Does Spybot SD Work on Win98 ?

[dencorso]

In addition, DW gave a rsult of, "Error opening file. The system cannot find the file specified (2)." for the following files. Find Files didn't find them, either:

APPHELP.DLL

USERENV.DLL

Finally (and possibly related to the above), the bottom panel had two Warnings:

"At least one delay-load dependency module was not found.

"At least one module has an unresolved import due to a missing export function in a delay-load dependent module."

Don't worry about those errors reported in your quote above. They are quite well-known Dependency Walker false positives, which simply indicate you're using IE6 SP1. I'll skip the detailed explanation of the reasons behind those errors, because it's quite long winded. You can find discussions about them by searching the forum, if you wish. You can disregard those safely!

[JorgeA]

JorgeA -

Don't use file names and dates from DW. Just show the files and file dates which you have in C:\Windows\System for each of the files which I listed.

Trying to find what is different between the system on which Spybot completes and the one on which it does not.

The format which you chose is fine.

georg,

Very well. Sorry about that.

Here we go. As I went through the list I realized that some modifications were necessary to the list format. The first date is the one you have. The next item, if "not listed," means that it did not show up on DW's list. If it is a date instead, it means that that's the date given in the file's Properties. That will be the Created date.

The third item following the filename is the Created date in the Properties. In some cases, a fourth item is given, which is the Modified date when that's different from the Created date. As you will see, they prove conclusively that it IS possible to modify something even before it gets created!!

MSOSS.DLL (5/11/98) (3/18/99)

CRYPT32.DLL (5/11/98) CREATED (10/31/04) MODIFIED (9/12/02) !!!

SQLITE3.DLL (6/19/08) CREATED (4/11/10) MODIFIED (6/19/08) !!!

NETBIOS.DLL (5/11/98) (5/11/98)

NETAPI.DLL (5/18/99) not listed (12/14/98)

WSOCK32.DLL (5/18/99) CREATED (unknown) MODIFIED (12/14/98)

WINMM.DLL (5/11/98) (5/11/98)

COMDLG32.DLL (5/11/98) (5/11/98)

WININET.DLL (5/11/98) (4/28/06)

SHLWAPI.DLL (5/11/98) (8/31/05)

SHELL32.DLL (5/11/98) CREATED (11/05/04) MODIFIED (12/06/01) !!!

WINSPOOL.DRV (5/11/98) (05/1198)

COMCTL32.DLL (4/30/99) (8/29/02)

MPR.DLL (5/11/98) (5/11/98)

VERSION.DLL (5/11/98) (5/11/98)

USER32.DLL (5/11/98) (12/02/09)

ADVAPI32.DLL (5/11/98) (5/11/98)

KERNEL32.DLL (5/11/98) (5/11/98)

GDI32.DLL (5/11/98) (5/11/98)

OLE32.DLL (5/11/98) (10/21/02)

OLEAUT32.DLL (5/4/01) (3/16/01)

WS2HELP.DLL (5/11/98) not listed

MSVCRT.DLL (11/14/03) (4/06/200)

WS2_32.DLL (5/11/98) not listed

MSWSOCK.DLL (5/11/98) not listed

MSIMG32.DLL (5/11/98) not listed

OLEPRO32.DLL (3/8/99) not listed (3/16/01)

OLEACC.DLL (5/11/98) not listed CREATED (9/11/05) MODIFIED (10/09/98) !!!

RPCRT4.DLL (5/11/98) CREATED (10/21/02) MODIFIED (3/29/99) !!!

MAPI32.DLL (5/11/98) not listed created (01/26/10) MODIFIED (5/11/98)

TOOLS.DLL (7/7/08) not listed

URLMON.DLL (5/11/98) (5/08/06)

HHCTRL.OCX (4/24/00) not listed (4/14/05)

RICHED32.DLL (5/11/98) not listed CREATED (unknown) MODIFIED (5/11/98)

TCIPADDRESS.DLL (12/24/07) not listed

CHAI.DLL (3/4/08) not listed

FENNEL.DLL (3/5/08) not listed

MATE.DLL (2/26/08) not listed

SHDOCVW.DLL (5/11/98) not listed

In addition, a bunch of files were listed in DW that are not on your list:

IMAGEHLP.DLL (9/14/02)

NETAPI32.DLL (5/11/98)

SPYBOTSD.EXE (1/26/09)

CFGMGR32.DLL (5/11/98)

LZ32.DLL (5/11/98)

MLANG.DLL (8/29/02)

MSI.DLL (1/26/02)

NTDLL.DLL (5/11/98)

SETUPAPI.DLL (5/11/98)

TAPI32.DLL (5/11/98)

Also, some files were not on DW's list that do exist in the Windows\System folder.

Hope that this will provide enough information to proceed from.

Thanks once again!

--JorgeA

[JorgeA]

In addition, DW gave a rsult of, "Error opening file. The system cannot find the file specified (2)." for the following files. Find Files didn't find them, either:

APPHELP.DLL

USERENV.DLL

Finally (and possibly related to the above), the bottom panel had two Warnings:

"At least one delay-load dependency module was not found.

"At least one module has an unresolved import due to a missing export function in a delay-load dependent module."

Don't worry about those errors reported in your quote above. They are quite well-known Dependency Walker false positives, which simply indicate you're using IE6 SP1. I'll skip the detailed explanation of the reasons behind those errors, because it's quite long winded. You can find discussions about them by searching the forum, if you wish. You can disregard those safely!

dencorso,

Thank you very much. This is reassuring.

You folks are SO knowledegeable about these things. Very impressive, my hat's off to you.

--JorgeA

[rilef]

JorgeA -

Sorry I misspoke. The firewall I meant to refer to, "Sygate", is available from many major download sites, including http://filehippo.com/download_sygate_personal_firewall/ . All software firewalls for Windows 98, including Sygate and Zone Alarm, are probably inadequate, and thus should be combined with a hardware firewall or router, if possible.

[georg]

JorgeA -

Are you saying that you do not have these Windows 98 DLL's in C:\Windows\System?

WS2HELP.DLL (5/11/98)

WS2_32.DLL (5/11/98)

MSWSOCK.DLL (5/11/98)

MSIMG32.DLL (5/11/98)

SHDOCVW.DLL (5/11/98)

Stay focused on the comparison of C:\Windows\System. Leave DW out of it.

Use only the date last Modified.

My system files show a creation date of (unknown) and the date which shows in Explorer is the date last Modified.

When a file is created, the creation date and time value is set and does not normally change. However, if you make a new copy of the file and save it to a different location, it is treated as a new file and a new creation date and time stamp is set. It is therefore possible to end up with a file that has a modification time that's earlier than its creation. If I copy a system file to another directory, the modification date is unchanged, but the creation date and time changes from (unknown) to the date and time showing on the system clock when the copy is made.

The modification date and time stamp normally changes only when the contents of the file are changed. Copying, renaming or moving the file doesn’t change it. Neither does opening the file without making any changes to it.

One reason I advised against a clean system install is that you wind up with all dates being 5/11/98. That breaks every application that uses an updated file, and wipes out all of your Windows updates. You have to be certain that you have ALL the original installation disks and support files for every program. Many people don't, and wind up worse off than they were before.

When a program that you have used for a long time stops working, the first thing to do is restore the registry and check all files against your last backup. If the backups are fresh, and you act fast enough, you can sometimes figure out what changed.

It is puzzling to me that Spybot S&D is the only program causing you trouble, and yet reinstalling the program does not fix the problem. I have to trust that you were rigorous about using Add/Remove, then manually deleting the directories and any remaining contents, then using CCleaner or regedit to search the registry and remove any remaining traces.

One other thought is to ask how you ran System File Checker. Did you tick the buttons to "Always back up before restoring", "Append to existing log", "Check for changed files" and "Check for deleted files"?

One more time, copy that list of DLL's from my post, and add to the right of each file only the date Modified from the details view of C:\Windows\System in Explorer. If you don't have that file in that directory, put "Not there".

[dencorso]

You can also compare compilation dates (aka PE Timestamps), which are usually much more reliable than the "Creation Times", because of being much less obvious to find, and even less to tamper with...

BTW, I've checked the others:

- 'danim.dll' has the same version number 6.03.01.0148, same size 1 056 768 bytes, but different MD5.

It can mean it's a different compilation of the same source. Or so minor a update that warrants no version number change. As it's impossible to decide which, it's usually best to stick with the newest version. And, when in doubt, you can always use MiTeC EXE Explorer to find out the real (unless it's been deliberately spoofed, which is unusual, as it's not a very well known feature) compilation date, the "PE Timestamp" of any Win-32 executable.

It depends on what are you trying to establish: compilation date means when the file was actually created, while "Last Modified" times tell you whether the file was modified and when.

[georg]

dencorso - nice little program. Thank you for the MiTeC link. - georg

[Prozactive]

Good advice from georg, et al. I recommend you also rule out memory and other hardware issues as a possible cause of your problems by running various diagnostic tools like Memtest86, Windows Memory Diagnostic, etc. Spybot runs fine on my Win98 systems although quite slowly as others have mentioned. On my slowest system (mobile Celeron 700mHz, 192MB RAM), it usually takes about 5-7 mins to load and around 1.5 hrs to scan my 6GB Win98 partition. I've never encountered any page fault or other errors, although after the last definitions update Spybot locked up after initial loading and eventually stopped responding in Task Manager for some reason (on all of my systems). It subsequently worked fine after reloading again.

Prozactive,

I thought I'd replied to you but it doesn't look like I did, sorry about that.

A few weeks ago I discovered the Windows Memory Diagnostic tool. I used it and the RAM passed with flying colors. (The Spybot issue has been going on for almost two years.)

My hard drive monitor reports a very healthy HDD.

Is there any other hardware I should/can test with software?

Thanks very much.

--JorgeA

JorgeA,

Sorry I also missed your reply in this extremely long convoluted thread. That's good that your system RAM passed the WMD test. (That acronym always makes me laugh, BTW.) It rules out one possible cause of your errors. I don't believe you're having hardware-related problems, but one excellent overall test of your CPU/memory and other subsystems is the torture test in Prime95. If your system passes an extended run of that test, you can be quite confident everything is working properly.

I have not thoroughly read and studied all of the long complex replies in this thread but you are definitely receiving a lot of excellent technically competent help. I'm sure you've already done this, but the general rule if something worked at one point then suddenly started giving errors, is to determine what system changes occurred in the interim then proceed with a methodical step-by-step clean boot troubleshooting procedure. I believe this is what you're doing now.

On a somewhat different but related note, about 2 or 3 weeks ago Spybot apparently changed their definitions updates and now the program loads significantly faster. I haven't done a full system scan so I can't report if that is also faster.

Good luck with your troubleshooting!

[JorgeA]

JorgeA -

Sorry I misspoke. The firewall I meant to refer to, "Sygate", is available from many major download sites, including http://filehippo.com/download_sygate_personal_firewall/ . All software firewalls for Windows 98, including Sygate and Zone Alarm, are probably inadequate, and thus should be combined with a hardware firewall or router, if possible.

rilef,

Thanks very much. I'll look into getting Sygate.

Does firewall software receive regular updates like antivirus programs, or are they something that can be installed, adjusted, and then left alone? I ask because I had Norton Internet Security on that PC, but the subscription expired in 12/08 and, although the AV part hasn't been getting updates (now using Avast!), the Norton firewall still operates.

--JorgeA

[JorgeA]

JorgeA,

Sorry I also missed your reply in this extremely long convoluted thread. That's good that your system RAM passed the WMD test. (That acronym always makes me laugh, BTW.) It rules out one possible cause of your errors. I don't believe you're having hardware-related problems, but one excellent overall test of your CPU/memory and other subsystems is the torture test in Prime95. If your system passes an extended run of that test, you can be quite confident everything is working properly.

I have not thoroughly read and studied all of the long complex replies in this thread but you are definitely receiving a lot of excellent technically competent help. I'm sure you've already done this, but the general rule if something worked at one point then suddenly started giving errors, is to determine what system changes occurred in the interim then proceed with a methodical step-by-step clean boot troubleshooting procedure. I believe this is what you're doing now.

On a somewhat different but related note, about 2 or 3 weeks ago Spybot apparently changed their definitions updates and now the program loads significantly faster. I haven't done a full system scan so I can't report if that is also faster.

Good luck with your troubleshooting!

Prozactive,

I sure agree that I'm getting excellent technical advice on this forum. This is the best help experience I've ever had on any topic on any forum, bar none!

A big problem (I think) with trying to trace what changes took place that might have messed things up, is that for about 14 years I treated PC's as black boxes that performed magic for me. I was really into computing when the original IBM PC's came out, and enjoyed tinkering with PC/MS-DOS, but then Windows overtook DOS, and as I used to say, the level of complexity surpassed my degree of interest. It's only in the past year that my desire to understand the workiings of computers has come back (prompted by the problem with my Win98 machine), and obviously I'm paying the price for that neglect.

I will definitely investigate Prime95 -- I appreciate the tip.

Spybot's definitions suddenly jumped from 0.9 million to 1.29 million in the last couple of weeks, and despite that -- yes, now that you mention it, it does seem to be loading faster. (Although in my case it could be because right now the computer is in a stripped-down environment for diagnostics.) Such a big increase would be good reason for the programmers to devise a way to make it load faster!

Thanks for the good wishes. Will keep you updated.

--JorgeA

[JorgeA]

georg,

Thank you for the additional instructions. Obviously I still have a lot of catching up to do, in terms of knowing what to do and how to do it.

I ran System File Checker again, with the settings you recommend. No issues were reported.

To reassure you on another question, I followed Safer Networking's instructions (http://www.safer-networking.org/en/howto/uninstall.html) for completely uninstalling and removing Spybot. Although I will admit that the documentation for Spybot is not the best or most detailed that I have ever seen for a program.

Here's the list of DLLs with the information you asked for. Hopefully it will be easier to read than my previous list.

FILENAME (YOUR DATE) (MY DATE)

MSOSS.DLL (5/11/98) (3/18/99)

CRYPT32.DLL (5/11/98) (9/12/02)

SQLITE3.DLL (6/19/08) (6/19/08)

NETBIOS.DLL (5/11/98) (5/11/98)

NETAPI.DLL (5/18/99) (12/14/98)

WSOCK32.DLL (5/18/99) (12/14/98)

WINMM.DLL (5/11/98) (5/11/98)

COMDLG32.DLL (5/11/98) (5/11/98)

WININET.DLL (5/11/98) (4/28/06)

SHLWAPI.DLL (5/11/98) (8/31/05) There's also a SHLWAPI_BK (3/18/99)

SHELL32.DLL (5/11/98) (12/06/01)

WINSPOOL.DRV (5/11/98) (5/11/98)

COMCTL32.DLL (4/30/99) (8/29/02)

MPR.DLL (5/11/98) (5/11/98)

VERSION.DLL (5/11/98) (5/11/98)

USER32.DLL (5/11/98) (12/04/09)

ADVAPI32.DLL (5/11/98) (5/11/98)

KERNEL32.DLL (5/11/98) (5/11/98)

GDI32.DLL (5/11/98) (5/11/98)

OLE32.DLL (5/11/98) (3/29/99)

OLEAUT32.DLL (5/4/01) (3/16/01) There's also a OLEAUT32.001 (3/08/99)

WS2HELP.DLL (5/11/98) (5/11/98)

MSVCRT.DLL (11/14/03) (4/06/00)

WS2_32.DLL (5/11/98) (5/11/98)

MSWSOCK.DLL (5/11/98) (5/11/98)

MSIMG32.DLL (5/11/98) (5/11/98)

OLEPRO32.DLL (3/8/99) (3/16/01)

OLEACC.DLL (5/11/98) (10/09/98)

RPCRT4.DLL (5/11/98) (3/29/99)

MAPI32.DLL (5/11/98) (5/11/98)

TOOLS.DLL (7/7/08) (1/26/09)

URLMON.DLL (5/11/98) (5/08/06)

HHCTRL.OCX (4/24/00) (4/14/05)

RICHED32.DLL (5/11/98) (5/11/98)

TCIPADDRESS.DLL (12/24/07) (12/24/07)

CHAI.DLL (3/4/08) (3/04/08)

FENNEL.DLL (3/5/08) (3/05/08)

MATE.DLL (2/26/08) (2/26/08)

SHDOCVW.DLL (5/11/98) (5/26/06)

* * *

O.K., this time I found all of them. (Got more sleep last night.)

(For what it's worth, I purchased this computer from Dell in mid-June 1999; the specific manufacturer and/or purchase date I suppose might account for some of the differences in dates. Curiously -- and I intended to bring this up in a new thread when the Spybot business was finished -- System Properties under Control Panel gives the OS version number as 4.10.2222, which suggests 98SE, whereas System Information under Accessories - System Tools says it's 4.10.1998, suggesting 98FE and which is the one I've always thought I had.)

How does it look?

--JorgeA

Edited April 28, 2010 by JorgeA

[dencorso]

Your USER32.DLL (5/11/98) (12/04/09) looks highly suspect for me.

Can you please provide: Size in bytes, File Version, Product Version, PE Timestamp and MD5 Hash of it?

You can calculate the MD5 Hash with FDIV (KB841290), if I recall right, it runs on 9x/ME (but I cannot confirm it right now, sorry). After downloading the package, there's no need to actually run the installer, for there's nothing to install, because FCIV is a standalone console utility... you may instead simply extract it from inside the installer and just drop it into C:\WINDOWS\COMMAND.

[georg]

JorgeA - Respond to dencorso re USER32.DLL We can continue later if need be. - georg

[JorgeA]

Your USER32.DLL (5/11/98) (12/04/09) looks highly suspect for me.

Can you please provide: Size in bytes, File Version, Product Version, PE Timestamp and MD5 Hash of it?

You can calculate the MD5 Hash with FDIV (KB841290), if I recall right, it runs on 9x/ME (but I cannot confirm it right now, sorry). After downloading the package, there's no need to actually run the installer, for there's nothing to install, because FCIV is a standalone console utility... you may instead simply extract it from inside the installer and just drop it into C:\WINDOWS\COMMAND.

dencorso,

Thanks very much for the link. The description says that FCIV will run only on Windows 2000, 2003, and XP. Shall I download and run it anyway?

In the meantime, here is all the information I was able to find about my USER32.DLL:

From Properties:

SIZE: 54.0KB (55,296 bytes), 57,344 used

CREATED: Wednesday, December 02, 2009 9:04:33 PM

MODIFIED: Friday, December 04, 2009 5:34:20 PM

FILE VERSION: 4.10.2231

PRODUCT VERSION (under "Item name"): 4.10.2222

SPECIAL BUILD DESCRIPTION: QFE

From System Information:

VERSION: 4.10.2231

MANUFACTURER: Microsoft Corporation

DATE: 4/19/01 3:36:49 PM GMT

No doubt you'll note that the date in Properties doesn't agree with the date in System Information.

I'll need guidance on the "PE Timestamp," as I'm not sure what that is. Hopefully one of the data bits above will have covered that.

What sorts of (legitimate) programs or tinkering might affect USER32.DLL? Maybe knowing that will help to jog my memory as to what I might have done with that PC in the first week of 12/09.

--JorgeA

[JorgeA]

JorgeA - Respond to dencorso re USER32.DLL We can continue later if need be. - georg

O.K., done! (As far as I could....)

--JorgeA