SpywareBlaster: Access Violation Error

Since yesterday, I have been getting this error each time I try to open SpywareBlaster (I do this to look for updates each time I switch my PC on).

"Error: Access violation at 0x771248A4 (tried to read from 0x2E2E2E2A), program terminated."

I notice a lot of problems relating to Spybot updates (I fully uninstalled this over a year ago and have never experienced any SpywareBlaster problems until today).

One observation of my own is that Windows Defender updated yesterday, and I think BOClean did the day before. Could these be the cause(s) of my problem?

Like I said, this has never happened before. I've been using it in conjunction with the above software for as long as I can remember without any trouble.

I would try uninstalling/reinstalling, but I can't get SpywareBlaster to open for me to disable all protection first (as advised here for an uninstall before update: http://www.javacoolsoftware.com/sbupdate.html).

I'm running XP SP3 with NOD32 2.7. Any help would be greatly appreciated.

Thanks.

 

Hi,

If you're just reinstalling the same version, you can do so without first disabling protection. (i.e. I would recommended just uninstalling SpywareBlaster and reinstalling it as a first step.)

Also, would you mind listing all security/privacy programs you have installed? (Examples: anti-virus, anti-trojan, anti-malware/spyware, firewall, cleaning tools, etc.) Anything in addition to NOD32, Windows Defender, and BOClean?

Best regards and thanks,

-Javacool

 

Hi, thanks for your reply.

I just tried the uninstall/reinstall but still got the same error message.

I reinstalled, enabled all protection and then downloaded the updates. The error occurs after downloading the updates (when "verifying database integrity and loading database"), just before the green bar hits the end.

Here are the programs I'm using:

NOD32 2.7
BOClean 4.27
Windows Defender (used on a scan-only basis)
Ad-Aware 2008 (used on a scan-only basis)
Malwarebytes' Anti-Malware 1.31 (used on a scan-only basis)
ATF Cleaner (used to clear temp folders etc before weekly scans)
Windows Firewall

I hope that helps. Thanks again for your quick reply.

 

Hi,

In the folder in which you installed SpywareBlaster (by default, this is C:\Program Files\SpywareBlaster), there are a number of .dtb files. Specifically:

-sbdatabase.dtb
-sbdatabaseinf.dtb
-sbdatabase2.dtb
-sbdatabaseinf2.dtb
-rsdatabase.dtb
-ckdatabase.dtb
-sbinfo.dtb

Could you please e-mail all of those files (in a .zip file, if possible) to: bugreports@javacoolsoftware.com ?

It almost sounds like something is getting corrupted in the updating process, and since I can't reproduce that here I'd like to take a look at the downloaded files which are apparently causing the issue for you.

Best regards and thanks,

-Javacool

 

E-mail sent now.

Good luck!

Many thanks.

 

Hi,

A quick additional question: could you please describe the settings you have configured in Windows' "Regional and Language Options"?

To view them:
1.) Open Control Panel
2.) Ensure "Classic View" is the view you're using.
3.) Double-click on "Regional and Language Options"

I'm particularly interested in:
-All of the settings under the "Regional Options" tab (a screenshot might be easiest)
-The "Language for non-Unicode programs" under the "Advanced" tab

Thanks in advance!

Best regards,

-Javacool

 

Hi,

I'm afraid I haven't received the e-mail yet - did you receive any errors on your end?

(If you tried sending the attachments in a .zip file the first time, could you try sending them individually and unzipped?)

Best regards,

-Javacool

 

Ok, I've just added them to the email (it was still stuck in my Outlook outbox...).

Let me know if you need any more.

Thanks.

 

Damn, I saw your reply too late - sorry. If you would prefer the DTBs separately, give me a shout.

 

Hi,

No worries - got the e-mail.

I'll let you know what I discover.

Best regards and thanks,

-Javacool

 

Hi,

I've duplicated your computer setup (based on the installed programs you mentioned and the regional/language settings), and I can't reproduce the problem (yet).

The .dtb files you sent me are correct. (No corruption - they check out 100%) So at least that seemingly rules out an updating/downloading problem.

I'll likely have to code up a quick debugging version, to try to track down where the problem is occurring. To help me get a handle on where that might be, I have some additional questions:

1. After updating, and SpywareBlaster crashes at the end of the "verifying database integrity" stage, does SpywareBlaster then crash when you try to restart it?
   
   
2. How far does SpywareBlaster get before it crashes on load? (i.e. How far does the green bar get, and what do the lines under "Status" in the main protection table say right before it crashes?)
   
   Example: A normal load of SpywareBlaster results in all of the Status lines changing from "Data loading..." to "X items have protection disabled..."
   
   
3. What types of protection / browsers show up on the main SpywareBlaster protection status table?
   
   Example: The default items that display are "Internet Explorer", "Restricted Sites", and "Mozilla Firefox" (which may or may not be detected).
   
   
4. What browsers do you have installed on your system?

Many thanks in advance!

Best regards,

-Javacool

 

After my reinstall, I'm back at the same stage (but presumably a few updates behind) I was when the problem first arose:

• I load SpywareBlaster;
  
• The green bar shoots across, "Loading Protection" accompanied by the message "Please be patient while SpywareBlaster loads the protection database";
  
• I get the Access Violation error as the green bar is one "block" from the end, just after the IE status changes from "Data loading..." to "0 items have protection disabled...".

I'll answer your questions 2 & 3 together:

The status lines read:

• Internet Explorer - Protection Enabled - 0 items have protection disabled...
  
• Restricted sites - Protection Enabled - Data loading...
  
• Mozilla Firefox - Protection Enabled - Data loading...

In answer to question 4, I have Firefox 3.0.5 and IE7. However, I have been using Firefox as my main browser for approximately one year.

Just for the record, below the status table I can see that the "SpywareBlaster database loaded: 12/20/2008 - 11198 items in database".

Hope this helps.

 

Hi,

Thanks again for the information.

I've sent you an e-mail with a link to a debug build of spywareblaster.exe. While I don't think this one will fix the problem, please let me know if the error message changes (or if it is displayed at a different point).

Best regards and thanks,

-Javacool

 

Hi again.

I've replaced the .exe file with the debug build you sent me, but exactly the same thing happens: same error message at the same point, the green bar gets to the same place, the status lines read identically...

 

Upon checking for SpywareBlaster updates this evening, I clicked Updates in the left navigation panel, then Check for Updates, and immediately got this error message... "Access violation at 0x7722BA97 (tried to write to 0x030B2000), program terminated"

 

Since the last time you successfully checked for updates with SpywareBlaster, have you:
-Upgraded/updated any software (if so, what?)
-Downloaded any Windows updates?
-Changed any computer settings?

Also, what service pack for Windows XP do you have installed?

And, finally, does this happen consistently? Just occasionally? Only once?

Best regards and thanks,

-Javacool

 

Responses in red above. Thank you!

 

Hi,

Thanks for the information.

I think it was more likely the reboot than clearing out your cache & temp files that helped fix things.

I also suspect the problem you encountered is significantly different from the problem that MDJarvis is having.

I set up a test machine reproducing the software combination listed in your signature. On this setup, I am able to reproduce crashes in a number of programs (BOClean, Internet Explorer, SpywareBlaster, and others) - likely because of some combination of hooks that ZoneAlarm Pro, Threatfire, and Avast set. When I'm able to reproduce consistent crashes, only rebooting seems to fix the problem. It seems as though a crash in one program is indicative of general system instability, and it's then more likely that the original program, and others, will crash until the test setup is rebooted.

Also, it appears as though both ZoneAlarm Pro and Threatfire are slowing down registry access. I suspect with just one installed, the effect wouldn't be as noticeable. But with both programs installed and active, side-by-side tests show a slowdown - which varies depending on what type + area of registry access a program is attempting to perform.

I can't say for sure which particular program might be most at fault in this case, but removing ZoneAlarm Pro and Threatfire resulted in a complete inability to reproduce crashes in any of the other programs mentioned above (and significantly faster system performance).

For the moment at least, it might be worth reviewing that particular combination of active programs. (Especially with both ZoneAlarm Pro and Threatfire providing components of "OS-level" protection.)

Best regards,

-Javacool

 

Hi again.

Just wondering if you'd got any further with my own problem?

Thanks.

 

Hey, thanks for all that testing! You're pretty fast!

You installed 5 programs (ZAP, GeSWall Pro, ThreatFire, avast and BOClean) on a test machine, you reproduced crashes in at least 4 programs (BOClean, Internet Explorer, SpywareBlaster, and others), then you removed 2 of the programs (ZAP and ThreatFire) and tested some more, discovered you were unable to reproduce crashes in any of the programs, then came here and wrote that nice long reply with all your findings... in one hour! Whew!

I'm trying to figure out why you had all those crashes with all those programs in one hour when I have been running that combination on two machines for months without any crashes to speak of.

Oh well, I'll let you know if I see that error message again.

 

Hi,

I've been working on a full (new) debug build, to help track down exactly why (and where) the error is occuring on your system.

I hope to have it ready for you shortly.

I installed the latest versions of all programs mentioned, if that helps. (Perhaps you have a slightly older build of one of them installed?)

Also, it's always possible that some facet of the test machine helped exacerbate the problem. (CPU speed/type/quantity, RAM, etc.) I will note, however, that it's often not conducive to system stability to run multiple programs that hook deeply into the operating system - and both ZoneAlarm Pro and Threatfire do so, in fairly intrusive ways. So it's not all that surprising to me that (a) I was able to reproduce crashes with both installed and (b) certain system functions were slowed down noticeably with both installed.

Even if you aren't seeing the easily reproducible crashes on your machine, you might try disabling one of those two programs and see if you notice any speed difference.

Best regards,

-Javacool

 

I run GeSWallPro 2.7.1. Brian just released v2.8 on Jan.4th and v2.81 followed today, I believe. Threads here at Wilders and on the GeSWall forum report lots of problems and instability with these new releases. I've stayed with v2.7.1 until I see what's what. If you installed the latest version, you could have experienced what others are finding?

ThreatFire just went through a "slowdown/failure to connect" issue for users who also ran avast! Web Shield, and TF subsequently released a patched version. So I have recently been running with TF disabled, then enabled, to see if the conflict was indeed remedied. Since the patch release (around the end of November 2008 ), I see no noticable speed difference with TF disabled. Maybe I've just gotten used to it over time. My machines seem fast enough for me.

This all came about because I posted to you about an Access violation error message I encountered while checking updates on your program. You said it isn't related to the OP's problem, but he did encounter an access violation error while trying to update SpywareBlaster, just like I did. I thought at the time that the added info might be of use to you... plus I didn't like the fact that SpywareBlaster was terminated while checking for updates.

I suppose it's a miracle that all of these applications work as well together as they do... when they do.

Thanks for all the help and advice.

 

I wasn't aware just how much TF acts as firewall, but I am starting to realize that with the sensitivity level set on 5 (high), TF acts as a firewall. I know that running two firewalls simultaneously is very bad, and until you posted to me about this, it hadn't sunk in that I might be doing this... even though I don't run the TF protection level that high.

So let me ask you, are you pointing expressly at ZoneAlarmPro as a firewall that should not be run with TF, or are you saying that TF and ANY firewall should not be run together? In other words, is there a firewall that does not hook deeply into the operating system ("in fairly intrusive ways"), that you think would work better with TF? Is it the OSFirewall aspect of ZAP that is hooking deeply?

 

Hi,

Thanks again for your patience, and my apologies for the delay.

I've sent you an e-mail with a link to a new debug build (and instructions). Please let me know what you find - thanks!

Best regards,

-Javacool

 

Hi,

The main potential conflict is not any network firewall components, but the "OS-level" firewall that both ZoneAlarm Pro (through its OS-Firewall component) and Threatfire provide.

My main suggestion was just that it isn't always a good idea to run two or more HIPS / behavioral-blocking / OS-level firewall programs at the same time, because of how they usually have to insert themselves in the middle of things. Both ZoneAlarm Pro's OS-Frewall component, and Threatfire itself, do this - so it might be worth investigating just one of them. (It seems as though it's possible to disable ZoneAlarm Pro's OS-Firewall without disabling all program control + outgoing firewall features, using the Custom settings button. But it's not clear just how thoroughly that disables things.)

Best regards,

-Javacool