slow scan on spybot?

[olemm]

why does spybot do such a slow scan? it did not when i had my computer 3 month ago and it is a good computer.

[spybotsandra]

Hello,

There can be various reasons for this problem. At first, there was a problem with HTT.

We originally thought HyperThreading only existed on P4 processors of 2.8Ghz or higher, but it turned out that there are slower and older processors with that technology. We suspect something like this to be the problem with Spybot-S&D, since several users have indicated they have no problems with Spybot-S&D and HTT. If you are running Spybot - Search & Destroy on a system that has Hyperthreading Technology (HTT) please read the following thread:

Spybot will not complete a scan? http://forums.spybot.info/showthread.php?t=110

Here is another post that might help: http://forums.spybot.info/showpost.php?p=390&postcount=4

Cannot Run Certain Programs on Hyper-Threaded or Dual-Processor Computers with a CPU Speed of Greater Than 2 GHz http://support.microsoft.com/kb/327809/en-us

Could also have something to do with CoolWWWSearch. At this time there is no clear explanation for the CoolWWWSearch.Feat2DLL variant myself, I think there may be malware involved in that one, but it may also be HTT in some cases.

It's fairly obvious at this point that the Central24 and other Dialer hangs are caused by RootKits, often Wareout. There were a couple rare C2.lop/GAIN.Gator hangs early on.

A couple of PCs shutdown or reboot are likely cooling fan problems, especially the laptop. Since we are now aware of the SpeedswitchXP program for mobile CPUs, we have a possible solution for laptops. http://www.diefer.de/speedswitchxp/index.html

I think this summarizes all the major variants we have experienced. If this does not match your problem, please report it to us, so we can soon solve this issue.

Best regards
Sandra
Team Spybot

[Jubilation_T_Corndoq]

On an computer we have, running XP Home SP2, Spybot takes 4 to 6 hours to complete one scan. [Results: 0 problems found (53:54)]

Ad-Aware takes about 20 minutes.

Spy Sweeper takes about 3 hours.

We cleaned some peculiar stuff off of it, and as it is now, the antivirus and spyware progs can find nothing. No spyware, no virii and Hijackthis is squeaky clean.

When we started Spybot would not even install. There were 6 registry keys that it could not deal with and it repeatedly crashed on the first one with an error message that identified what it was trying to write:

SpybotSD.DisableFile
" SBIFile
" SDSFile
" TInfoFile
" UTIFile
" UTSFile

The permissions could not be changed by normal means, but we were able repair that, deleted the keys, and installed Spybot and Ad-Aware.

Following that, both Spybot and Ad-Aware ran but froze (Ctrl-Alt-Delete) when they came to the first of 2 irregular but similar directories:

C:\Documents and Settings\Guest\Local Settings\TEMP\Temporary Internet Files\Content.IE5\

and

C:\Documents and Settings\Owner\Local Settings\TEMP\Temporary Internet Files\Content.IE5\

(The standard TIFs were located and behaved normally.)

Clicking on either of the Content.IE5 directories would instantly shutdown Windows Explorer. So did trying to delete the TIF directories. This made them pretty difficult to deal with.

What we did was rename the TIFs to "XTemporary Internet Files" (that may not have been necessary). Then we cut and pasted them up on directory level at a time. They could not be moved up more than one level each time without crashing Windows Explorer - It appeared that whatever was crashing Explorer didn't have time to react. Once they were on a level with the Recycle Bin we cut and pasted them into it and emptied it.

The remaining TEMP directories cleaned up without any problems.

Then, for the first time we were able to run Spybot (it took 4 hours). There weren't a lot of objects, 200 - 300 perhaps, one or two virii, a dozen Trojans but mostly cookies.

After a couple of virus scans, etc., HijackThis came out pretty clean. Four or 5 baddies that we researched and eliminated. One registry cleaner runs OK but the other one freezes, so, overall it looks pretty good, except it now takes Spybot 6 hours to do one scan. There are no errors but it's awfully slow.

Taking a paranoid view of it, we think some of the garbage was targeting spyware removal programs and Spybot specifically.

Our question: What can we do to speed Spybot up some?

[tashi]

Hi Jubilation_T_Corndoq.


C:\Documents and Settings\Owner\Local Settings\TEMP\Temporary Internet Files\Content.IE5\

(The standard TIFs were located and behaved normally.)

Clicking on either of the Content.IE5 directories would instantly shutdown Windows Explorer.

Normally a hidden folder and infections can hide there.

Spybot-S&D should not be taking so long to scan and yes there is malware that targets security programs.
If spybotsandra's instructions do not apply to you, and as you have deleted keys (by your description the machine was quite infected), we would need to see a log in order to advise.

You could provide the results of a previous Spybot-S&D scan rather than scanning again.

Or we could see a HJT log in the malware forum.
Follow the instructions in this sticky topic to post a HJT log in malware removal.
"BEFORE you POST" -Preliminary Steps (http://forums.spybot.info/showthread.php?t=288) Skip the instructions for Spybot-S&D at the moment.

Start your own thread in the Malware Removal Forum (http://forums.spybot.info/forumdisplay.php?f=22) and copy/paste the HJT log into the topic.

Regards. :)