Spybot keeps hanging!

[mandy rhea]

Hello all!

I am running Spybot 1.4 and it keeps hanging during the scan on file 6828. I have uninstalled and removed all spybot files then reinstalled but no luck it continues to hang!

[spybotsandra]

Hello,

Please delete the contents of your Windows temp folder and try it again: For that purpose, please run Spybot-S&D and switch to "Advanced mode" via the menu bar item "Mode". Now select "Tools" --> "Secure Shredder" from the navigation bar on the left. There select "Add files from temp folder" from the drop down menu on the top (hit the small arrow next to templates). Then "Chop it away!"

You can also try the following:
- select "Settings" --> "Settings" in the navigation bar on the left and untick the checkbox in front of "display confirmation dialogs"
- exit Spybot-S&D so the settings are saved
- run Spybot-S&D and "Check for problems" again

Expect it to run slowly, it appears to hang. Please be patient - it should clear with the problems fixed.

If it still doesn't work please select "Settings" --> "Settings" from the toolbar on the left. In the section "Main settings" please untick the checkbox in front of "Create system restore point when fixing spyware/usage tracks".

Best regards
Sandra
Team Spybot

[mandy rhea]

Thank you for responding! I tried all three of the options you gave me and but continues to hang on 6828/41952 coolwwwsearch. I tried letting it run but after about an hour spybot was "not responding".

Is there anything else I can do to resolve this matter?

[spybotsandra]

Hello,

There can be various reasons for this problem. At first, there was a problem with HTT.

We originally thought HyperThreading only existed on P4 processors of 2.8Ghz or higher, but it turned out that there are slower and older processors with that technology. We suspect something like this to be the problem with Spybot-S&D, since several users have indicated they have no problems with Spybot-S&D and HTT. If you are running Spybot - Search & Destroy on a system that has Hyperthreading Technology (HTT) please read the following thread:

Spybot will not complete a scan? http://forums.spybot.info/showthread.php?t=110

Here is another post that might help: http://forums.spybot.info/showpost.php?p=390&postcount=4

Cannot Run Certain Programs on Hyper-Threaded or Dual-Processor Computers with a CPU Speed of Greater Than 2 GHz http://support.microsoft.com/kb/327809/en-us

Could also have something to do with CoolWWWSearch. At this time there is no clear explanation for the CoolWWWSearch.Feat2DLL variant myself, I think there may be malware involved in that one, but it may also be HTT in some cases.

It's fairly obvious at this point that the Central24 and other Dialer hangs are caused by RootKits, often Wareout. There were a couple rare C2.lop/GAIN.Gator hangs early on.

A couple of PCs shutdown or reboot are likely cooling fan problems, especially the laptop. Since we are now aware of the SpeedswitchXP program for mobile CPUs, we have a possible solution for laptops. http://www.diefer.de/speedswitchxp/index.html

I think this summarizes all the major variants we have experienced. If this does not match your problem, please report it to us, so we can soon solve this issue.

Best regards
Sandra
Team Spybot

[JSchmidt]

Hello,

I am experiencing the same identical behavior as mandy rhea. Spybot freezes at 6828/41952 coolwwwsearch. I have tried the same recommended fixes and cannot get it to scan. I tried to reset the Affinity on GPU 0 but it was already the only cpu that was checked. Nothing seems to help get past this point on the scan. Everything worked fine on my old computer but when I upgraded last January, I cannot get Spybot to work right. Sure hope you can help as I really like this program.

James

[JSchmidt]

Information on my computer:
Processor=Intel p4 630 @ 3.0 GHZ
Mem= 1 GB
HD= 160 GB
OS=Win XP Home Edition with all updates

James

[spybotsandra]

Hello,

If you have Spybot - Search & Destroy version 1.3 please upgrade to the newer version 1.4.
If you do already have Spybot S&D 1.4 this is a rare situation that hasn't been explained yet.
But you can do the following to get the scan to work, but you'll have to do it each time you use the program.

- Open Spybot-S&D, then leave it alone
- Open Task Manager, and go to the Processes tab
- Right-click on SpybotSD.exe, and choose "Set Priority..."
- On the box that comes up, check/uncheck boxes so that ONLY "CPU 0" is checked.
- Go back to the already-open Spybot-S&D, and run a scan. It should complete without hanging or losing responsiveness.

This can also be done like this:
Please run Spybot-S&D and switch to "Advanced mode" via the menu bar item "Mode".
Now select "Settings" -->"Settings" from the navigation bar on the left.
Under "Main Settings" you will find the point "Scan priority".
There you should choose "Lower" by ticking the checkbox.

Best regards
Sandra
Team Spybot

[bitman]

spybotsandra,

I'm afraid the specific symptom of Spybot S&D scans hanging at approximately detection 6828 (CoolWWWSearch) has not ever been explained. The exact detection (67 to 6800's) has shifted over time, but as with these two, it's very specific at any moment in time.

The more common HyperThreading (HTT) issue has less specific symptoms of almost random hanging at different points during a scan, though they actually occur most commonly during periods of high processor utilization, which makes sense. Some of these do occur during portions of the CoolWWWSearch group of detections, but not as consistently as it does on these PCs.

This is the only case of several which appeared late in 2005 that has never been explained to my knowledge. All of the others were either RootKit (mostly Pipas.A), oversize temporary files, or the HyperThreading issue already mentioned.

None of my own testing could ever reproduce this specific CoolWWWSearch hang, so I was never able to determine a possible cause. I think the Team needs to look closely at the specific detection invloved to attempt to understand what affects these specific PCs, since in this case it appears to be a complete hang, not simply a delay.

Bitman

[JSchmidt]

I have tried all of these suggestions and it still hangs the same as before. I tried lowering the priority from task manager and no change. I then went to settings in Spybot and lowered the priority there and it still hung. I am thinking that it would work ok if I could get past the coolwwsearch sections.

Thanks for your quick response and suggestions. Can we try anything else?

[bitman]

JSchmidt,

In the short run, I would try to complete the rest of a scan by bypassing the problem detection. The simplest way to do this is to switch to Advanced Mode and turn off either the specific detection, if you can determine that, or the entire section if not.

To do this;

Select Mode Menu > Advanced Mode > answer Yes to the question.
In left pane click Settings > Ignore products
In Right pane click the Hijackers.sbi tab > scroll to detection > check its box
Run a Spybot scan to test

If this doesn't work, try turning off the entire Hijackers.sbi group in Avdanced Mode;

In left pane click Settings > File Sets
In Right pane uncheck Hijackers.sbi
Run a Spybot scan to test

Please post the results here with any additional information you learn.

Bitman

[JSchmidt]

Bitman,

There was no "Detection" option to check on the scroll down. There are, however several coolwwsearch options. So I moved on to your next suggestion. I turned off the entire Hijackers.sbi option and did a scan. This time it hung at 5779/33332: Key spy.

What do you suggest?

thanks

[bitman]

What you needed to find was the detection that causes the hang, which you described only as CoolWWWSearch, but you'll notice there are dozens of these. Only the very first one is named 'CoolWWWSearch' only, so that may be the one involved.

Now that you've determined that other detections later in the scan can cause it though (KeySpy is a Keylogger), things are different than I recall. So let's try to determine how specific the problem is.

First, disable (uncheck) all of the items in the File Sets other than the Hijackers.sbi selection. This way, if it stops on CoolWWWSearch with a different number (these count from 0 only for the detections actually scanned) we know the detection itself is the problem. Make sure you get the exact name of the detection along with any number. Also let us know exactly which set of detections (In Spybot, Help > About) and Spybot version (1.?) you are using, and if you use the Beta Detections.

You could also try this with just the Keyloggers.sbi to determine the same thing about the KeySpy detection. Note there is no space in the name, so you need to be very accurate when you list these specifics. If you wish, you could also disable (check) only the specific detections like KeySpy and see if any other hangs occur in Keyloggers.

What this should do overall is help the Spybot Team determine what is really causing the hang, specific detections or something about timing within the scan process. Then maybe we'll know if it's something about your PC or something in Spybot itself. Most likely it's a combination which is why it hasn't yet been found.

Team Spybot is based in Germany, so we may not hear from them until next week, but anything that you learn and post will be waiting for them early Monday when they return. I'm sure spybotsandra will point this thread out to them since she's also there in Germany. As a member of Spybot Advisors I am based in the US and as a volunteer I have no set schedule.

Bitman

[JSchmidt]

Bitman,
Thanks for your interest. Here are the results I got when I tried your suggestions.

1. I disabled all File Sets other than Hijackers.sbi and it hung at 1574/8649 coolwwsearch.

2. The version I am running is 1.4 and is not beta.

3. I disabled all file sets other than Keyloggers.sbi and it hung at 525/1170 Keyspy.

4. I then repeated step 3 and also disabled Keyspy in Keyloggers and it hung at
661/1170 Probat.

I await further suggestions,

[bitman]

James,

That's very good information, but I don't have any further ideas at the moment myself. Since you don't appear to have a HyperThreading system this would appear to be a problem with these detections as they relate to your system.

You might want to make sure your PC isn't HyperThreading capable, but simply has it disabled as this might also create such problems. The fact that you didn't find the 'Set Affinity' option says that the operating system itself isn't performing using HyperThreading, but maybe the processor is capable of it and either disabled or operating in an unstable manner.

Your processor (http://www.intel.com/support/processors/sb/CS-005958.htm) speed indicates it is new enough to support HyperThreading (http://www.intel.com/technology/hyperthread/index.htm), but that doesn't mean it does. As the link below discusses on its Requirements for Hyper-Threading Technology (http://www.intel.com/products/ht/hyperthreading_more.htm) page, it must also have a chipset and system BIOS that support HTT as well as a supported OS, which current versions of Windows XP Home (http://support.microsoft.com/?id=810231) do.

Hyper-Threading Technology Test Utility (http://www.intel.com/support/processors/tools/htu/)

Since your symptoms don't currently match the 'normal' HTT issue of random hangs in different places during the scan, they appear different, but might still be related since they do move if you force them.

My gut feeling though, is that there is something in common within those specific detections that is triggering the hang and Team Spybot may be able to determine what it is and point towards a possible cause. If they need more information I'm sure they'll request it.

Thanks for performing the tests so far. I hope it will help both you and others resolve this particular hang issue in the long run.

Bitman

[JSchmidt]

Bitman,
Have you had any word yet from Team Spybot on the hanging problem in this thread? Sure hope that it can be fixed so that I can use it.
thanks,

[LonnyRJones]

I see you posted in the waiting thread in our maleware section
Please go here and follow instructions.
http://forums.spybot.info/showthread.php?t=288

Basicly start a thread in the maleware section, post a hijackthis log and an online scan report.
There not here please

[Dr. Winston]

I have experienced all the problems previously talked about in this thread. I have tried all the solutions given and nothing. I am at my wits end as to what to do with Spybot S&D. I think I'll just uninstall it as all it seems to do is take up space and provide no help to me at all. Maybe some day someone will get their act together and make a reasonable program for me and others to use untill bye-bye.