Spybot wants to reboot computer and scan again

[DGenerateKane]

Every time I scan when it gets to virtumonde.dll a dialog box pops up and says "It is recommended that you reboot and scan again. If you want to do this, click "Yes", save all open documents and reboot." Why? I chose no but it popped up about 10 more times, got through the scan, removed everything possible and rebooted because some were unable to be removed. During that scan the same box came up again. I don't see how rebooting again and running another scan will change anything personally, but maybe somebody here might have an idea.

[Greyfox]

One could assume that Spybot had found a problem in a file that is in use, and because it is in use, it can't delete it. Agreeing to a reboot lets Spybot start following the reboot ahead of other software, hopefully before the file is used.

But it appears you didn't agree to this, and just manually rebooting your computer later and then allowing all the normal programs to start up again before running another scan is not the same thing.

You can force a scan at system start up by starting Spybot, put it into Advanced mode, then goto settings->settings, scroll down the page until you get to the System Start group, then select "Run program once on next system startup". Now the next time you reboot, Spybot will start early in the sequence and you can scan and hopefully fix your problems.

[DGenerateKane]

That was when I was scanning because spybot was unable to fix everything during a normal scan.

[md usa spybot fan]

DGenerateKane:

What version of Spybot are you running?

Please go into Spybot » Help » About. Make sure you are running the most resent version of Spybot with the latest detection updates:
Spybot - Search & Destroy 1.6.0.30 or above.
Latest detection update 10/8/2008
If not, update or upgrade as appropriate:
The download for Search & Destroy 1.6.0 is available here (http://www.spybot.info/en/mirrors/index.html)
If you are running the lastest version and update of Spybot, try running Spybot in Safe Mode (http://www.laplink.com/support/kb/article.asp?ID=102) and see if that helps with the removal of the problem.

If Spybot still fails to correct the problem consider posting in the Malware Removal (http://forums.spybot.info/forumdisplay.php?f=22) forum and having someone take a look at your system.

If you decide to have an experienced malware removal specialist assist you, please follow the procedure in this link to run scans and produce a HijackThis log: "BEFORE you POST"(READ this Procedure BEFORE Requesting Assistance) ( http://forums.spybot.info/showthread.php?t=288).
After you have completed the required scans and produced the requested logs, start your own thread in the Malware Removal (http://forums.spybot.info/forumdisplay.php?f=22) forum, making sure to post the HijackThis log produced from the above instructions.

[DGenerateKane]

I'll do that as soon as I can. Unfortunately In my repair process I installed SP1 and since can't get back in to windows. As soon as I figure that out I'll post back.

[wyrmrider]

I do not recommend - personal opinion here- installing updates- especially service packs till you know you are clean you might want to roll back get clean and then update all your apps

I DO think that you can IMMUNIZE, run spywareblaster, install a two way firewall (although you might have to uninstall and reinstall later)
remove old java etc- but getting an AP corrupted during installation and if your restore points are bad you could end up reinstalling Windows or reformatting
PS I do not recommend turning off system restore till you know you are clean
an infected restore is better than none at all
Back up
run a rootkit checker

after you know you are clean run secunia software inspector
clean your system, temp, trash can with ccleaner or atf cleaner or by hand
defrag
then turn off system restore and turn it on again
enjoy

comments welcome

[DGenerateKane]

Well I decided just to reformat due to other problems that could not be fixed, so I doubt I will have this problem once I finish.