Does Spybot SD Work on Win98 ?

[georg]

JorgeA -

fciv runs OK on Win98fe from C:\Windows\Command by opening an MS-DOS prompt

C:\WINDOWS> fciv c:\windows\system\user32.dll

While you have the prompt open, type ver to see product version

When you doubleclick the installer it will ask where to put the files. You get fciv.exe and a ReadMe.txt, so I suggest choosing an empty directory and then manually copy fciv.exe into C:\Windows\Command so you don't overwrite some other ReadMe.txt

[dencorso]

@JorgeA: the PE Timestamp is listed simply as "Timestamp" (the 4th line under the Header tab), when you open user32.dll with MiTeC EXE Explorer. It's given in UTC. There's a link for it and a link under "PE Timestamp" in my post #66. For the files it can open, EXE Explorer also provides the MD5 Hash, BTW. Then again, FCIV calculates hashes for any kind of file.

Here's that data from bona-fide USER32.DLL from KB291362:

File Size: 55,296 bytes

File Version: 4.10.2231

File Version (under "Item name"): 4.10.2231

Product Version (under "Item name"): 4.10.2222

PE Timestamp: 19/04/2001 3:36:49 PM

MD5: 2143F0DDE35D73A04FF12EC1FB06C439

PS: Sometimes the two instances of File Version in the right-click --> Properties --> Version do present different info, but that's not the case for this file. If the MD5 of your file matches, it's an untampered file. Then we may look elsewhere.

[JorgeA]

JorgeA -

fciv runs OK on Win98fe from C:\Windows\Command by opening an MS-DOS prompt

C:\WINDOWS> fciv c:\windows\system\user32.dll

While you have the prompt open, type ver to see product version

When you doubleclick the installer it will ask where to put the files. You get fciv.exe and a ReadMe.txt, so I suggest choosing an empty directory and then manually copy fciv.exe into C:\Windows\Command so you don't overwrite some other ReadMe.txt

georg,

Thanks for the scoop. And it DID work in Win98 (dencorso, you were right), despite Microsoft's notice.

Here's the information you requested --

VER returns the following line:

Windows 98 (Version 4.10.1998)

FCIV yields the following output:

//

// File Checksum Integrity Verifier version 2.05.

//

2143f0dde35d73a04ff12ec1fb06c439 c:\windows\system\user32.dll

I'm assuming those are zeroes (0) rather than capital O's.

How does one interpret that information?

--JorgeA

[dencorso]

MD5: 2143F0DDE35D73A04FF12EC1FB06C439

2143f0dde35d73a04ff12ec1fb06c439 c:\windows\system\user32.dll

How does one interpret that information?

One has to compare the MD5 hash with that from a known untampered version of the same file, which I provided in my latest post before this one... MD5 comparison answers the question "are two given binaries identical or not?".

They match! We may look elsewhere.

[JorgeA]

...

Here's that data from bona-fide USER32.DLL from KB291362:

File Size: 55,296 bytes

File Version: 4.10.2231

File Version (under "Item name"): 4.10.2231

Product Version (under "Item name"): 4.10.2222

PE Timestamp: 19/04/2001 3:36:49 PM

MD5: 2143F0DDE35D73A04FF12EC1FB06C439

PS: Sometimes the two instances of File Version in the right-click --> Properties --> Version do present different info, but that's not the case for this file. If the MD5 of your file matches, it's an untampered file. Then we may look elsewhere.

dencorso,

I have to gree with georg, this is a pretty neat program. I feel like I'm looking, not just under the hood, but at the pistons inside as they cycle. Amazing.

The PE Timestamp for my USER32.DLL is --

4/19/01 3:36:49 PM

Let me know if you need any more data from MiTeC EXE Explorer.

--JorgeA

[JorgeA]

MD5: 2143F0DDE35D73A04FF12EC1FB06C439

2143f0dde35d73a04ff12ec1fb06c439 c:\windows\system\user32.dll

How does one interpret that information?

One has to compare the MD5 hash with that from a known untampered version of the same file, which I provided in my latest post before this one... MD5 comparison answers the question "are two given binaries identical or not?".

They match! We may look elsewhere.

Cool! Too bad we didn't find the root of the Spybot problem yet, but it's reassuring to know that a critical file hasn't been messed with.

Thanks!

--JorgeA

[georg]

JorgeA -

OK. Now let's talk about Dependency Walker.

Open DW

Go to File > Open > use the drop down to browse to C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe

Select (highlight) SpybotSD.exe and left click Open

Go to Profile and left click on "Start Profiling"

On the Profile Module, leave Program arguments blank

Leave "Clear the log window" blank, but tick all the other choices

Click OK to begin profiling; Spybot message boxes will start appearing.

Wait until the main Spybot screen comes up showing loading is complete (abt. 5 minutes)

On the Spybot screen click "Search for problems" (profiling will continue)

The rapidly changing bottom window on the DW screen, called the "Log View," is the one I use.

The last few entries should show exit from all threads and a final "Exited...from SPYBOTSD.EXE..."

If not, the last entries may reveal where the process bombed.

Right click on the log view entries and then left click on SelectAll

Copy and paste the log into Wordpad

Save the file under a name of your choice and then exit DW and open the log file.

You should have a log about 58 pages in length.

It is from that log that I drew the list of DLL's.

My suggestion is that you create logs for several other programs that you know work perfectly, and look at the kind of messages that come up in the logs in Red print, just for perspective.

OK. Now back to the list of DLL's. I edited the list to remove all the entries where we both have original file dates of 5/11/98, and all the entries that are Spybot S&D files that come with the program. I also looked at your original list of "a bunch of files ...listed in DW that are not on your list". There were 3 files that do appear in the log, missed by me, but we both have the 5/11/98 date for them so they are ignored. The others do not appear in the log as being actually used by the SSD process. I also deleted files where you have a 1998 or 1999 date, feeling they are probably Windows updates or service packs. Based on the exchange with dencorso, I've also deleted user32.dll. This is what remains.

FILENAME (georg DATE) (JorgeA DATE)

CRYPT32.DLL (5/11/98) (9/12/02)

WININET.DLL (5/11/98) (4/28/06)

SHLWAPI.DLL (5/11/98) (8/31/05) There's also a SHLWAPI_BK (3/18/99)

SHELL32.DLL (5/11/98) (12/06/01)

COMCTL32.DLL (4/30/99) (8/29/02)

OLEAUT32.DLL (5/4/01) (3/16/01) There's also a OLEAUT32.001 (3/08/99)

MSVCRT.DLL (11/14/03) (4/06/00)

OLEPRO32.DLL (3/8/99) (3/16/01)

URLMON.DLL (5/11/98) (5/08/06)

HHCTRL.OCX (4/24/00) (4/14/05)

SHDOCVW.DLL (5/11/98) (5/26/06)

It would be safest to make a fresh backup, including the registry, before substituting any files.

Since your problem occurs at the end of the SSD process, one approach would be to work the list backward, from bottom to top. For each file, use the Edit > Find function in Wordpad to look at all instances of that file in the log.

If you come up with a likely suspect, or you can't see a suspect, then for each file extract an original 5/11/98 from your cabs, move the newer file from C:Windows\System to a backup location, and put the 5/11/98 file into the system directory. Then reboot. If Windows still works, see if Spybot works (using the stub filesets short scan). See if anything else breaks. Try the apparent backups for SHLWAPI and OLEAUT32.

Wait a bit here before you begin. You still have the option to just stop scanning with SSD using Windows 98.

Wait also to see if some wise head wants to pop in with a better suggestion.

[georg]

"Wait also to see if some wise head wants to pop in with a better suggestion."

Don't like the way that came out. My intent is to invite someone who knows more than I do to get this on an easier or better track if there is one. :-)

[JorgeA]

"Wait also to see if some wise head wants to pop in with a better suggestion."

Don't like the way that came out. My intent is to invite someone who knows more than I do to get this on an easier or better track if there is one. :-)

georg,

Not to worry, I did understand what you meant with that last line.

Once again, your instructions are magnificent in their level of detail, but I'll take your advice and wait a day or two in case someone else comes up with a different approach. In the meantime, there's no harm (or much additional time invested) in doing the steps generating the DW log for SSD and other programs that are still fully functional. That way they'll be ready if and when we move on to the heavy-duty work.

Thanks once more.

--JorgeA

[georg]

JorgeA -

PE Timestamps & version numbers from MiTeC for the last shortlist:

FILENAME / PE TIMESTAMP / VERSION

CRYPT32.DLL / 4/29/98 4:04:01 PM / 5.101.1743.1

WININET.DLL / 4/29/98 4:05:10 PM / 4.72.3110.0

SHLWAPI.DLL / 3/11/98 4:05:38 AM / 4.72.3110.0

SHELL32.DLL / 4/29/98 4:03:50 PM / 4.72.3110.6

COMCTL32.DLL / 5/1/99 1:01:05 AM / Product 5.00.2614.3600 File 5.80

OLEAUT32.DLL / 5/4/01 9:34:09 PM / 2.40.4517

MSVCRT.DLL / 7/13/00 3:10:12 AM / 6.10.8924.0

OLEPRO32.DLL / 3/8/99 7:15:46 PM / Product 2.40 File 5.0.4275

URLMON.DLL / 4/29/98 4:05:01 PM / 4.72.3110.6

HHCTRL.OCX / 5/24/00 5:24:16 PM / 4.74.8875

SHDOCVW.DLL / 4/29/98 4:04:52 PM / 4.72.3110.3

[JorgeA]

JorgeA -

OK. Now let's talk about Dependency Walker.

Open DW

...

georg,

Preliminary report --

I did the DW profiling as you indicated, ran Spybot (it crashed again at the very end, ho hum), and then saved the log file. Before we start discussing the log, I'd like to bring up some things that appeared in DW's "Module" pane (the second from the bottom) which may be relevant. The first 22 entries in that pane have a message in red starting below the "File Time Stamp" heading, running across to the right. They each have this same message:

"Error opening file. The system cannot find the file specified (2)."

Here are the modules that showed that message --

APPHELP.DLL

CCL30.DLL

USERENV.DLL

c:\program files\spybot - search & destroy\ADVCHECK.EN

c:\program files\spybot - search & destroy\ADVCHECK.ENU

c:\program files\spybot - search & destroy\plugins\CHAI.EN

c:\program files\spybot - search & destroy\plugins\CHAI.ENU

c:\program files\spybot - search & destroy\plugins\FENNEL.EN

c:\program files\spybot - search & destroy\plugins\FENNEL.ENU

c:\program files\spybot - search & destroy\plugins\MATE.EN

c:\program files\spybot - search & destroy\plugins\MATE.ENU

c:\program files\spybot - search & destroy\plugins\TCPIPADDRESS.EN

c:\program files\spybot - search & destroy\plugins\TCPIPADDRESS.ENU

c:\program files\spybot - search & destroy\SPYBOTSD.EN

c:\program files\spybot - search & destroy\SPYBOTSD.ENU

c:\program files\spybot - search & destroy\TOOLS.EN

c:\program files\spybot - search & destroy\TOOLS.ENU

PSAPI.DLL

SRCLIENT.DLL

UXTHEME.DLL

WSHIP6.DLL

WTSAPI32.DLL

There is an unlabeled column just to the left of "Module" that contains cryptic icons. The first three in the above list show what appears to be a blue hourglass and then a black question mark in a yellow circle; the next 19 have what looks like a tiny sun or light, followed by the question mark.

"Find Files" found exactly one of these 22 files in a different location, and the rest not at all. The one it did find is CCL30.DLL, which is in C:\Program Files\Common Files\Symantec Shared.

A quick scan of the remaining listings in that pane shows that, subsequently, DLL files with many of these same filenames were loaded.

One more item: Six (other) modules had "Actual Base" memory locations listed in red. Below are the affected module names, followed by the Preferred Base and then the Actual Base --

c:\program files\spybot - search & destroy\ADVCHECK.DLL 0x00400000 0x06FE0000

c:\program files\spybot - search & destroy\plugins\CHAI.DLL 0x00400000 0x03A80000

c:\program files\spybot - search & destroy\plugins\FENNEL.DLL 0x00400000 0x04030000

c:\program files\spybot - search & destroy\plugins\TCPIPADDRESS.DLL 0x00400000 0x00440000

c:\program files\spybot - search & destroy\plugins\MATE.DLL 0x00400000 0x066A0000

c:\windows\system\MSIMG32.DLL 0xBFDF0000 0x00410000

Does any of this information yield clues?

--JorgeA

[georg]

JorgeA -

You wrote: "Does any of this information yield clues?"

Yes, but. You used an analogy to an automobile engine in one of your posts. A mechanic in a garage with a Motor Manual could once fix the whole car. Now technicians go to school for years just to try and understand one subsystem. It would take a garage full of books, and if you read them all you would never have time to repair anything. Bill Gates has bragged that Windows contains more lines of code than the "unfixable" U.S. air traffic control system. Patrick D. Kolla has worked on Spybot S&D for more than a decade. You can't understand code just by watching it run.

However, you begin by reading all the help files that the developer makes available, and you google all the terms like md5 that you do not understand. DW has excellent help, and there are full descriptions, in color, of all the "cryptic symbols". Click on the little plus signs and you get 23 chapters of information.

Any program like Spybot S&D that runs on a wide variety of operating systems, and tries to check an infinite variety of installed software, is going to throw up some errors. Dencorso used the phrase "false positives" and you can probably add "false negatives". Given that it is a security program, you are unlikely to get an explanation of exactly how the program works, even on the SSD forum.

All the modules that are preceded with the path to Spybot Search & Destroy are integral parts of SSD. Only Patrick Kolla can explain why his own program can't find the module, if that is true. He likes tea (e.g. teatimer). Chai, fennel and mate are all types of tea.

I get the "Error opening file" in red for most of the modules you list, but the program still operates OK.

These are the ones where your system shows an error, and mine does not.

apphelp.dll is not on my hard drive, and DW does not list it.

ccl30.dll ditto

userenv.dll ditto

advcheck.dll is in the Spybot directory. It does not show as an error on my system. It does not appear in my log.

The fact that CCL30.DLL is a Symantec file again raises for me the question of whether a Norton process is the one that does not play well with SSD. Even though you said you uninstalled part of it, and are now running Avast, you've obviously got traces that are throwing up an error in SSD. We are often admonished not to run multiple security programs, and it may be that you will have to choose one or the other. You can try removing all traces of Norton or Symantec and see if SSD then works. Symantec is notorious for being hard to remove, but you will have to do it anyway if you go to Sygate or some other firewall.

Here is the entry for apphelp,dll from the Dependency Walker FAQ (part of help):

"APPHELP.DLL is used by Windows XP's application compatibility feature. It is a Windows XP/2003/Vista/+ only DLL. If you see this warning, you most likely installed Internet Explorer 6.0 on your pre- Windows XP computer (Windows 95/98/ME/2000). Internet Explorer 6.0 installs a new SHWAPI.DLL that has a delay-load dependency on APPHELP.DLL. This is normal as SHWAPI.DLL does not expect to find APPHELP.DLL on versions of Windows prior to Windows XP. This warning can be ignored. You do not need (or want) APPHELP.DLL on Windows 95/98/ME/2000.

A quick google search brings up a ton of similar errors re DW and those two files with other software.:

APPHELP.DLL and USERENV.DLL & Win98SE

"problems with these DLLs (are) quite common, but that they are not in fact supposed to be used under Win98SE"

"APPHELP.DLL and USERENV.DLL ...are NT only function calls"

"If you are using a version of windows other than XP check your version of NTDLL.dll for that export. Chances are, it just isn't there."

"Actual Base" (from DW help):

"This value will be shown in red if it does not match the preferred base address for the module. Your application will suffer a load-time performance hit for every module that does not load at its preferred base address"

Maybe that's one reason why load times are so slow. An issue to take up with the Spybot forum.

[JorgeA]

georg,

Thanks for the further explanations. It sounds like these error messages don't point to the root of the problem, and we'll have to take a look at the actual log. I have that in its own file now, and will go through it for promising indicators.

Regarding Symantec, it might be relevant to know that I've been using Norton Internet Security on that computer since 2003 and Spybot since 2004(?), but the problem with Spybot surfaced only years later, in 2008.

As you might imagine, I've received an enormous amount of information during the course of this thread (sincere thank you, all), which I'm slowly making my way through. Been staying up till 2 and 3 AM just exploring and learning. One good thing about delving into an old OS is that you can get thick manuals on Amazon.com for US$0.01 + shipping.

I see that there aren't any other ideas, so I can now move on to reporting on the Dependency Walker log. (The program's name sounds to me like a character in an old Western....)

--JorgeA

Edited April 30, 2010 by JorgeA

[JorgeA]

georg,

I took a look at the DW log for Spybot. Before I start making changes to the Registry as suggested in your Post #82, maybe we can examine some of DW's output fur further guidance.

To give you some background, I loaded DW and then profiled SSD. SSD was set to scan all files except Usage Tracks and the biggest chunks, the Trojans. That scan was finished in about 18 minutes (although I had to step out of the office and returned at about 41 minutes) and yielded a log that Word processes as 272 pages in length.

There were a lot of lines in red. (Other programs that I tried, such as Word and CompuServe 4.02, also returned some lines in red but they've never given me any problems). Here are two representative samples:

00:00:02.465: DllMain(0x65340000, DLL_PROCESS_ATTACH, 0x00000001) in "c:\windows\system\OLEAUT32.DLL" called by thread 1.

00:00:02.473: GetProcAddress(0xBFF70000 [c:\windows\system\KERNEL32.DLL], "IsTNT") called from "c:\windows\system\OLEAUT32.DLL" at address 0x653B3A52 and returned NULL by thread 1. Error: The specified module could not be found (126).

00:00:02.503: GetProcAddress(0xBFF70000 [c:\windows\system\KERNEL32.DLL], "IsProcessorFeaturePresent") called from "c:\windows\system\OLEAUT32.DLL" at address 0x653B6C0B and returned 0x83950258 by thread 1.

and --

00:00:03.812: LoadLibraryA("gdi32.dll") called from "c:\windows\system\MSIMG32.DLL" at address 0x0041137F by thread 1.

00:00:03.816: LoadLibraryA("gdi32.dll") returned 0xBFF20000 by thread 1.

00:00:03.823: GetProcAddress(0xBFF20000 [c:\windows\system\GDI32.DLL], "GdiTransparentBlt") called from "c:\windows\system\MSIMG32.DLL" at address 0x0041138F and returned NULL by thread 1. Error: The specified module could not be found (126).

00:00:03.832: GetProcAddress(0xBFF20000 [c:\windows\system\GDI32.DLL], "GdiGradientFill") called from "c:\windows\system\MSIMG32.DLL" at address 0x004113AA and returned NULL by thread 1. Error: The specified module could not be found (126).

00:00:03.841: GetProcAddress(0xBFF20000 [c:\windows\system\GDI32.DLL], "GdiAlphaBlend") called from "c:\windows\system\MSIMG32.DLL" at address 0x004113C5 and returned NULL by thread 1. Error: The specified module could not be found (126).

00:00:03.846: DllMain(0x00410000, DLL_PROCESS_ATTACH, 0x00000000) in "c:\windows\system\MSIMG32.DLL" returned 1 (0x1) by thread 1.

00:00:03.850: LoadLibraryA("msimg32.dll") returned 0x00410000 by thread 1.

There are MANY more like that, but nonetheless Spybot seems to run its course just great -- till we reach the following, when we get a large number of "first chance exceptions" involving ADVCHECK.DLL, and then nothing further happens till I close the program at minute 41. In the log, these lines all show up in black:

00:16:55.940: LoadLibraryA("C:\PROGRAM FILES\SPYBOT - SEARCH & DESTROY\Tools.dll") returned 0x029F0000 by thread 7 "SpybotSD_Scan_Thread".

00:16:55.958: GetProcAddress(0x029F0000 [c:\program files\spybot - search & destroy\TOOLS.DLL], "SolveEnvMulti") called from "c:\program files\spybot - search & destroy\SPYBOTSD.EXE" at address 0x007114AB and returned 0x02ADF4EC by thread 7 "SpybotSD_Scan_Thread".

00:16:58.160: LoadLibraryA("C:\PROGRAM FILES\SPYBOT - SEARCH & DESTROY\Tools.dll") called from "c:\program files\spybot - search & destroy\SPYBOTSD.EXE" at address 0x0071149E by thread 7 "SpybotSD_Scan_Thread".

00:16:58.167: LoadLibraryA("C:\PROGRAM FILES\SPYBOT - SEARCH & DESTROY\Tools.dll") returned 0x029F0000 by thread 7 "SpybotSD_Scan_Thread".

00:16:58.179: GetProcAddress(0x029F0000 [c:\program files\spybot - search & destroy\TOOLS.DLL], "SolveEnvMulti") called from "c:\program files\spybot - search & destroy\SPYBOTSD.EXE" at address 0x007114AB and returned 0x02ADF4EC by thread 7 "SpybotSD_Scan_Thread".

00:17:11.521: First chance exception 0x0EEDFADE (Unknown) occurred in "c:\program files\spybot - search & destroy\ADVCHECK.DLL" at address 0x07094EE8 by thread 7 "SpybotSD_Scan_Thread".

00:17:11.538: First chance exception 0x0EEDFADE (Unknown) occurred in "c:\program files\spybot - search & destroy\ADVCHECK.DLL" at address 0x07094F46 by thread 7 "SpybotSD_Scan_Thread".

00:17:11.555: First chance exception 0x0EEDFADE (Unknown) occurred in "c:\program files\spybot - search & destroy\ADVCHECK.DLL" at address 0x07094F46 by thread 7 "SpybotSD_Scan_Thread".

00:17:11.586: First chance exception 0x0EEDFADE (Unknown) occurred in "c:\program files\spybot - search & destroy\ADVCHECK.DLL" at address 0x07094F46 by thread 7 "SpybotSD_Scan_Thread".

00:17:11.621: First chance exception 0x0EEDFADE (Unknown) occurred in "c:\program files\spybot - search & destroy\ADVCHECK.DLL" at address 0x07094F46 by thread 7 "SpybotSD_Scan_Thread".

00:17:11.683: First chance exception 0x0EEDFADE (Unknown) occurred in "c:\program files\spybot - search & destroy\ADVCHECK.DLL" at address 0x07094F46 by thread 7 "SpybotSD_Scan_Thread".

00:17:11.768: First chance exception 0x0EEDFADE (Unknown) occurred in "c:\program files\spybot - search & destroy\ADVCHECK.DLL" at address 0x07094F46 by thread 7 "SpybotSD_Scan_Thread".

00:17:11.804: First chance exception 0x0EEDFADE (Unknown) occurred in "c:\program files\spybot - search & destroy\ADVCHECK.DLL" at address 0x07094F46 by thread 7 "SpybotSD_Scan_Thread".

00:17:11.812: First chance exception 0x0EEDFADE (Unknown) occurred in "c:\program files\spybot - search & destroy\ADVCHECK.DLL" at address 0x07094EE8 by thread 7 "SpybotSD_Scan_Thread".

00:17:11.834: First chance exception 0x0EEDFADE (Unknown) occurred in "c:\program files\spybot - search & destroy\ADVCHECK.DLL" at address 0x07094F46 by thread 7 "SpybotSD_Scan_Thread".

00:17:11.903: First chance exception 0x0EEDFADE (Unknown) occurred in "c:\program files\spybot - search & destroy\ADVCHECK.DLL" at address 0x07094F46 by thread 7 "SpybotSD_Scan_Thread".

00:18:00.274: First chance exception 0x0EEDFADE (Unknown) occurred in "c:\program files\spybot - search & destroy\ADVCHECK.DLL" at address 0x07094F46 by thread 7 "SpybotSD_Scan_Thread".

00:18:00.280: First chance exception 0xC0000005 (Access Violation) occurred in "c:\program files\spybot - search & destroy\ADVCHECK.DLL" at address 0x070A31C2 by thread 7 "SpybotSD_Scan_Thread".

00:18:00.608: First chance exception 0x0EEDFADE (Unknown) occurred in "c:\program files\spybot - search & destroy\ADVCHECK.DLL" at address 0x07094F46 by thread 7 "SpybotSD_Scan_Thread".

00:18:04.027: LoadLibraryA("C:\PROGRAM FILES\SPYBOT - SEARCH & DESTROY\Tools.dll") called from "c:\program files\spybot - search & destroy\SPYBOTSD.EXE" at address 0x0071149E by thread 7 "SpybotSD_Scan_Thread".

00:18:04.034: LoadLibraryA("C:\PROGRAM FILES\SPYBOT - SEARCH & DESTROY\Tools.dll") returned 0x029F0000 by thread 7 "SpybotSD_Scan_Thread".

00:18:04.045: GetProcAddress(0x029F0000 [c:\program files\spybot - search & destroy\TOOLS.DLL], "SolveEnvMulti") called from "c:\program files\spybot - search & destroy\SPYBOTSD.EXE" at address 0x007114AB and returned 0x02ADF4EC by thread 7 "SpybotSD_Scan_Thread".

00:18:16.556: First chance exception 0x0EEDFADE (Unknown) occurred in "c:\program files\spybot - search & destroy\ADVCHECK.DLL" at address 0x07094F46 by thread 7 "SpybotSD_Scan_Thread".

00:18:16.562: First chance exception 0xC0000005 (Access Violation) occurred in "c:\program files\spybot - search & destroy\ADVCHECK.DLL" at address 0x070A336F by thread 7 "SpybotSD_Scan_Thread".

00:18:16.578: First chance exception 0x0EEDFADE (Unknown) occurred in "c:\program files\spybot - search & destroy\ADVCHECK.DLL" at address 0x07094F46 by thread 7 "SpybotSD_Scan_Thread".

00:18:16.584: First chance exception 0xC0000005 (Access Violation) occurred in "c:\program files\spybot - search & destroy\ADVCHECK.DLL" at address 0x070A336F by thread 7 "SpybotSD_Scan_Thread".

00:18:16.637: First chance exception 0x0EEDFADE (Unknown) occurred in "c:\program files\spybot - search & destroy\ADVCHECK.DLL" at address 0x07094F46 by thread 7 "SpybotSD_Scan_Thread".

00:18:16.645: First chance exception 0xC0000005 (Access Violation) occurred in "c:\program files\spybot - search & destroy\ADVCHECK.DLL" at address 0x070A336F by thread 7 "SpybotSD_Scan_Thread".

00:18:16.653: First chance exception 0x0EEDFADE (Unknown) occurred in "c:\program files\spybot - search & destroy\ADVCHECK.DLL" at address 0x07094F46 by thread 7 "SpybotSD_Scan_Thread".

00:18:16.660: First chance exception 0xC0000005 (Access Violation) occurred in "c:\program files\spybot - search & destroy\ADVCHECK.DLL" at address 0x070A336F by thread 7 "SpybotSD_Scan_Thread".

00:18:17.405: First chance exception 0x0EEDFADE (Unknown) occurred in "c:\program files\spybot - search & destroy\ADVCHECK.DLL" at address 0x07094F46 by thread 7 "SpybotSD_Scan_Thread".

00:18:17.431: First chance exception 0x0EEDFADE (Unknown) occurred in "c:\program files\spybot - search & destroy\ADVCHECK.DLL" at address 0x07094F46 by thread 7 "SpybotSD_Scan_Thread".

00:18:17.576: First chance exception 0x0EEDFADE (Unknown) occurred in "c:\program files\spybot - search & destroy\ADVCHECK.DLL" at address 0x07094F46 by thread 7 "SpybotSD_Scan_Thread".

00:18:17.589: First chance exception 0x0EEDFADE (Unknown) occurred in "c:\program files\spybot - search & destroy\ADVCHECK.DLL" at address 0x07094F46 by thread 7 "SpybotSD_Scan_Thread".

00:18:17.611: First chance exception 0x0EEDFADE (Unknown) occurred in "c:\program files\spybot - search & destroy\ADVCHECK.DLL" at address 0x07094F46 by thread 7 "SpybotSD_Scan_Thread".

00:18:17.661: First chance exception 0x0EEDFADE (Unknown) occurred in "c:\program files\spybot - search & destroy\ADVCHECK.DLL" at address 0x07094F46 by thread 7 "SpybotSD_Scan_Thread".

00:18:17.684: First chance exception 0x0EEDFADE (Unknown) occurred in "c:\program files\spybot - search & destroy\ADVCHECK.DLL" at address 0x07094F46 by thread 7 "SpybotSD_Scan_Thread".

00:18:17.716: First chance exception 0x0EEDFADE (Unknown) occurred in "c:\program files\spybot - search & destroy\ADVCHECK.DLL" at address 0x07094F46 by thread 7 "SpybotSD_Scan_Thread".

00:18:17.725: First chance exception 0x0EEDFADE (Unknown) occurred in "c:\program files\spybot - search & destroy\ADVCHECK.DLL" at address 0x07094F46 by thread 7 "SpybotSD_Scan_Thread".

00:18:17.759: First chance exception 0x0EEDFADE (Unknown) occurred in "c:\program files\spybot - search & destroy\ADVCHECK.DLL" at address 0x07094F46 by thread 7 "SpybotSD_Scan_Thread".

00:18:17.797: First chance exception 0x0EEDFADE (Unknown) occurred in "c:\program files\spybot - search & destroy\ADVCHECK.DLL" at address 0x07094F46 by thread 7 "SpybotSD_Scan_Thread".

00:18:17.819: First chance exception 0x0EEDFADE (Unknown) occurred in "c:\program files\spybot - search & destroy\ADVCHECK.DLL" at address 0x07094F46 by thread 7 "SpybotSD_Scan_Thread".

00:18:17.871: First chance exception 0x0EEDFADE (Unknown) occurred in "c:\program files\spybot - search & destroy\ADVCHECK.DLL" at address 0x07094F46 by thread 7 "SpybotSD_Scan_Thread".

00:18:17.937: First chance exception 0x0EEDFADE (Unknown) occurred in "c:\program files\spybot - search & destroy\ADVCHECK.DLL" at address 0x07094F46 by thread 7 "SpybotSD_Scan_Thread".

00:18:17.946: First chance exception 0x0EEDFADE (Unknown) occurred in "c:\program files\spybot - search & destroy\ADVCHECK.DLL" at address 0x07094F46 by thread 7 "SpybotSD_Scan_Thread".

00:18:18.023: First chance exception 0x0EEDFADE (Unknown) occurred in "c:\program files\spybot - search & destroy\ADVCHECK.DLL" at address 0x07094F46 by thread 7 "SpybotSD_Scan_Thread".

00:18:18.044: First chance exception 0x0EEDFADE (Unknown) occurred in "c:\program files\spybot - search & destroy\ADVCHECK.DLL" at address 0x07094F46 by thread 7 "SpybotSD_Scan_Thread".

00:18:18.137: First chance exception 0x0EEDFADE (Unknown) occurred in "c:\program files\spybot - search & destroy\ADVCHECK.DLL" at address 0x07094F46 by thread 7 "SpybotSD_Scan_Thread".

00:18:18.660: First chance exception 0x0EEDFADE (Unknown) occurred in "c:\program files\spybot - search & destroy\ADVCHECK.DLL" at address 0x07094EE8 by thread 7 "SpybotSD_Scan_Thread".

00:18:18.708: First chance exception 0x0EEDFADE (Unknown) occurred in "c:\program files\spybot - search & destroy\ADVCHECK.DLL" at address 0x07094F46 by thread 7 "SpybotSD_Scan_Thread".

00:18:18.737: First chance exception 0x0EEDFADE (Unknown) occurred in "c:\program files\spybot - search & destroy\ADVCHECK.DLL" at address 0x07094F46 by thread 7 "SpybotSD_Scan_Thread".

00:18:18.797: First chance exception 0x0EEDFADE (Unknown) occurred in "c:\program files\spybot - search & destroy\ADVCHECK.DLL" at address 0x07094F46 by thread 7 "SpybotSD_Scan_Thread".

00:18:18.939: First chance exception 0x0EEDFADE (Unknown) occurred in "c:\program files\spybot - search & destroy\ADVCHECK.DLL" at address 0x07094F46 by thread 7 "SpybotSD_Scan_Thread".

00:18:18.969: First chance exception 0x0EEDFADE (Unknown) occurred in "c:\program files\spybot - search & destroy\ADVCHECK.DLL" at address 0x07094F46 by thread 7 "SpybotSD_Scan_Thread".

00:41:05.268: Thread 4 exited with code -1 (0xFFFFFFFF).

00:41:05.277: Thread 5 exited with code -1 (0xFFFFFFFF).

00:41:05.286: Thread 2 exited with code -1 (0xFFFFFFFF).

00:41:05.317: Unloaded "c:\program files\common files\symantec shared\antispam\ASOEHOOK.DLL" at address 0x67320000 by thread 1.

00:41:05.343: Unloaded "c:\windows\system\MSVCR71.DLL" at address 0x7C340000 by thread 1.

00:41:05.353: Thread 1 exited with code -1 (0xFFFFFFFF).

00:41:05.361: Thread 3 exited with code -1 (0xFFFFFFFF).

00:41:05.441: Exited "c:\program files\spybot - search & destroy\SPYBOTSD.EXE" (process 0xFFF5B4F1) with code -1 (0xFFFFFFFF) by thread 7 "SpybotSD_Scan_Thread".

==============

What do you think?

--JorgeA

[georg]

JorgeA -

You wrote: "I've been using Norton Internet Security on that computer since 2003 ...but the problem with Spybot surfaced only years later, in 2008."

I suggest you read the wikipedia entry on Spybot Search and Destroy.

http://en.wikipedia.org/wiki/Spybot_-_Search_&_Destroy

Also google asoehook.dll +oe +"outlook express"

(from your log)

00:41:05.317: Unloaded "c:\program files\common files\symantec shared\antispam\ASOEHOOK.DLL" at address 0x67320000 by thread 1.

asoehook.dll is normal if you have Norton installed. "asoehook.dll is a "Norton AntiSpam OE Hook" "from Symantec Corporation" "belonging to Norton AntiSpam"

All of our work to isolate the interaction only to SSD and Win98 was for naught. Norton insinuates itself into every process and does not reveal itself when running. You have more going on than just the firewall.

I don't think there is anything wrong with your Win98 system files, and advise that you abandon the idea of replacing them one at a time on a trial basis with original files.

(from DW help FAQ)

"It is fairly normal to see errors or warnings during profiling. One common error seen is when one module tries to dynamically load another module (using one of the LoadLibrary functions), but the module is not found. Dependency Walker makes a note of this failure, but if the application is prepared for the failure, then this is not a problem. Another common error is when a module tries to dynamically locate a function (using GetProcAddress) in a module. Again, this is not a problem if the application is prepared for the failure. You may also see first-chance exceptions occur in the log view. If the application handles the exceptions and they don't turn into second-chance exceptions, then this is not a problem. All these cases are normal, and can usually be ignored."

(from DW help How to Interpret Warnings and Errors)

"When an exception (like an access violation) occurs in an application, the application is given a chance to handle the exception. These are known as first chance exceptions. If the application handles the exception, then there should be no problem and the exception can probably be ignored."

"Many applications routinely generate first chance exceptions and handle them. This is not a sign of a bad application since there are many legitimate reasons to generate first chance exceptions and handle them."

At this point I'm going to recuse myself because we are just beating a dead horse. Your original question was: "Does Spybot SD Work on Win98? Do you use it, and how well does it work on your system?"

That question has been fully answered.