Spybot asks to reboot and run again in mid-scan?

[gabespc]

Was this a new feature included in today's update?

In the middle of scanning, I'm getting a message box saying:
"It is recommended that you reboot and scan again. If you want to do this, click "Yes", save all open documents and reboot."

This is not necessarily a bad thing... but I clicked NO about 25 times in a row before I got bored and quit counting.
And to make matters worse, all scanning appears to come to a halt until you happen to notice it's waiting for you to answer it.

Is there a command line switch or some way to make it not do this?
I don't like to sit and babysit Spybot while it runs... I like to start it, go do something else, and have it waiting for me to click Remove when I come back.

[Oni_2K]

Same problem here. Is getting rather irritating...

Anyone know why this is happening?

[129260]

I have never experienced this....

1.) when did this start to occur?

2.) at what items was it scanning at when it asked you that question?

3.) what operating system are you running? Spybot version? thanks.

4.) does safe mode do it as well?

[donald]

Virtumonde infestation. Probably enough said.

When Spybot finds it on the machines I'm working on, that comes up in mid-scan. If you read the sidebar, it said removal requires disconnection from the internet and rebooting.

Not sure when this started for Spybot. I've just recently come across some Virtumonde infested machines, so it's all new to me.


It seemed to ask me that reboot question during the entire Virtumonde sections of scanning. Seems to be several: program/bho, dll and screensaver, so far that I've noticed, all begin "Virtumonde.xxx" in the status line).

Thankfully, I'm only dealing with XP SP 2 systems.

Yes, I do get it in Safe Mode. as a matter of fact, Virtumonde is loaded somehow in Safe Mode. I haven't read all the history on it in the forums (new user), but from what I've seen, that's normal for this bug.

I, too, found it irritating, because from the message, I don't understand if I'm to reboot now or if I can continue scanning and reboot later. Also, do I go ahead with fixing the things found so far, or am I supposed to do that on reboot as well. It just says to save my work and reboot.

The first few times, I stopped the scan and fixed what was found then rebooted. It definitely helped those systems and I started the scans over again. In my case, all scanning is done from Safe Mode until I find it clean. THEN I reboot normally and scan some more, just in case. (Overkill? I think not! :P)

HTH,
Donald

[129260]

you might want to consider posting in the malware removal forum to make sure your system are clean. Please be patient as these are volunteer helpers.

Also read this before you post.

Not necessary, but if you would like to make sure you are clean, that is something you can do.

Unless another member has a solution, it seems that the first and second poster experienced an infection that needed to be removed immediately, and a reboot was needed asap. (as soon as possible) When the message was given the reboot is recommended to be done at that time, because some infections are time critical, giving out personal information to someone, etc.

As for the third poster: Same as above statement.

[Ronin77]

I have encountered this problem today for the first time in a particularly nasty infection by Antivirus XP 2008, which used installation tactics I haven't seen before. Rebooting did nothing to help Spybot, which kept stopping at the same spot. I finally just said "No" and continued scanning.

Virtumonde was not detected by Spybot or any other scanners. Eset detected and cleaned a number of trojans. Which promptly returned as soon as I connected to the Internet.

AntiVir turned up the same trojans along with 7 hidden files and 6 hidden registry keys. After removing the hidden keys and files via UBCD, the infection has not returned, however, I still get that cryptic message when running Spybot.

Can anyone confirm that Spybot is actually generating this message? Is it possible that this is a malware ploy to get the user to interupt the scan and reboot? -- Allowing an opportunity for virus components to re-install? I noticed that the message seems to pop up at the same percentage of completion, although since cleaning the infection, it now stops at a different exploit name...

Thanks!