Spybot freezes at "win32agent.pz"

[e1fletch]

I have been using Spybot for 4+ years and this has never happened. I am using version 1.6. It will not complete a full scan. Program stops dead after 3 or 4 minutes (about 15% through the scan) and the note at the bottom left says "Running bot-check (51291/295344: Win32Agent.pz)" I run Spybot manually every week and immunize, but I do not use teatimer.

I have McAfee Virus scan (& firewall, antimalware, root kits,system guard)- no hits/clean and WinDefender - no hits/clean. However, WinDefender showed a few "warnings" in the Event Viewer (event id 3004) in the last few days about suspicious changes -- c:\windows\system32\drivers\etc\Hosts, also one with a long reg key name ending in "...Internet Explorer\Main\\Startpage."

Can anyone tell me if this is a serious threat and how to get Spybot to work again?

Thanks in advance for any help.

e1fletch

[wyrmrider]

spybot Sandra worked on this problem in this thread
http://forums.spybot.info/showthread.php?t=19884
I DO NOT KNOW IF IT WAS RESOLVED

see post 8 first

quote from post 11

It should also help to deactivate the scanning for usage tracks.
Please run Spybot-S&D and switch to "Advanced mode" via the menu bar item "Mode". Now select "Settings" --> "File Sets" in the navigation bar on the left. The checkboxes in front of "Usage tracking" and "tracks.uti" have to be unticked if you do not want to find usage tracks anymore.

If this does not help please edit the shortcut icon on your desktop that is used to run Spybot-S&D.
Rightclick the icon and choose properties.
Then include a /verbose (with a space tab in front) in it's link location at "Target".
"C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /verbose
To see how to do that please have a look at this link in our forum:
http://forums.spybot.info/showthread.php?t=23560
Or have a look at this how to flash tutorial.
When you do a scan now, it will show an 8 digit number in the status bar at the bottom, like $1234ABCD.
Please post that information here.
They can use this information to look up where exactly it hangs. Thanks.

Best regards
Sandra
Team Spybot
end of copied post

Thread ends there
can you supply the end of the story
thanks

[e1fletch]

Thanks wymrider,
I checked the file sets setting and the Usage tracking boxes were already unchecked before this happened. I would have preferred these to be checked as I rely on Spybot to help remove tracking stuff that I don't want! So that hasn't been happening. I also did an online Kaspersky scan and found 2 Trojans in Outlook Express MessageStore inbox -- "paylap.ev" and "fraud.gen" that neither Spybot or my McAfee virus scan detected. (It also found a lot of "win32" type files related to Logmein and UBCD4Win programs which are probably ok.)

I will run Spybot with the vebose setting to see if it still hangs.

Will let you know.

[e1fletch]

Hello again,
Attempted a Spybot scan again with the /verbose setting. Usage tracking files still unchecked. It still freezes at the same spot. The additional info is $70E19D46. So still can't get more than a 10% scan of my system.

Please advise.

e1fletch

[drragostea]

Good work wyrmrider.

e1fletch,
What version of Spybot-SD are you running (Help>about)?
http://www.safer-networking.org/en/faq/52.html

In addition to the link above, have you attempted to clear the cache, temp. files, and cookies from your browsers (along with the temp. files in the system. If it is locked, attempt a reboot and clear them).

[e1fletch]

last detection update is 9/3/08.

Just ran another McAfee scan -- no real issues. Also SDFix, no problems.
Would still like to have Spybot working again.

Hope that helps.

[honda12]

Hi e1fletch,

How about trying to ignore 'Win32Agent.pz' from scans to see if that makes a difference:

Mode > Advanced Mode > Click 'Yes' > Ignore Products > Select 'Malware.sbi' tab > Scroll down to 'Win32Agent.pz' and check the box

Restart Spybot, then try scanning again


Note. When writing these instructions, I discovered that I had 2 entries listed as 'Win32Agent.pz' - I don't know if this might have anything to do with the problem, but it is strange nonetheless

[e1fletch]

Hello Honda12,
I had already cleared the cache (does so after closing brower) and I clear the temp folders /cookies regularly. So I tried as you recommended clicking to ignore win32agent.pz and Spybot now moves on. BUT, it now freezes at "65880/295344 Smitfraud-C.ul; $3F3E4ECE". Same symptom as before -- it will not complete the scan. Stops dead. If I click on the X it takes several seconds and I get the "Program not responding... do you want to end?" so I have to do that to close Spybot.

I do not want to continue to have it "ignore" malware to make it work -- that defeats the whole purpose of the program. Why is it not identifying and "detecting" these items and finishing the program?

Still wondering what the problem is.
e1fletch.

[e1fletch]

As noted -- still having the problem with Spybot freezing - now just at a different place. I am not the only one having this problem. I was scanning the other sections of the forum and noticed someone else has had this exact same problem. See copy of post below.
E1fletch

The post was in the General forum and I copied it (it is also from yesterday -- 09/05/2008):

Thread: Spybot Locking Up? View Single Post
Yesterday, 09:58 #13
cibrlx01
Junior Member

Join Date: Sep 2008
Posts: 2

--------------------------------------------------------------------------------

i went into settings and noticed that i could uncheck the file win32.agent.pz
after that it kept going until 65880/295344 smitfraud.c.ul


cibrlx01

[AndTheWolf]

E1fletch, I have the same problem you and cibrlx01 have. Each time Spybot stopped I recorded the result, checked the Malware.sbi item, and ran Spybot again, until I was able to complete a scan. The complete set is as follows:

51291/295344;Win32Agent.pz;$70E19D46
65880/295344;Smitfraud-C.ul;$3F3E4ECE
110768/295344;Haxdoor.hm;$31E81190
121359/295344;Win32Agent.frl;$27F1A0FA
264942/295344;ZlobDNSChanger.RTK;$CA1FF945
268743/295344;zlob.rtk;$AE9C4A8E

I have never really looked before, but I'm guessing that the 295344 number changes with each set of updates. If so, it appears that each of us is using the most recent update set. And each of us got stopped at the same first two points. I'll bet that if you kept checking the relevant Malware.sbi items you would have gotten the same results for the remaining four stop points.

I don't think this is happening to everyone or there would be more posts.
I'm using Spybot 1.6.0.30 with last detection update of 9/3/2008 so I think we are both at the same level.

I hope someone with knowledge of Spybot's workings can use this information.