Spybot will not complete scan

[Trapper38]

It keeps stopping at 6052 CoolWWWSearch and will not complete a scan

I have tried various solutions, all of the suggestions on this thread and it still won't compleate a scan.

http://forums.spybot.info/showthread...reezes+coolwww

Also I have tried a clean reinstall, this made no differance either.

I'd be grateful if someone would help me fix this problem. thanks

[chi-va]

Please try my suggestion:
http://forums.spybot.info/showthread.php?t=17397

[Trapper38]

Please try my suggestion:
http://forums.spybot.info/showthread.php?t=17397

Thanks for your response. I've tried your first suggestion and File mon will not open , it keeps on saying that this file is already in place, do you want to replace it and then whichever choice I make nothing happens.

[chi-va]

Do you have extracted the download before? Please always post the exact error message because this makes it easier to find out from where it comes. A screen shot could help as well. My problem now is that I don't know exactly if this is something that is reported in the Filemon log or if this is an error message that you couldn't start Filemon.

If this is a Filemon starting error then please try the
tool Process Monitor.
http://www.microsoft.com/technet/sys...ssmonitor.mspx

It is a package which contains Filemon as well. You haven't posted any information about your system yet so I hope that you use a system that is supported in Process Monitor. If this tool didn't work as well even if it is supported then we have a really serious problem. Without any logs it is almost impossible to tell you where the problem is.

If Filemon does actually work(see Filemon screen shot in the previous link) then please tell us where(which files) the problems are(probably access denied messages?). This could give us a hint which processes could block the access.

Apart from that, you should try the rootkit tool as well. Hiding files is only one of tricky rootkits features.

Last but not least please also poste a Hijackthis log in the malware removal forum:
http://forums.spybot.info/showthread.php?t=288

Please follow Tashis' instructions but skip the part about Spybot-S&D. Seeing some system information is always helpful.

[Trapper38]

Managed to download and Filemon working now, screen shot enclosed.

Also do still need me to post Hijackthis log in the malware removal forum?

[Trapper38]

I think I made an error with the previous screen shot and it's too small to read.

http://img209.imageshack.us/img209/4642/untitledzm5.jpg

[md usa spybot fan]

Trapper38:

It would probably be easier to interpret the output if you saved it to a file, zipped (archived) the file and attached that to a post.

[chi-va]

Hello Trapper38! Good work! Now we can read it but I'm afraid it is still not what we want to see. Do you agree Md usa spybot fan? Thank you for joining us!

Or was this already the point where Spybot-S&D was freezing? As long as you can see that Spybot-S&D is opening something then it is still scanning. By regarding your screen shot the last entry is telling me that Spybot-S&D has sucessfully close the last opened file/directory. So it is unlikely that this is the point where Spybot-S&D was freezing. With other words I'm looking for the last entry of Spybot-S&D during a scan which does not change even after more than 5 minutes.

P.S.: I'm agree that a log file of Filemon does help but this is not necessary here. Apart from that Filemon creates awfully long log files. So I prefer posting the last Spybot-S&D entries or just make a screen shot of the last Spybot-S&D entries. By the way, if you have found it please enlarge the frame for "Path" in Filemon so that we can see the full entry of it.

P.P.S.: Posting in the malware removal forum is not necessary yet. Maybe later. Do you already have tried Blacklight?

[Trapper38]

Thanks for your reply. Sorry, I did post a log in the malware forum before getting this latest reply.

I have not tried backlight , also I'm not really sure exactly what you require concerning Spybot entries, if you could explain please.

[md usa spybot fan]

chi-va:

I agree that if Filemon is going to help reveal the cause of the problem, the file system activity by SpybotSD immediately prior to the hang is the most important. From the location of the vertical scroll bar and the count of the entries displayed, I don't believe that the screen shot was of the file system activity by SpybotSD immediately prior to the hang.

Trapper38:

Please try again. After the SpybotSD scan hangs and before you take any action to terminate the process, make sure that you are still at the bottom of the Filemon listing before taking the screen shot.

ps:

chi-va:

I also hope that a screen shot of the last activity displayed will actually be the last file system activity by SpybotSD. I have noted in the past that Filemon (and Regmon as well) has a tendency to skip the recording of portions of activity from fast running processes. Although the entry number of the output generally reflects this skip of it occurs in the middle of a process, you can not tell if it happens at the end of a process.

pps:

Trapper38:

Thanks for taking the time to try and help determine the cause of the problem. Many people look for a quick fix and aren't willing to expend an effort to find that fix.