Spybot asks to reboot and run again in mid-scan?

[gabespc]

Was this a new feature included in today's update?

In the middle of scanning, I'm getting a message box saying:
"It is recommended that you reboot and scan again. If you want to do this, click "Yes", save all open documents and reboot."

This is not necessarily a bad thing... but I clicked NO about 25 times in a row before I got bored and quit counting.
And to make matters worse, all scanning appears to come to a halt until you happen to notice it's waiting for you to answer it.

Is there a command line switch or some way to make it not do this?
I don't like to sit and babysit Spybot while it runs... I like to start it, go do something else, and have it waiting for me to click Remove when I come back.

[Oni_2K]

Same problem here. Is getting rather irritating...

Anyone know why this is happening?

[129260]

I have never experienced this....

1.) when did this start to occur?

2.) at what items was it scanning at when it asked you that question?

3.) what operating system are you running? Spybot version? thanks.

4.) does safe mode do it as well?

[donald]

Virtumonde infestation. Probably enough said.

When Spybot finds it on the machines I'm working on, that comes up in mid-scan. If you read the sidebar, it said removal requires disconnection from the internet and rebooting.

Not sure when this started for Spybot. I've just recently come across some Virtumonde infested machines, so it's all new to me.


It seemed to ask me that reboot question during the entire Virtumonde sections of scanning. Seems to be several: program/bho, dll and screensaver, so far that I've noticed, all begin "Virtumonde.xxx" in the status line).

Thankfully, I'm only dealing with XP SP 2 systems.

Yes, I do get it in Safe Mode. as a matter of fact, Virtumonde is loaded somehow in Safe Mode. I haven't read all the history on it in the forums (new user), but from what I've seen, that's normal for this bug.

I, too, found it irritating, because from the message, I don't understand if I'm to reboot now or if I can continue scanning and reboot later. Also, do I go ahead with fixing the things found so far, or am I supposed to do that on reboot as well. It just says to save my work and reboot.

The first few times, I stopped the scan and fixed what was found then rebooted. It definitely helped those systems and I started the scans over again. In my case, all scanning is done from Safe Mode until I find it clean. THEN I reboot normally and scan some more, just in case. (Overkill? I think not! :P)

HTH,
Donald

[129260]

you might want to consider posting in the malware removal forum to make sure your system are clean. Please be patient as these are volunteer helpers.

Also read this before you post.

Not necessary, but if you would like to make sure you are clean, that is something you can do.

Unless another member has a solution, it seems that the first and second poster experienced an infection that needed to be removed immediately, and a reboot was needed asap. (as soon as possible) When the message was given the reboot is recommended to be done at that time, because some infections are time critical, giving out personal information to someone, etc.

As for the third poster: Same as above statement.

[Ronin77]

I have encountered this problem today for the first time in a particularly nasty infection by Antivirus XP 2008, which used installation tactics I haven't seen before. Rebooting did nothing to help Spybot, which kept stopping at the same spot. I finally just said "No" and continued scanning.

Virtumonde was not detected by Spybot or any other scanners. Eset detected and cleaned a number of trojans. Which promptly returned as soon as I connected to the Internet.

AntiVir turned up the same trojans along with 7 hidden files and 6 hidden registry keys. After removing the hidden keys and files via UBCD, the infection has not returned, however, I still get that cryptic message when running Spybot.

Can anyone confirm that Spybot is actually generating this message? Is it possible that this is a malware ploy to get the user to interupt the scan and reboot? -- Allowing an opportunity for virus components to re-install? I noticed that the message seems to pop up at the same percentage of completion, although since cleaning the infection, it now stops at a different exploit name...

Thanks!

[Ronin77]

P.S. to above --

I completely uninstalled and reinstalled Spybot three times during this process, deleting the installation folders as well. The third time was after successfully cleaning the infection -- and yet this symtom persists, even though other scanners are showing the system as clean.

[wunderwood]

P.S. to above --

I completely uninstalled and reinstalled Spybot three times during this process, deleting the installation folders as well. The third time was after successfully cleaning the infection -- and yet this symtom persists, even though other scanners are showing the system as clean.

I have been seeing this same problem and finally googled around to see if someone had an answer. I have tried rebooting as requested, but that did nothing. I have tried not rebooting and letting the scan complete. So far I am at a loss as to what's up.

I have used a few different antivirus programs in an attempt to get this resolved but I am stuck so far. Anyone else found a solution to this? If it is virtumonde.dll, how do I remove it aside from reformatting the machine?

[Spybotuserr]

Dude,

See my thread here ---> http://forums.spybot.info/showthread.php?t=35981

Same problem happened to me, solved by downloading the latest updates from last week and scanning again.

If the message occurred when it was scanning for Virtumonde around 200,346/248,822 then it is most likely a false positive.

Several people have also reported experiencing exactly the same problem at the same time which to me reinforces the false positive.

Good luck!

Simon

PS: Follow the directions of the Spybot Admin Team only in here!!!

[haakman]

Yesterday Spybot still asked me halfway during scanning to reboot and scan again, although I updated it immediately before the scanning. The dialog asked if I wanted to reboot and scan again YES of NO. When clicking on Yes, a blue screen appeared before my computer restarted. Then I scanned again, and at the same place (Virtumonde) I got the same message. So I answered Yes again, got a blue screen before rebooting and scanned again.
When I got the Yes/No message this time I answered NO and Spybot continued scanning, and did not find any threat. I don`t understand. Who does?