SpywareGuard 2.2 crash & burn

I'm receiveing the following error:
Runtime Error -2147024770(8007007e)
Automation Error
The specified module could not be found

This is a W2K SP4 environment with MSIE5.5, Norton AV (2003) and Star Downloader v1.42. The contents of the SpywareGuard directory are:
SGBHP.EXE v 2.2.0.1 8-29-03
SGMAIN.EXE v 2.2.0.1 8-29-03
SGLIVEUPDATE.EXE v 2.2.0.1 8-28-03
DLPROTECT.DLL v 2.2.0.0 8-2-03
SPYWAREGUARD.DLL v 2.2.0.0 8-2-03
CONFIG.INI 1-7-04 2935 bytes
DEF1.DTB 1-7-04 15900 bytes
DEF2.DTB 1-7-04 10202 bytes
DLBDATA1.DTB 1-7-04 9317 bytes
DLBDATA2.DTB 1-7-04 9814 bytes

My MSVBVM60.DLL file is v 6.0.96.90 and the rev date suggests that it is part of the SP4 package.

I ran MS Dependency Walker on the individual modules and nothing was detected as missing.

The crash is not always immediate but will happen within a minute. I noticed with Taskinfo that after the crash that SGMAIN is still running but with minimal hooked modules and the system tray icon is gone. Restarting does not help. Rebooting does not help either.

So what's next?

 

Re:SpywareGuard 2.2 crash & burn

Hi tgm,

I knew I had seen it before: https://www.wilderssecurity.com/showthread.php?t=13217

Can you check if it helps to disable the Browser Hijack Protection?

Regards,

Pieter

 

It appears that I'm having the same problem, my symptoms are the same. Similar to this other user, I'm unable to disable Browser Hijacking Protection from the GUI where the process crashes immediately when I attempt to save it.

Can this be disabled in the registry? I notice there is a key HKLM\Software\SpywareGuard\Settings\BHOProt. This is a binary value that is currently "FF FF".

For some further info... I was looking a both filemon and regmon (www.sysinternals.com) while some of this taking place and I noticed that in the midst of things that explorer was looking for an application object via msvbvm60.dll with the id 4c8cc155-6c1e-11d1-8e41-00c04fb9386d and failing. This object does not exist in my registry. Some serching around the internet suggests that it may be related to data streams. Also my MDAC version is 2.7 SP1 and the environment has been validated with MDAC checker.

 

Hi tgm,

I hope that information will help Javacool in his quest for a solution.

I'll make sure he reads this thread.

Regards,

Pieter

 

I'm still looking and I found some info that may or may not be impacting things. The clsid 4c8cc155-6c1e-11d1-8e41-00c04fb9386d that I mentioned in my previous post is an NTFS "feature" called Alternate Data Streams. They are new to me so I won't try to explain them but I found a reference to their functionality, see http://neworder.box.sk/blog.php?newsid=9765 Also a search of "Alternate Data Streams" with your favorite search engine will point you to more but the clsid will not generally be mentioned in the articles.

This clsid is NOT in my registry, and I'm wondering if it was ever there or was removed as part of a security patch, bot scan, etc. I have another W2K machine and this clsid is not there either, but both machines have had similar security scans, patching, etc performed on them.

I'm wondering if the lack of clsid definition in the registry is causing this failure with SpywareGuard?

 

Hi tgm,

The two computers you searched for that CLSID, are their file-systems FAT32 or NTFS ?

Regards,

Pieter

 

Both of them are NTFS.

 

OK. That's one theory out the window.

I hope Javacool will be able to help you.

Regards,

Pieter

 

Hi and thanks for the detailed bug report.

Would it be at all possible for you try SpywareGuard on the other W2K machine? I'd be very interested to see whether you receive the same error there (if you don't, we'll be able to rule out a general problem with Windows 2000, and can instead focus on the problem machine - if the error does occur it may point to a general W2K problem with SpywareGuard, although I've had many users report success on W2K, or just something different about the way those two machines are configured).

Also, on the machine where the error occured, is it a clean W2K install, or an upgrade from a previous version of Windows (maybe NT4?)? Can you think of anything else - perhaps highly restrictive system security - that could potentially be the cause or a contributing factor?

Thanks,

-Javacool

 

Re: SpywareGuard 2.2 crash & burn

I'm having the same run-time problem with Windows XP SP2, although the browser hijack function works fine, I'm not able to disable it within options, it gets this error when I try to save teh setting.

 

Re: SpywareGuard 2.2 crash & burn

Guess I should check my spelling before posting...now I feel like such a noob... :-D

 

Re: SpywareGuard 2.2 crash & burn

Ok, I'm registered now...