Spybot will not complete scan

[Trapper38]

Lets hope this is the part of the file that you require, spybot was operating and hanging at CoolWeb, though I'm not sure if the snap shot was taken at the correct point.

http://img504.imageshack.us/img504/6...meluckybs8.jpg

[chi-va]

Not exactly but almost I think. I have add some comments in your screen shot. 15:43:14 is the last entry which I can see from Spybot-S&D(red marked process). Your system clock is showing the same time so it is difficult to tell if it is really freezing or not. Please wait at least minutes at the point where you think that Spybot-S&D is freezing. Then take a look again in Filemon. If there are no more Spybot-S&D activity listed then it is really freezing. If you can see more log entries with the Spybot-S&D process then it is not freezing but just scanning slowly.

If it is really freezing then scroll back to the last Spybot-S&D log file entry and please enlarge the frame for the "Path". At the moment I can only see "C:\Documents and Settings\Kenny\Lo...". For locating the file you have to enlarge the frame so that we can read the full path.

P.S.: Posting in the malware removal forum was good because I have found some minor problems in your reports. I hope our experts there will help you as soon as possible.

[Trapper38]

Hope this image is correct, I don't think spybot is freezing actually it just hangs at Coolweb and never completes the scan


http://img129.imageshack.us/img129/5190/73881591rs9.jpg

[chi-va]

Yeah, I'm agree. It seems it is still scanning and not really freezing at Coolweb. Please ensure that there are no files in the temp folder left. The files there are not really necessary so no need to wait for Spybot-S&D to scan them. Just delete them and you will spare a lot of time. Here you can find an instruction for cleaning the temp folder:
http://www.helpwithwindows.com/WindowsXP/howto-16.html

After that please take a look in the temp folder in order to ensure that it is really empty. Sometimes the cleaning does not work correctly which could cause problems. So controlling the folder size couldn't be wrong as well. I have seen systems where no visible files could be found in the temp folder but the folder size was over 1000 MB. Obviously caused by tools which didn't delete the files correctly.

Some system only need 10 minutes for a scan others need much longer. Not need to worry just let it doing its job as long as this is not taking forever. With Filemon you can normally ensure if is hanging freezing or whatever. I hope we was able to clarify that Spybot-S&D is still scanning. Be free to ask me if you need to know something else.

[Trapper38]

Not having much luck with these temporary files. I have been deleting them with Ccleaner, plus IE tools options and via Firefox. Also found a few more with your attachment advice however, the problem still remains

The only thing I can think of is the secure shreader on Spybot, there are never any temp files to bring down and if I then click chop away Spybot does freeze up and then I have to use task manager to end the process. The shredder does work ok for cookie and cache files though. Hope this info' helps a little more.

[chi-va]

Which version of CCleaner do you use? In version 1.41.544 you can analyse the temp files. What size does they have all together? Please only select the temporary system files for the analyse. There several bugs in CCleaners' versions history mentioned which apply to the temporary files. Just in case that there are damaged files left. Please run the tool CHKDSK:

http://support.microsoft.com/kb/315265/EN-US/

A secure tool for deleting files is the tool Eraser:
http://www.heidi.ie/eraser/download.php

Please use it if you have problems to delete the temporary files. It might help if you delete the temporay files in Windows safe mode:
http://www.computerhope.com/issues/chsafe.htm

How long do you have wait before you have cancelled the Spybot-S&D scan? Was it at least 60 minutes?

[Trapper38]

I'm running Ccleaner version 1.41.544 and have set it just to delete temp files, it deleted 476 temp files 2.12MB.

I have run the tool CHKDSK: again, which makes three times in total to no avail.

Spybot has been left running for well over an hour and will not complete.

I have downloaded the eraser tool, but not used it yet. It doesn't look that user friendly at first glance and I don't know how to remove temp files with it? if indeed this is the problem?

[fixet]

Background
Spybot 1.4 worked great for me for a long time untill suddenly I had the below mentioned problems and then Spybot was simply unusable. Nothing in all previous posts would fix this. Other registry scanning programs such as adaware and misc registry cleaners would have the same problems.

Problem
spybot will not complete a scan.
spybot becomes unresponsive and freezes at different points of scan.
system internals freezes during scan.

Solution
1. you will need to download two programs
AVG 7.5 Antispyware (used to be ewido) which is here->http://www.grisoft.com/doc/31/us/crp/0?prd=asw
and Blacklight Rootkit revealer which is here ->http://www.f-secure.com/blacklight/try_blacklight.html

2. a)install and start the avg7.5 antispyware
avg7.5 antispyware will not fix this problem but will simply detect the rootkit in memory before the fix and confirm that the problem is no longer there after the fix. you can keep or uninstall this program when finished.
b) hit the update button and then update by pressing start update..it is pretty much self explanatory
and simply to get most recent definitions of course.
c) then you can hit the scanner button and only need do the memory scan. when the memory scan is complete ( only takes a few minutes or so) there should be a few detections if this your problem.
d)exit avg7.5 antispyware

3. a) run the blacklight rootkit program and get to the scan screen and run a scan. This scan should not take very long as well, maybe 5-10 minutes max. this program will detect the files that are causing the memory problem. in my case it detected one file called csrvu.exe and was located in windows/system32 folder. anyways..click rename and finish and blacklight will rename the file with a different ending.. through explorer find this file and delete it
4. restart computer and run the avg7.5 antispyware memory scan again. there should be no detections and this will indicate fixed.

Spybot and the above mentioned programs now run as they should for the first time in months..I hope this fixes your problem too.

[chi-va]

Are there any reasons why you don't have tried Blacklight yet? It is a small download and the software is still free to try. As written in my first post rootkits could cause that Spybot-S&D don't work correctly as well. This includes freezing or hanging. Please use Blacklight because Filemon is not able to detect rootkits. Apart from a rootkit I don't know what else it could be.

If it is the "Temp" folder then just rename it to "oldTemp" and then create a new folder with the name "Temp" in the same location of the old folder. It is really suspicious that Spybot-S&D open this folder that often even if it is almost empty.

Eraser is simple to use. Start Eraser and then just drag & drop the files/folders which you want to delete.

[Trapper38]

Well, downloaded and ran blacklight, scan was clean. Renamed temp folder and still the same result, no result.