Spybot error message "recommended reboot and scan again"?!?!?!?!?!?

[Spybotuserr]

Dear SpyBot Forum,

Is the message I received an error with Spybot? I googled and found a few other people had recently had the same message.

Can somebody please offer some advice?

I downloaded the latest spybot definitions today (November 3, 2008) and ran them and received this message "It is recommended you reboot and scan again. If you want to do this click "yes", save all open documents and reboot." I clicked no and stopped the scan.

I am running Spybot 1.6.0.30 and the message appeared when SpyBot was at 200,346/248,822 Virtumonde.sci.

I did the following:
- Complete boot-time scan of all files with latest updated version of Avast Pro 4.8.1229 - ALL CLEAN
- Complete scan of all files with latest updated version of SuperAntiSpyware - ALL CLEAN
- Complete scan of all files with latest updated A-squared - ALL CLEAN
- Complete scan with latest updated ZoneAlarm Pro Anti-Spyware Function - ALL CLEAN
- Scan using Hijackthis analysed with http://www.hijackthis.de/ - ALL CLEAN - NO NASTIES (NO RED CROSSES).
- Complete scan of all files with latest Lavasoft Ad-Aware - ALL CLEAN
- Complete scan of all files with latest updated AVG anti-spyware - ALL CLEAN

I also followed the forum administrator's instructions at http://forums.spybot.info/showthread.php?t=35185 in rebooting and running SpyBot in safemode however the same message appeared at the same time.

I did not press 'fix all entries' after the scan and after further googling came across people who had fixed the entries only to have:
- SpyBot still find the same entries
- Blue screen of death appear on their computer once the scan is finished

Here is my setup:
Windows XP SP3 - Fully updated and patched
Avast 4.8.1229 - Fully updated
ZoneAlarm Pro 8.0.059.000 - Fully Updated
Firefox 3.0.3 - Latest Version
Superantispyware - Fully updated (Note: NOT RESIDENT - ONLY USED ON DEMAND)
A-squared - Fully updated (Note: NOT RESIDENT - ONLY USED ON DEMAND)
Lavasoft Adaware - Fully updated (Note: NOT RESIDENT - ONLY USED ON DEMAND)
AVG Anti-Spyware - Fully updated (Note: NOT RESIDENT - ONLY USED ON DEMAND)
SpyBot 1.6.0.30 - Fully updated for result please read above (Note: NOT RESIDENT - ONLY USED ON DEMAND)

I haven't noticed any abnormal behaviour of my computer, nor have I seen any strange messages etc.

Although I am not a computer expert, I am quite careful and use common sense in web browsing. For example I do not open any email from people I don't know or even emails I am not expecting from people I know.

Can somebody please offer some advice?

Many thanks,

Simon

[spybotsandra]

Hello,

Spybot - Search & Destroy can not delete all files. Some files used by Windows are running in the background. If you would delete these files before the application they are involved in your system would be instable. But if you restart your System Spybot - Search & Destroy can find and destroy them, before they are activated. That is the reason why you sometimes have to restart your system after the scan has finished.

Please send us a complete bug report. In order to do so, please run Spybot - Search & Destroy and switch to Advanced Mode via the menu item Mode, let it scan, try to fix the problems (!) and then go to "Tools" --> "View Report". Tick all the 10 checkboxes (leave "Do not report disabled or known legitimate items" unchecked) you can find there and click on "View Report". Now choose "Export" and save the file to your desktop. Please attach this file to your email and send it again to detections(at)spybot.info. Please refer to this post in your e-mail. Thanks.

Best regards
Sandra
Team Spybot

[PepiMK]

What Sandra meant by that long text is that while you really tried to provide a lot of information, which is commendable, you forgot the important part: the scean results Spybot shows after such a scan, because they allow to see which entries it is talking about.

[Spybotuserr]

Dear Sandra and Pepi,

Firstly thanks for the speedy reply! My apologies for failing to include the scan log.

I am extremely hesitant (and quite scared!) to 'fix all the problems' because:
- My knowledge of Window$ internal settings (eg. registry) is very poor
- I am worried this is a false positive and don't want to damage my system
- In the three years I have used spybot it has only ever found two 'red entries'
- 1. Microsoft Window$ Security Centre.Antivirus Override.
- 2. Microsoft Window$ Security Centre.Firewall Override.
- Avast disabled Nr. 1 and ZoneAlarm Pro disabled Nr. 2 so they are both fine
- I have always just selected 'ignore from future scans' and Windows Firewall is turned off

Also because several other people are reporting the same problem at exactly the same time. This increases my belief that the problem lies with SpyBot.

Moreover all the other anti-virus and anti-spyware products (several!) I tried all came back with clean reports.

I have always liked SpyBot as a product and I'm very grateful for the services of great programmers who offer a wonderful program free of charge! I wonder is there another way I am able to obtain some comfort for the problem described in my first post?

Were I to 'fix all problems' I fear it paves the way for system instability for me and a lot of hours for a newbie like me to repair the damage :-(

Is there anyone else who is experiencing the same problem who has the courage to try Sandra and Pepi's suggested 'fix all problems' solution and submit the log?

Is there any other work-around for me Sandra or Pepi?

I will wait for the Spybot updates today (Wednesday) and try the scan again.

Thanks in advance!

Simon

PS: Sandra - sind Sie Deutsche? :o und aus welchem Bundesland kommen Sie denn her? :D

[Spybotuserr]

Dear Forum,

I have just completed a scan with the latest Spybot updates (from today - November 5) and the error message in my previous post has vanished!!!

So whatever you did Spybot team... thanks! :-)

I neither 'fixed all selected problems' nor changed anything else with my system so it appears my suspicion of a fault with Spybot or a false positive has been confirmed.

Thanks again Spybot forum and team, you do a sterling job and I shall continue to use Spybot in the fight against malware!

I wish you all the best in the future and a great week!

Simon

[antdude]

I am running a scan and it asked the same thing. I never had that before. It started with today's updates. Why reboot? I am only scanning!!

[antdude]

I wonder if this is why with WhyReboot tool from today's updates:

RENAME c:\winstuff\Spybot-S&D\is-JTH7O.tmp to c:\winstuff\Spybot-S&D\Tools.dll

[Spybotuserr]

Dear Antdude,

I'm terribly sorry however due to my lack of computer knowledge I didn't understand that post.

Would you be ever so kind to please repost in layman's terms?

Many thanks,

Simon

[antdude]

Dear Antdude,

I'm terribly sorry however due to my lack of computer knowledge I didn't understand that post.

Would you be ever so kind to please repost in layman's terms?

Many thanks,

SimonDon't worry about it. I was just saying a tool showed that today's updated renamed one of Spybot files. I was wondering if that was causing us to get a reboot message.

[sreed888]

I am still having this problem even after updating today. I have sent in a report as directed above...

[antdude]

I am still having this problem even after updating today. I have sent in a report as directed above...It still happens after a reboot? If so, then I should rescan and try to reproduce it.

[Spybotuserr]

Hello All!

I would recommend checking that you have this version of Spybot:
- Uninstall all older versions of spybot
- Spybot 1.6.0.30 ---> http://www.spybotupdates.com/files/spybotsd160.exe
- Latest Updates from November 5, 2008 (click update once Spyot has loaded and select (tick) ALL updates)

Then try again.

Otherwise just follow the advice of the forum administrators on here. I'm sure they will work it all out.

Good luck!

Simon

[antdude]

I didn't have this message on my other XP Pro. SP2 (not SP3) machine.

[n1ck1985]

Am having this problem now too.

Have emailed the report to the email stated by spybotsandra, but thought I may as well post it here too incase it gets lost in cyberspace.

Cheers -
Nick