Spybot hangs at "Win32.Wisemop"

[jtaylor678]

I update my files this morning. Search & Destroy is now hanging when it gets to "Win32.Wisemop" I've followed the removal suggestion but do not find any of entries in my registry.

Has anyone else ran into this problem?
Does anyone know how to correct the issue?

[spybotsandra]

Hello,

Which version of Spybot do you run?

Best regards
Sandra
Team Spybot

[frozenJim]

I am having the same problem. Today, for the first time, I see Spybot frozen at "Win32.Wisemop".

I am running Spybot 1.6.2 and have it set to automatically stay updated.

I see at http://forums.spybot.info/showthread.php?p=436488#post436488 that this is a rootkit.

We'll see if restarting Spybot will allow me to remove it.

[user6111111]

I too am having this problem. It occurred after a fresh install of spybot (newest version) and update.

[Kavu2]

1.31.13
Windows XP SP3
SpyBot S&D v 1.6.2

Wisemop mention found here also.

Scaned today w/Spybot S&D v 1.6.2 after updating today.
Scan ran thru...did not hang (to my knowledge) and finished w/no problems shown. However during the scan an 'include errors' popped up:

Includes file C:\Programs\Spybot - Search & Destroy\includes\TrojansC-03.sbi
See include errors log file

Examining the include errors log file within I found this mention of Wisemop.

C:Documents and Settings\All Users\Spybot Search & Destroy\Logs\Include errors log

1/31/2013 12:13:29 PM C:\Program Files\Spybot - Search & Destroy\Includes\TrojansC-03.sbi | Win32.Wisemop (Mutant) [$7438AAEF]

So is it a bad update file? No problems prior to today.

[sawickig]

I spent two hours trouble shooting.
It doesn't matter what version you are using. The software if performing the same search in all of them.

I can't find anyone to contact to tell them about the hang.
Does that make sense?

[spybotsandra]

Hello,

There seems to be a problem with one specific detection rule.
I would recommend to try the following:
Exclude Win32.OnlineGames.ws2 from the scan and try to run another check.

To do so please run Spybot - Search & Destroy in "Advanced Mode" and go to "Settings" -> "Ignore products". There you can tick the checkbox in front of the product you want to exclude from the search.

You might also want to try the scan with the new version Spybot 2.

Sorry for the inconvenience.
We'll try to fix the problem as soon as possible.

Best regards
Sandra
Team Spybot

[spybotsandra]

Update:

One user received a message from Microsoft that it might have something to do with a mousedriver.
So it might also help to disable "Win32.Wisemop".
To make sure it is really this detection rule you can download this handle (http://forums.spybot.info/downloads.php?id=49).
Then search for \BaseNamedObjects\searchup and let us know the results.
Thanks. :)

[Kavu2]

Thanks for the info Sandra...

I d/l the handler and ran a filter for: "\BaseNamedObjects\searchup"
no results came up (blank results). So not sure what that means (good/bad), but I'm guessing it gives an indicator of whether the problem is w/the definition file?...or no?

I did have 2 instances (identical?) for win32.wisemop in the excludes products, both TrojansC-03

Hope this is helpful for your team's diagnosis process.

[ManniAV]

I have the same problem - that various other users reported recently.
Mine appeared this week for the very first time.

Will Spybot fix this?

thanks a lot
Manni

[spybotsandra]

Hello,

The fix should be available with the detection update on Wednesday.

Best regards
Sandra
Team Spybot

[Kavu2]

Thank you and the Spybot team
:thanks:

[user6111111]

Check and see if compatibility mode is enabled. Disabling it fixed the issue for me.