Problem with spybot and files in use

[dminliberty]

My spybot scan works just fine and detects a number of pieces of malicious software that needs to be removed. I check the boxes for the software I want removed and Spybot attempts to remove them. It finishes the removal and check marks the ones it did remove and tells me that it couldn't remove all of them due to a file being in use and then asks me if it would be ok to run spybot again the next time I reboot. I answer yes and the next time I reboot, spybot starts up and goes into a scan. It again detects the same malicious software and I again attempt to remove them and again it tells me it can't because of files being in use. It's a vicious cycle. I've attempted to go into task manager and kill all the processes that might be holding a file with no luck. Is there someone out there who might offer me a solution to this never ending cycle? How do I find what is holding the file that spybot needs to complete it's mission?

[spybotsandra]

Hello,

What are the items named that you are trying to fix?

Please run a scan in safe mode:
http://www.computerhope.com/issues/chsafe.htm
That should fix it.

Best regards
Sandra
Team Spybot

[dminliberty]

deleting-dup message

[dminliberty]

I've tried running in safe mode but I get the same results. The items it can't fix due to the fact that the associated files are still in use (in memory) are 180Solutions.SearchAssistant, ABetterInternet, CAS-Client, GAIN.Gator, GJeans30, MediaMotor, NewDotNet, and SmitFraud-C. If I click the + to the left of the item it does show me the file in use.

Here's an sample from the log:
--- Search result list ---
GJeans30: Executable (File, fixing failed)
C:\WINDOWS\Uninst2.htm

GJeans30: Executable (File, fixing failed)
C:\WINDOWS\Unist1.htm

ABetterInternet: Data (File, fixing failed)
C:\WINDOWS\ISSM0064.DAT

CAS-Client: Data (File, fixing failed)
C:\WINDOWS\jptc.dat


Apparently these items start up prior to being in safe mode. Is there a way I could start spybot before this in the boot up sequence? I get the same results if I try running spybot on the next boot or running in safe mode.

[spybotsandra]

Hello,

Could it be that you are running an old version of Spybot, like 1.3?

Best regards
Sandra
Team Spybot

[dminliberty]

I'm running 1.4.

[spybotsandra]

Hello,

Please download the new Spybot - Search & Destroy 1.5 Release Candidate 1.
This should fix it.
Here is the download link:
http://www.safer-networking.org/files/beta/spybotsd15.exe

Please do not forget to update afterwards.

If this doesn't solve the problem please send us your *complete* Spybot bug report: Run Spybot - Search & Destroy and switch to Advanced Mode via the menu item Mode, let it scan, try to fix the problems (!) and then go to "Tools --> View Report". Tick on all of the 10 checkboxes (leave "Do not report disabled or known legitimate items" unchecked) you can find there and click on "View Report". Now choose "Export" and save the file to your desktop. Please attach this file to your email and send it again to detections(at)spybot.info.

Best regards
Sandra
Team Spybot

[dminliberty]

Version 1.5 did seem to solve the problem. However, I did run into a problem in the "fix the problems" step in that it told me there was a memory issue and had to quit. I only have 512mg of memory on this particular machine. I have another machine with more memory that was having the same issue that I will try 1.5 on. It did resolve most of the problems.