Spybot hangs up

[nightowl007]

First off, Spybot is one of the best tools I have ever seen.

The issue I have seen, one many PCs, is once spyware is found, Spybot will 'hang' or report 'Not Responding' when trying to remove spyware (zango, virtumonde, etc).

I have to kill it and rescan and then remove one item at a time, starting with the cookies first, items with only reg entries next and then any issues involving files and directories last (one at a time).

This occurs on newer machines with lots of resources or slower machines.

Any thoughts?

[drragostea]

Clear the cache, temp. files, and cookies from your browsers. ALL the browsers. Have you defragmented your drive lately?

I would suggest you perform a scan when the computer is at minimal activity.

Have you attempted to remove the "entries" in SAFE MODE? The cookies however, you can simply remove them manually by clearing them in the browsers.
--
Also, give some examples of the entries found on the computer. If it's Virtuemonde, it may be persistent to remove, even on 'remove file' on reboot.

[nightowl007]

: Clear the cache, temp. files, and cookies from your browsers.
: ALL the browsers. Have you defragmented your drive lately?

Did that, using Ccleaner, ATF Cleaner as well as removing Temp Internet Files using IE. I have not defragged the drive, but I doubt that would cause the issue I am seeing.



: I would suggest you perform a scan when the computer is at minimal activity.

I do. I normally boot into safe mode and kill every process that isn't needed using task manager.


: Have you attempted to remove the "entries" in SAFE MODE?

Yes. Both in safe and normal mode. Usually safe.

: Also, give some examples of the entries found on the computer. If it's Virtuemonde, it may be persistent to remove, even on 'remove file' on reboot.

I usually see this with Zango or Virtumonde. My experience has been, if I try to remove items with infected 'files' like .DLL or .EXE files, Spybot hangs up.

What I normally do is scan to find the issues and then remove them manually using rmdir /s (Zango, for example) and then let Spybot 'clean' it so it doesn't hang up.

I also have learned that if I unselect all and then manually process each entry one-by-one, it is successful.

Let's hope 1.6 clears this up. It has been an issue for some time (1.52 also had the issue).

And, this occurs on multiple PCs, all Windows XP (home and pro).

[drragostea]

Run a full scan with Spybot-SD 1.6. If it finds Virtuemonde or Zango remove it. If it is persistent, I would suggest you seek help in the Malware Forums.

Also, any signs of a "Zango" toolbar in IE? How about pop-ups?

FYI, Spybot-SD 1.6 was released yesterday. Make sure you upgrade. I think it will resolve your problem about the hanging, however for the malware, I think you may need to seek help if Spybot is unsuccessful in removing it.

Disable SDHELPER and TEATIMER prior to uninstalling. Also undo the immunization.
--
http://www.safer-networking.org/en/howto/uninstall.html
--

Run the 'small fix' after rebooting the computer.