Spybot freezes at "win32agent.pz"

[AndTheWolf]

I temporarily replaced the Spybot folder in Program Files with one from my last hard drive backup (with detection updates to 8/27 I think). I got stopped at Haxdoor.hm, and I know I ran a complete scan with the backed up version last week, so it is NOT just the detection updates.

[honda12]

@ e1fletch - Thanks, the aim of ignoring the product causing the problem was to highlight if it was a specific detection problem or a wider problem. I think the latter is the case

Unfortunately, I can't help any further, I don't have the knowledge of Spybot's 'inner' workings

It would be better for a member of Team Spybot to assist you further

Thanks

[e1fletch]

AndTheWolf,
Thanks for pointing this out. I thought I would try to ignore the same 5 items and see if I could get Spybot to finish, but I do not have the exact same items under "Malware.sbi". For instance, I have 2 Smitfraud -- Smitfraud-C.Antifirewall and Smitfraud-C.Deskbar -- but not a Smitfraud-C.ul to check to ignore under Malware.sbi. Also, I have a Haxdoor.Ki, but not a Haxdoor.hm in Spybot under Malware.sbi. And no Zlob* entries. Are these under a different tab?? I want to identify if I can "ignore" the exact same items and get it to finish. That might help the Team Spybot folks figure this out.

... awaiting any feedback.

e1fletch

[AndTheWolf]

My error, e1fletch. I had to kill Spybot and restart it many times during my test, and did not realize that I was using the "All products" tab after my first cycle. (I think because I found "Win32Agent.pz" on my first restart I assumed that "Ignore Products" was opening at the last used tab and did not even notice I was on "All products".) "All products" contains, i think, every entry on the other tabs in collated order, so though it is a much longer list, it is easier to use when looking for a specific entry than trying to work out which specific tab it belongs to. Try looking there. Let me know how it goes.

Unchecking the five items is temporary workaround, not really satisfactory. I'm hoping someone from the the Spybot team can use the information for diagnostics.

Since not everyone has the problem (three people who posted, and an unknown number who have not found the forum), I wonder what we have in common. How often to you run a Spybot scan? I usually run mine weekly. Do you know of any changes to your system between you last successful scan and the scan that froze on Win32Agent.pz?

[e1fletch]

Hi AndTheWolf, By the way, your list has SIX item (my mistake, not 5) Yes, I am trying to figure out what has caused this. I also run Sbybot about 1 time per week. I was running it on 9/5 or 9/6 when this happened.

I was very concerned that I might have gotten a Trojan and I can't afford to lose my desktop system. As I just now look back over the past week, I notice in EventViewer that WinDefend showed a warning on 9/3 that it "took action to protect this machine from spyware or other potentially unwanted software". The EV note did not have much info, so I just went to Defender and looked what could have been quarantined. It is a an entry called "RemoteAccess:Win32/RemotelyAnywhere". It says "if you do not trust the publisher consider blocking or removing the software" -- so I'm not sure what it did! I am not sure if this has ANYTHING to do with Spybot hanging, it is just something that has not showed up before..

i will keep looking , but it is a bit distressing that of the SIX tems that SPYBOT hangs on on both of our system, FIVE of them are trojans. Yet my McAfee says I have no threats, SDFix said I had no threats and MalWareBytes (yes I have even run that) says there are no hits. Only an online Kaspersky scan showed something, and it of course did not give me any info on how to remove. I would feel a lot better if SPYBOT would actually RUN, even if it detects nothing.

..still hoping TEAM SPYBOT will help us figure out how to get SPYBOT to work again

e1fletch

[spybotsandra]

Hello,

It hangs at a NTFile rule, so it seems that the advcheck.dll could not be found.
Probably you have installed the new version 1.6 in a different folder and the registry points to an old folder.

Editing the registry should help.
regedit:
HKEY_CURRENT_USER\Software\Safer Networking Limited\SpybotSnD\

Under path you have to enter the file path for the 1.6 version, which you will get from the desktop link.

Best regards
Sandra
Team Spybot

[AndTheWolf]

THANK YOU Spybotsandra!! That was the problem. I'm guessing the registry got rewritten when I was trying to created a UBCD4WIN CD that included the Spybot plugin (When I tried to configure the plugin it tried to update the plugin to 1.6, and failed, but it did rewrite that registry key to "E:\UBCD4Win\plugin\AntiSpyware\Spybot\files\" .

e1fletch, I notice you referred to UBCD4WIN earlier in this thread. Perhaps that is the source of your problem too.

[e1fletch]

... but it was not that I updated Spybot in a new folder -- 1.6 was in the same directory as the previous version: C:\Program Files\Spybot - Search & Destroy\. And advcheck.dll was there.

Last week I was using UBCD4Win (Ultimate Backup CD for Windows) to try and create a bootable cd with the operating system. It uses plugins for other software to run spyware/virus checks if your computer cannot boot from your hard drive. Apparently, in creating such a disk and running it from the cd drive, it went to update Spybot and changed the registry entry regarding the location path. That apparently was the cause. It looks like this was also the problem for some others on this thread.

Thanks again for the help!!!! Spybot is working fine now. It is a great program and you have terrific folks on this forum.

e1fletch

[wyrmrider]

I was going to suggest a SAFE MODE scan
but under this scenario it would not complete either
I think PepiMK gave the details about moving folders in a post somwhere

The way I remember it the format between 1.3 -1.4 and 1.5-1.6 changed
this is why I recommend a complete uninstall and use of the removal tool
(search for "small fix" or see the stickie on removing Spybot
when upgrading Spybot
upgrading by writing over 1.5 with 1.6 should work but many do not remember all the prior versions they have had

The last two updates have been huge
Spybot has been finding malware missed by other well known apps
good work - but also a good reason to keep updated

(did I get the above anywhere close to right?)

[davepjcx]

spybotsandra,

I too also experienced the same symptoms as the other poster in this thread, after reading your answer mentioning UBCD4WIN, I checked my registry setting and the path was pointing to C:\UBCD4Win directory. I changed it to match the path from the desktop link and the scan now continues. Thanks for a great solution..

davepjcx