Page 1 of 2 12 LastLast
Results 1 to 10 of 20

Thread: Spybot freezes at "win32agent.pz"

  1. #1
    Junior Member
    Join Date
    Sep 2008
    Location
    Rhode Island, USA
    Posts
    9

    Default Spybot freezes at "win32agent.pz"

    I have been using Spybot for 4+ years and this has never happened. I am using version 1.6. It will not complete a full scan. Program stops dead after 3 or 4 minutes (about 15% through the scan) and the note at the bottom left says "Running bot-check (51291/295344: Win32Agent.pz)" I run Spybot manually every week and immunize, but I do not use teatimer.

    I have McAfee Virus scan (& firewall, antimalware, root kits,system guard)- no hits/clean and WinDefender - no hits/clean. However, WinDefender showed a few "warnings" in the Event Viewer (event id 3004) in the last few days about suspicious changes -- c:\windows\system32\drivers\etc\Hosts, also one with a long reg key name ending in "...Internet Explorer\Main\\Startpage."

    Can anyone tell me if this is a serious threat and how to get Spybot to work again?

    Thanks in advance for any help.

    e1fletch

  2. #2
    Senior Member
    Join Date
    Oct 2005
    Location
    Los Angeles
    Posts
    219

    Default

    spybot Sandra worked on this problem in this thread
    http://forums.spybot.info/showthread.php?t=19884
    I DO NOT KNOW IF IT WAS RESOLVED

    see post 8 first

    quote from post 11

    It should also help to deactivate the scanning for usage tracks.
    Please run Spybot-S&D and switch to "Advanced mode" via the menu bar item "Mode". Now select "Settings" --> "File Sets" in the navigation bar on the left. The checkboxes in front of "Usage tracking" and "tracks.uti" have to be unticked if you do not want to find usage tracks anymore.

    If this does not help please edit the shortcut icon on your desktop that is used to run Spybot-S&D.
    Rightclick the icon and choose properties.
    Then include a /verbose (with a space tab in front) in it's link location at "Target".
    "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /verbose
    To see how to do that please have a look at this link in our forum:
    http://forums.spybot.info/showthread.php?t=23560
    Or have a look at this how to flash tutorial.
    When you do a scan now, it will show an 8 digit number in the status bar at the bottom, like $1234ABCD.
    Please post that information here.
    They can use this information to look up where exactly it hangs. Thanks.

    Best regards
    Sandra
    Team Spybot
    end of copied post

    Thread ends there
    can you supply the end of the story
    thanks

  3. #3
    Junior Member
    Join Date
    Sep 2008
    Location
    Rhode Island, USA
    Posts
    9

    Default Usage tracks were already unchecked..

    Thanks wymrider,
    I checked the file sets setting and the Usage tracking boxes were already unchecked before this happened. I would have preferred these to be checked as I rely on Spybot to help remove tracking stuff that I don't want! So that hasn't been happening. I also did an online Kaspersky scan and found 2 Trojans in Outlook Express MessageStore inbox -- "paylap.ev" and "fraud.gen" that neither Spybot or my McAfee virus scan detected. (It also found a lot of "win32" type files related to Logmein and UBCD4Win programs which are probably ok.)

    I will run Spybot with the vebose setting to see if it still hangs.

    Will let you know.

  4. #4
    Junior Member
    Join Date
    Sep 2008
    Location
    Rhode Island, USA
    Posts
    9

    Default Still freezes at 51291/295344 Win 32 agent.. $70E19D46

    Hello again,
    Attempted a Spybot scan again with the /verbose setting. Usage tracking files still unchecked. It still freezes at the same spot. The additional info is $70E19D46. So still can't get more than a 10% scan of my system.

    Please advise.

    e1fletch

  5. #5
    Senior Member drragostea's Avatar
    Join Date
    Jan 2008
    Location
    @Home
    Posts
    3,674

    Default

    Good work wyrmrider.

    e1fletch,
    What version of Spybot-SD are you running (Help>about)?
    http://www.safer-networking.org/en/faq/52.html

    In addition to the link above, have you attempted to clear the cache, temp. files, and cookies from your browsers (along with the temp. files in the system. If it is locked, attempt a reboot and clear them).

  6. #6
    Junior Member
    Join Date
    Sep 2008
    Location
    Rhode Island, USA
    Posts
    9

    Default Spybot version is 1.6.0.31 also...

    last detection update is 9/3/08.

    Just ran another McAfee scan -- no real issues. Also SDFix, no problems.
    Would still like to have Spybot working again.

    Hope that helps.

  7. #7
    Senior Member honda12's Avatar
    Join Date
    Nov 2007
    Location
    UK
    Posts
    682

    Wink

    Hi e1fletch,

    How about trying to ignore 'Win32Agent.pz' from scans to see if that makes a difference:

    Mode > Advanced Mode > Click 'Yes' > Ignore Products > Select 'Malware.sbi' tab > Scroll down to 'Win32Agent.pz' and check the box

    Restart Spybot, then try scanning again


    Note. When writing these instructions, I discovered that I had 2 entries listed as 'Win32Agent.pz' - I don't know if this might have anything to do with the problem, but it is strange nonetheless
    -honda12

  8. #8
    Junior Member
    Join Date
    Sep 2008
    Location
    Rhode Island, USA
    Posts
    9

    Default ... that works! Now the question...

    Hello Honda12,
    I had already cleared the cache (does so after closing brower) and I clear the temp folders /cookies regularly. So I tried as you recommended clicking to ignore win32agent.pz and Spybot now moves on. BUT, it now freezes at "65880/295344 Smitfraud-C.ul; $3F3E4ECE". Same symptom as before -- it will not complete the scan. Stops dead. If I click on the X it takes several seconds and I get the "Program not responding... do you want to end?" so I have to do that to close Spybot.

    I do not want to continue to have it "ignore" malware to make it work -- that defeats the whole purpose of the program. Why is it not identifying and "detecting" these items and finishing the program?

    Still wondering what the problem is.
    e1fletch.

  9. #9
    Junior Member
    Join Date
    Sep 2008
    Location
    Rhode Island, USA
    Posts
    9

    Default Still freezing - now at Smitfraud.... any help?

    As noted -- still having the problem with Spybot freezing - now just at a different place. I am not the only one having this problem. I was scanning the other sections of the forum and noticed someone else has had this exact same problem. See copy of post below.
    E1fletch

    The post was in the General forum and I copied it (it is also from yesterday -- 09/05/2008):

    Thread: Spybot Locking Up? View Single Post
    Yesterday, 09:58 #13
    cibrlx01
    Junior Member

    Join Date: Sep 2008
    Posts: 2

    --------------------------------------------------------------------------------

    i went into settings and noticed that i could uncheck the file win32.agent.pz
    after that it kept going until 65880/295344 smitfraud.c.ul


    cibrlx01

  10. #10
    Junior Member
    Join Date
    Sep 2008
    Posts
    4

    Default

    E1fletch, I have the same problem you and cibrlx01 have. Each time Spybot stopped I recorded the result, checked the Malware.sbi item, and ran Spybot again, until I was able to complete a scan. The complete set is as follows:

    51291/295344;Win32Agent.pz;$70E19D46
    65880/295344;Smitfraud-C.ul;$3F3E4ECE
    110768/295344;Haxdoor.hm;$31E81190
    121359/295344;Win32Agent.frl;$27F1A0FA
    264942/295344;ZlobDNSChanger.RTK;$CA1FF945
    268743/295344;zlob.rtk;$AE9C4A8E

    I have never really looked before, but I'm guessing that the 295344 number changes with each set of updates. If so, it appears that each of us is using the most recent update set. And each of us got stopped at the same first two points. I'll bet that if you kept checking the relevant Malware.sbi items you would have gotten the same results for the remaining four stop points.

    I don't think this is happening to everyone or there would be more posts.
    I'm using Spybot 1.6.0.30 with last detection update of 9/3/2008 so I think we are both at the same level.

    I hope someone with knowledge of Spybot's workings can use this information.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •