00:03.850: LoadLibraryA("msimg32.dll") returned 0x00410000 by thread 1. There are MANY more like that, but nonetheless Spybot seems to run its course just great -- till we reach the following, when we get a large number of "first chance exceptions" involving ADVCHECK.DLL, and then nothing further happens till I close the program at minute 41. In the log, these lines all show up in black: 00:16:55.940: LoadLibraryA("C:\PROGRAM FILES\SPYBOT - SEARCH & DESTROY\Tools.dll") returned 0x029F0000 by thread 7 "SpybotSD_Scan_Thread". 00:16:55.958: GetProcAddress(0x029F0000 [c:\program files\spybot - search & destroy\TOOLS.DLL], "SolveEnvMulti") called from "c:\program files\spybot - search & destroy\SPYBOTSD.EXE" at address 0x007114AB and returned 0x02ADF4EC by thread 7 "SpybotSD_Scan_Thread". 00:16:58.160: LoadLibraryA("C:\PROGRAM FILES\SPYBOT - SEARCH & DESTROY\Tools.dll") called from "c:\program files\spybot - search & destroy\SPYBOTSD.EXE" at address 0x0071149E by thread 7 "SpybotSD_Scan_Thread". 00:16:58.167: LoadLibraryA("C:\PROGRAM FILES\SPYBOT - SEARCH & DESTROY\Tools.dll") returned 0x029F0000 by thread 7 "SpybotSD_Scan_Thread". 00:16:58.179: GetProcAddress(0x029F0000 [c:\program files\spybot - search & destroy\TOOLS.DLL], "SolveEnvMulti") called from "c:\program files\spybot - search & destroy\SPYBOTSD.EXE" at address 0x007114AB and returned 0x02ADF4EC by thread 7 "SpybotSD_Scan_Thread". 00:17:11.521: First chance exception 0x0EEDFADE (Unknown) occurred in "c:\program files\spybot - search & destroy\ADVCHECK.DLL" at address 0x07094EE8 by thread 7 "SpybotSD_Scan_Thread". 00:17:11.538: First chance exception 0x0EEDFADE (Unknown) occurred in "c:\program files\spybot - search & destroy\ADVCHECK.DLL" at address 0x07094F46 by thread 7 "SpybotSD_Scan_Thread". 00:17:11.555: First chance exception 0x0EEDFADE (Unknown) occurred in "c:\program files\spybot - search & destroy\ADVCHECK.DLL" at address 0x07094F46 by thread 7 "SpybotSD_Scan_Thread". 00:17:11.586: First chance exception 0x0EEDFADE (Unknown) occurred in "c:\program files\spybot - search & destroy\ADVCHECK.DLL" at address 0x07094F46 by thread 7 "SpybotSD_Scan_Thread". 00:17:11.621: First chance exception 0x0EEDFADE (Unknown) occurred in "c:\program files\spybot - search & destroy\ADVCHECK.DLL" at address 0x07094F46 by thread 7 "SpybotSD_Scan_Thread". 00:17:11.683: First chance exception 0x0EEDFADE (Unknown) occurred in "c:\program files\spybot - search & destroy\ADVCHECK.DLL" at address 0x07094F46 by thread 7 "SpybotSD_Scan_Thread". 00:17:11.768: First chance exception 0x0EEDFADE (Unknown) occurred in "c:\program files\spybot - search & destroy\ADVCHECK.DLL" at address 0x07094F46 by thread 7 "SpybotSD_Scan_Thread". 00:17:11.804: First chance exception 0x0EEDFADE (Unknown) occurred in "c:\program files\spybot - search & destroy\ADVCHECK.DLL" at address 0x07094F46 by thread 7 "SpybotSD_Scan_Thread". 00:17:11.812: First chance exception 0x0EEDFADE (Unknown) occurred in "c:\program files\spybot - search & destroy\ADVCHECK.DLL" at address 0x07094EE8 by thread 7 "SpybotSD_Scan_Thread". 00:17:11.834: First chance exception 0x0EEDFADE (Unknown) occurred in "c:\program files\spybot - search & destroy\ADVCHECK.DLL" at address 0x07094F46 by thread 7 "SpybotSD_Scan_Thread". 00:17:11.903: First chance exception 0x0EEDFADE (Unknown) occurred in "c:\program files\spybot - search & destroy\ADVCHECK.DLL" at address 0x07094F46 by thread 7 "SpybotSD_Scan_Thread". 00:18:00.274: First chance exception 0x0EEDFADE (Unknown) occurred in "c:\program files\spybot - search & destroy\ADVCHECK.DLL" at address 0x07094F46 by thread 7 "SpybotSD_Scan_Thread". 00:18:00.280: First chance exception 0xC0000005 (Access Violation) occurred in "c:\program files\spybot - search & destroy\ADVCHECK.DLL" at address 0x070A31C2 by thread 7 "SpybotSD_Scan_Thread". 00:18:00.608: First chance exception 0x0EEDFADE (Unknown) occurred in "c:\program files\spybot - search & destroy\ADVCHECK.DLL" at address 0x07094F46 by thread 7 "SpybotSD_Scan_Thread". 00:18:04.027: LoadLibraryA("C:\PROGRAM FILES\SPYBOT - SEARCH & DESTROY\Tools.dll") called from "c:\program files\spybot - search & destroy\SPYBOTSD.EXE" at address 0x0071149E by thread 7 "SpybotSD_Scan_Thread". 00:18:04.034: LoadLibraryA("C:\PROGRAM FILES\SPYBOT - SEARCH & DESTROY\Tools.dll") returned 0x029F0000 by thread 7 "SpybotSD_Scan_Thread". 00:18:04.045: GetProcAddress(0x029F0000 [c:\program files\spybot - search & destroy\TOOLS.DLL], "SolveEnvMulti") called from "c:\program files\spybot - search & destroy\SPYBOTSD.EXE" at address 0x007114AB and returned 0x02ADF4EC by thread 7 "SpybotSD_Scan_Thread". 00:18:16.556: First chance exception 0x0EEDFADE (Unknown) occurred in "c:\program files\spybot - search & destroy\ADVCHECK.DLL" at address 0x07094F46 by thread 7 "SpybotSD_Scan_Thread". 00:18:16.562: First chance exception 0xC0000005 (Access Violation) occurred in "c:\program files\spybot - search & destroy\ADVCHECK.DLL" at address 0x070A336F by thread 7 "SpybotSD_Scan_Thread". 00:18:16.578: First chance exception 0x0EEDFADE (Unknown) occurred in "c:\program files\spybot - search & destroy\ADVCHECK.DLL" at address 0x07094F46 by thread 7 "SpybotSD_Scan_Thread". 00:18:16.584: First chance exception 0xC0000005 (Access Violation) occurred in "c:\program files\spybot - search & destroy\ADVCHECK.DLL" at address 0x070A336F by thread 7 "SpybotSD_Scan_Thread". 00:18:16.637: First chance exception 0x0EEDFADE (Unknown) occurred in "c:\program files\spybot - search & destroy\ADVCHECK.DLL" at address 0x07094F46 by thread 7 "SpybotSD_Scan_Thread". 00:18:16.645: First chance exception 0xC0000005 (Access Violation) occurred in "c:\program files\spybot - search & destroy\ADVCHECK.DLL" at address 0x070A336F by thread 7 "SpybotSD_Scan_Thread". 00:18:16.653: First chance exception 0x0EEDFADE (Unknown) occurred in "c:\program files\spybot - search & destroy\ADVCHECK.DLL" at address 0x07094F46 by thread 7 "SpybotSD_Scan_Thread". 00:18:16.660: First chance exception 0xC0000005 (Access Violation) occurred in "c:\program files\spybot - search & destroy\ADVCHECK.DLL" at address 0x070A336F by thread 7 "SpybotSD_Scan_Thread". 00:18:17.405: First chance exception 0x0EEDFADE (Unknown) occurred in "c:\program files\spybot - search & destroy\ADVCHECK.DLL" at address 0x07094F46 by thread 7 "SpybotSD_Scan_Thread". 00:18:17.431: First chance exception 0x0EEDFADE (Unknown) occurred in "c:\program files\spybot - search & destroy\ADVCHECK.DLL" at address 0x07094F46 by thread 7 "SpybotSD_Scan_Thread". 00:18:17.576: First chance exception 0x0EEDFADE (Unknown) occurred in "c:\program files\spybot - search & destroy\ADVCHECK.DLL" at address 0x07094F46 by thread 7 "SpybotSD_Scan_Thread". 00:18:17.589: First chance exception 0x0EEDFADE (Unknown) occurred in "c:\program files\spybot - search & destroy\ADVCHECK.DLL" at address 0x07094F46 by thread 7 "SpybotSD_Scan_Thread". 00:18:17.611: First chance exception 0x0EEDFADE (Unknown) occurred in "c:\program files\spybot - search & destroy\ADVCHECK.DLL" at address 0x07094F46 by thread 7 "SpybotSD_Scan_Thread". 00:18:17.661: First chance exception 0x0EEDFADE (Unknown) occurred in "c:\program files\spybot - search & destroy\ADVCHECK.DLL" at address 0x07094F46 by thread 7 "SpybotSD_Scan_Thread". 00:18:17.684: First chance exception 0x0EEDFADE (Unknown) occurred in "c:\program files\spybot - search & destroy\ADVCHECK.DLL" at address 0x07094F46 by thread 7 "SpybotSD_Scan_Thread". 00:18:17.716: First chance exception 0x0EEDFADE (Unknown) occurred in "c:\program files\spybot - search & destroy\ADVCHECK.DLL" at address 0x07094F46 by thread 7 "SpybotSD_Scan_Thread". 00:18:17.725: First chance exception 0x0EEDFADE (Unknown) occurred in "c:\program files\spybot - search & destroy\ADVCHECK.DLL" at address 0x07094F46 by thread 7 "SpybotSD_Scan_Thread". 00:18:17.759: First chance exception 0x0EEDFADE (Unknown) occurred in "c:\program files\spybot - search & destroy\ADVCHECK.DLL" at address 0x07094F46 by thread 7 "SpybotSD_Scan_Thread". 00:18:17.797: First chance exception 0x0EEDFADE (Unknown) occurred in "c:\program files\spybot - search & destroy\ADVCHECK.DLL" at address 0x07094F46 by thread 7 "SpybotSD_Scan_Thread". 00:18:17.819: First chance exception 0x0EEDFADE (Unknown) occurred in "c:\program files\spybot - search & destroy\ADVCHECK.DLL" at address 0x07094F46 by thread 7 "SpybotSD_Scan_Thread". 00:18:17.871: First chance exception 0x0EEDFADE (Unknown) occurred in "c:\program files\spybot - search & destroy\ADVCHECK.DLL" at address 0x07094F46 by thread 7 "SpybotSD_Scan_Thread". 00:18:17.937: First chance exception 0x0EEDFADE (Unknown) occurred in "c:\program files\spybot - search & destroy\ADVCHECK.DLL" at address 0x07094F46 by thread 7 "SpybotSD_Scan_Thread". 00:18:17.946: First chance exception 0x0EEDFADE (Unknown) occurred in "c:\program files\spybot - search & destroy\ADVCHECK.DLL" at address 0x07094F46 by thread 7 "SpybotSD_Scan_Thread". 00:18:18.023: First chance exception 0x0EEDFADE (Unknown) occurred in "c:\program files\spybot - search & destroy\ADVCHECK.DLL" at address 0x07094F46 by thread 7 "SpybotSD_Scan_Thread". 00:18:18.044: First chance exception 0x0EEDFADE (Unknown) occurred in "c:\program files\spybot - search & destroy\ADVCHECK.DLL" at address 0x07094F46 by thread 7 "SpybotSD_Scan_Thread". 00:18:18.137: First chance exception 0x0EEDFADE (Unknown) occurred in "c:\program files\spybot - search & destroy\ADVCHECK.DLL" at address 0x07094F46 by thread 7 "SpybotSD_Scan_Thread". 00:18:18.660: First chance exception 0x0EEDFADE (Unknown) occurred in "c:\program files\spybot - search & destroy\ADVCHECK.DLL" at address 0x07094EE8 by thread 7 "SpybotSD_Scan_Thread". 00:18:18.708: First chance exception 0x0EEDFADE (Unknown) occurred in "c:\program files\spybot - search & destroy\ADVCHECK.DLL" at address 0x07094F46 by thread 7 "SpybotSD_Scan_Thread". 00:18:18.737: First chance exception 0x0EEDFADE (Unknown) occurred in "c:\program files\spybot - search & destroy\ADVCHECK.DLL" at address 0x07094F46 by thread 7 "SpybotSD_Scan_Thread". 00:18:18.797: First chance exception 0x0EEDFADE (Unknown) occurred in "c:\program files\spybot - search & destroy\ADVCHECK.DLL" at address 0x07094F46 by thread 7 "SpybotSD_Scan_Thread". 00:18:18.939: First chance exception 0x0EEDFADE (Unknown) occurred in "c:\program files\spybot - search & destroy\ADVCHECK.DLL" at address 0x07094F46 by thread 7 "SpybotSD_Scan_Thread". 00:18:18.969: First chance exception 0x0EEDFADE (Unknown) occurred in "c:\program files\spybot - search & destroy\ADVCHECK.DLL" at address 0x07094F46 by thread 7 "SpybotSD_Scan_Thread". 00:41:05.268: Thread 4 exited with code -1 (0xFFFFFFFF). 00:41:05.277: Thread 5 exited with code -1 (0xFFFFFFFF). 00:41:05.286: Thread 2 exited with code -1 (0xFFFFFFFF). 00:41:05.317: Unloaded "c:\program files\common files\symantec shared\antispam\ASOEHOOK.DLL" at address 0x67320000 by thread 1. 00:41:05.343: Unloaded "c:\windows\system\MSVCR71.DLL" at address 0x7C340000 by thread 1. 00:41:05.353: Thread 1 exited with code -1 (0xFFFFFFFF). 00:41:05.361: Thread 3 exited with code -1 (0xFFFFFFFF). 00:41:05.441: Exited "c:\program files\spybot - search & destroy\SPYBOTSD.EXE" (process 0xFFF5B4F1) with code -1 (0xFFFFFFFF) by thread 7 "SpybotSD_Scan_Thread". ============== What do you think? --JorgeA

georg, Thanks for the further explanations. It sounds like these error messages don't point to the root of the problem, and we'll have to take a look at the actual log. I have that in its own file now, and will go through it for promising indicators. Regarding Symantec, it might be relevant to know that I've been using Norton Internet Security on that computer since 2003 and Spybot since 2004(?), but the problem with Spybot surfaced only years later, in 2008. As you might imagine, I've received an enormous amount of information during the course of this thread (sincere thank you, all), which I'm slowly making my way through. Been staying up till 2 and 3 AM just exploring and learning. One good thing about delving into an old OS is that you can get thick manuals on Amazon.com for US$0.01 + shipping. I see that there aren't any other ideas, so I can now move on to reporting on the Dependency Walker log. (The program's name sounds to me like a character in an old Western....) --JorgeA

georg, Preliminary report -- I did the DW profiling as you indicated, ran Spybot (it crashed again at the very end, ho hum), and then saved the log file. Before we start discussing the log, I'd like to bring up some things that appeared in DW's "Module" pane (the second from the bottom) which may be relevant. The first 22 entries in that pane have a message in red starting below the "File Time Stamp" heading, running across to the right. They each have this same message: "Error opening file. The system cannot find the file specified (2)." Here are the modules that showed that message -- APPHELP.DLL CCL30.DLL USERENV.DLL c:\program files\spybot - search & destroy\ADVCHECK.EN c:\program files\spybot - search & destroy\ADVCHECK.ENU c:\program files\spybot - search & destroy\plugins\CHAI.EN c:\program files\spybot - search & destroy\plugins\CHAI.ENU c:\program files\spybot - search & destroy\plugins\FENNEL.EN c:\program files\spybot - search & destroy\plugins\FENNEL.ENU c:\program files\spybot - search & destroy\plugins\MATE.EN c:\program files\spybot - search & destroy\plugins\MATE.ENU c:\program files\spybot - search & destroy\plugins\TCPIPADDRESS.EN c:\program files\spybot - search & destroy\plugins\TCPIPADDRESS.ENU c:\program files\spybot - search & destroy\SPYBOTSD.EN c:\program files\spybot - search & destroy\SPYBOTSD.ENU c:\program files\spybot - search & destroy\TOOLS.EN c:\program files\spybot - search & destroy\TOOLS.ENU PSAPI.DLL SRCLIENT.DLL UXTHEME.DLL WSHIP6.DLL WTSAPI32.DLL There is an unlabeled column just to the left of "Module" that contains cryptic icons. The first three in the above list show what appears to be a blue hourglass and then a black question mark in a yellow circle; the next 19 have what looks like a tiny sun or light, followed by the question mark. "Find Files" found exactly one of these 22 files in a different location, and the rest not at all. The one it did find is CCL30.DLL, which is in C:\Program Files\Common Files\Symantec Shared. A quick scan of the remaining listings in that pane shows that, subsequently, DLL files with many of these same filenames were loaded. One more item: Six (other) modules had "Actual Base" memory locations listed in red. Below are the affected module names, followed by the Preferred Base and then the Actual Base -- c:\program files\spybot - search & destroy\ADVCHECK.DLL 0x00400000 0x06FE0000 c:\program files\spybot - search & destroy\plugins\CHAI.DLL 0x00400000 0x03A80000 c:\program files\spybot - search & destroy\plugins\FENNEL.DLL 0x00400000 0x04030000 c:\program files\spybot - search & destroy\plugins\TCPIPADDRESS.DLL 0x00400000 0x00440000 c:\program files\spybot - search & destroy\plugins\MATE.DLL 0x00400000 0x066A0000 c:\windows\system\MSIMG32.DLL 0xBFDF0000 0x00410000 Does any of this information yield clues? --JorgeA

georg, Not to worry, I did understand what you meant with that last line. Once again, your instructions are magnificent in their level of detail, but I'll take your advice and wait a day or two in case someone else comes up with a different approach. In the meantime, there's no harm (or much additional time invested) in doing the steps generating the DW log for SSD and other programs that are still fully functional. That way they'll be ready if and when we move on to the heavy-duty work. Thanks once more. --JorgeA

One has to compare the MD5 hash with that from a known untampered version of the same file, which I provided in my latest post before this one... MD5 comparison answers the question "are two given binaries identical or not?". They match! We may look elsewhere. Cool! Too bad we didn't find the root of the Spybot problem yet, but it's reassuring to know that a critical file hasn't been messed with. Thanks! --JorgeA

dencorso, I have to gree with georg, this is a pretty neat program. I feel like I'm looking, not just under the hood, but at the pistons inside as they cycle. Amazing. The PE Timestamp for my USER32.DLL is -- 4/19/01 3:36:49 PM Let me know if you need any more data from MiTeC EXE Explorer. --JorgeA

georg, Thanks for the scoop. And it DID work in Win98 (dencorso, you were right), despite Microsoft's notice. Here's the information you requested -- VER returns the following line: Windows 98 (Version 4.10.1998) FCIV yields the following output: // // File Checksum Integrity Verifier version 2.05. // 2143f0dde35d73a04ff12ec1fb06c439 c:\windows\system\user32.dll I'm assuming those are zeroes (0) rather than capital O's. How does one interpret that information? --JorgeA

O.K., done! (As far as I could....) --JorgeA

dencorso, Thanks very much for the link. The description says that FCIV will run only on Windows 2000, 2003, and XP. Shall I download and run it anyway? In the meantime, here is all the information I was able to find about my USER32.DLL: From Properties: SIZE: 54.0KB (55,296 bytes), 57,344 used CREATED: Wednesday, December 02, 2009 9:04:33 PM MODIFIED: Friday, December 04, 2009 5:34:20 PM FILE VERSION: 4.10.2231 PRODUCT VERSION (under "Item name"): 4.10.2222 SPECIAL BUILD DESCRIPTION: QFE From System Information: VERSION: 4.10.2231 MANUFACTURER: Microsoft Corporation DATE: 4/19/01 3:36:49 PM GMT No doubt you'll note that the date in Properties doesn't agree with the date in System Information. I'll need guidance on the "PE Timestamp," as I'm not sure what that is. Hopefully one of the data bits above will have covered that. What sorts of (legitimate) programs or tinkering might affect USER32.DLL? Maybe knowing that will help to jog my memory as to what I might have done with that PC in the first week of 12/09. --JorgeA

georg, Thank you for the additional instructions. Obviously I still have a lot of catching up to do, in terms of knowing what to do and how to do it. I ran System File Checker again, with the settings you recommend. No issues were reported. To reassure you on another question, I followed Safer Networking's instructions (http://www.safer-networking.org/en/howto/uninstall.html) for completely uninstalling and removing Spybot. Although I will admit that the documentation for Spybot is not the best or most detailed that I have ever seen for a program. Here's the list of DLLs with the information you asked for. Hopefully it will be easier to read than my previous list. FILENAME (YOUR DATE) (MY DATE) MSOSS.DLL (5/11/98) (3/18/99) CRYPT32.DLL (5/11/98) (9/12/02) SQLITE3.DLL (6/19/08) (6/19/08) NETBIOS.DLL (5/11/98) (5/11/98) NETAPI.DLL (5/18/99) (12/14/98) WSOCK32.DLL (5/18/99) (12/14/98) WINMM.DLL (5/11/98) (5/11/98) COMDLG32.DLL (5/11/98) (5/11/98) WININET.DLL (5/11/98) (4/28/06) SHLWAPI.DLL (5/11/98) (8/31/05) There's also a SHLWAPI_BK (3/18/99) SHELL32.DLL (5/11/98) (12/06/01) WINSPOOL.DRV (5/11/98) (5/11/98) COMCTL32.DLL (4/30/99) (8/29/02) MPR.DLL (5/11/98) (5/11/98) VERSION.DLL (5/11/98) (5/11/98) USER32.DLL (5/11/98) (12/04/09) ADVAPI32.DLL (5/11/98) (5/11/98) KERNEL32.DLL (5/11/98) (5/11/98) GDI32.DLL (5/11/98) (5/11/98) OLE32.DLL (5/11/98) (3/29/99) OLEAUT32.DLL (5/4/01) (3/16/01) There's also a OLEAUT32.001 (3/08/99) WS2HELP.DLL (5/11/98) (5/11/98) MSVCRT.DLL (11/14/03) (4/06/00) WS2_32.DLL (5/11/98) (5/11/98) MSWSOCK.DLL (5/11/98) (5/11/98) MSIMG32.DLL (5/11/98) (5/11/98) OLEPRO32.DLL (3/8/99) (3/16/01) OLEACC.DLL (5/11/98) (10/09/98) RPCRT4.DLL (5/11/98) (3/29/99) MAPI32.DLL (5/11/98) (5/11/98) TOOLS.DLL (7/7/08) (1/26/09) URLMON.DLL (5/11/98) (5/08/06) HHCTRL.OCX (4/24/00) (4/14/05) RICHED32.DLL (5/11/98) (5/11/98) TCIPADDRESS.DLL (12/24/07) (12/24/07) CHAI.DLL (3/4/08) (3/04/08) FENNEL.DLL (3/5/08) (3/05/08) MATE.DLL (2/26/08) (2/26/08) SHDOCVW.DLL (5/11/98) (5/26/06) * * * O.K., this time I found all of them. (Got more sleep last night.) (For what it's worth, I purchased this computer from Dell in mid-June 1999; the specific manufacturer and/or purchase date I suppose might account for some of the differences in dates. Curiously -- and I intended to bring this up in a new thread when the Spybot business was finished -- System Properties under Control Panel gives the OS version number as 4.10.2222, which suggests 98SE, whereas System Information under Accessories - System Tools says it's 4.10.1998, suggesting 98FE and which is the one I've always thought I had.) How does it look? --JorgeA

Prozactive, I sure agree that I'm getting excellent technical advice on this forum. This is the best help experience I've ever had on any topic on any forum, bar none! A big problem (I think) with trying to trace what changes took place that might have messed things up, is that for about 14 years I treated PC's as black boxes that performed magic for me. I was really into computing when the original IBM PC's came out, and enjoyed tinkering with PC/MS-DOS, but then Windows overtook DOS, and as I used to say, the level of complexity surpassed my degree of interest. It's only in the past year that my desire to understand the workiings of computers has come back (prompted by the problem with my Win98 machine), and obviously I'm paying the price for that neglect. I will definitely investigate Prime95 -- I appreciate the tip. Spybot's definitions suddenly jumped from 0.9 million to 1.29 million in the last couple of weeks, and despite that -- yes, now that you mention it, it does seem to be loading faster. (Although in my case it could be because right now the computer is in a stripped-down environment for diagnostics.) Such a big increase would be good reason for the programmers to devise a way to make it load faster! Thanks for the good wishes. Will keep you updated. --JorgeA

rilef, Thanks very much. I'll look into getting Sygate. Does firewall software receive regular updates like antivirus programs, or are they something that can be installed, adjusted, and then left alone? I ask because I had Norton Internet Security on that PC, but the subscription expired in 12/08 and, although the AV part hasn't been getting updates (now using Avast!), the Norton firewall still operates. --JorgeA