Spybot hangs at end of disinfect on clean machine

[Mike_W]

On a clean system Spybot runs to completion of scan then the window goes all white and the program status becomes "HungApp".

details:
Gateway, 2 yrs old P4
XP Media Center Edition, SP2,
No tea-timer.
After Norton and Spysweeper ran, and were removed (performance stunk).
(Yes, I used the extra Norton removal tool)
(Yes, I then removed the remaining registry entries with autoruns)
I booted UBCD, ran all Anti-malware on UBCD, found some funweb & mywebsearch parts, cleaned up OK.

reboot normal
Added AVG, Spybot 1.6, and AdAware, same process I've done 100's of times.
Adaware & AVG found cookies only, Spybot found some leftover funweb registry entries,
then at end of scan, spybot froze up. No memory, cpu or paging activity, so I killed it.

Re-run, stop after detection, fix problems. OK.
But the scan didn't complete. Every time I let the scan complete, it freezes up and the window turns all or partly white (as-if occluded by another window and not re-freshed) at the end of the scan.

Tried scan at next boot, same effect.
Tried scan in safe mode, admin acct, same effect.
Tried booting into UBCD, and run spybot v1.6 from C drive, completes OK.

Through all this, the "freeze" responds to the "close" command, (top rt X)
and results in Windows "noticing" that the app is being abnormally closed.
Poking into the data about the problem you find it's a "hungapp".

Tried disable all AVG shields and scanners, rerun Spybot
Now it gets through the scan, lists a cookie, say "fix" and
it locks up. The X won't close it, and there's no activity
showing in Task Mgr.

Re-downloaded latest Spybot and AVG, re-installed, no change.

Also ran MalwareBytes, found a few more funweb & myweb bits

Spybot logs:
Checks....txt ends with chai, fennel, mate and tcpipAddress.dll - seems normal

I have one other remote Dell system reported to be acting similarly,
same AVG/AdAware/Spybot mix, but it's at SP3 of XP Home.

So what do I need to adjust so it won't hang?

[Greyfox]

Mike,

Re-run, stop after detection, fix problems. OK.
But the scan didn't complete. Every time I let the scan complete, it freezes up

The normal Spybot "Scan" is completed when it displays any nasties found in Red, or the "Congratulations, no immediate threats were found" messafe, and/or the usage tracks in Green (if scan for usage tracks is set). The next stage is the "Fix" stage. You say it is freezing at the end of the scan, but the above quote seems to indicate it has actually been past this and has fixed the items as well - Can you identify the point where it stops more specifically.

Since the PC it is not actually frozen if you can exit Spybot via the red cross, it may be possible to get a screen shot when the problem occurs.

Tried scan at next boot, same effect.
Tried scan in safe mode, admin acct, same effect.
Tried booting into UBCD, and run spybot v1.6 from C drive, completes OK.

If it worked correctly from the UBCD, then this would suggest it is possibly because it is clashing with something else that is normally running, but is not running when you boot from the UBCD. The fact that it also has the problem when run in safe mode may narrow the field.

I would suggest you start by perhaps fully uninstalling the other spyware product and also the Antivirus, then retest. If that solves the problem, then reinstall them one at a time and see where/if the problem comes back. Obviously stay off line whilst you are without an AV installation.

[Mike_W]

To clarify (new text in BOLD):

Re-run, stop after detection, but before completion of scan fix problems. OK.
But the scan didn't complete. Every time I let the scan complete, it freezes up

but the above quote seems to indicate it has actually been past this and has fixed the items as well - Can you identify the point where it stops more specifically.

When I sit and watch the progress bar, as it hits 100% the interior of the spybot window whites-out, eliminating the text that was there (Hint of the day...) and leaving only white, but responsive to the X.

If it worked correctly from the UBCD, then this would suggest it is possibly because it is clashing with something else that is normally running, but is not running when you boot from the UBCD. The fact that it also has the problem when run in safe mode may narrow the field.

Agreed. I've killed all non-system processes except for AA&AVG, to no effect.
I hesitate to directly blame AA&AVG, since I've over 200 client PC's I've configured exactly this way.

I would suggest you start by perhaps fully uninstalling the other spyware product and also the Antivirus, then retest. If that solves the problem, then reinstall them one at a time and see where/if the problem comes back. Obviously stay off line whilst you are without an AV installation.

Will do.

[Mike_W]

Uninstall AVG, Spybot Completes.
Reinstall AVG, Spybot hangs at end of scan.
200 other PC's this isn't happening.

Any suggestions?
This is a client PC, and overdue to be returned.
Is there anything I can check or submit to help troubleshoot this problem?

[drragostea]

Mike, I recall that there was an issue with slow scanning when AVG's Resident Shields are on, but I can't be sure if this solution will remedy your problem. Can you try disabling the Resident Shields (of course disconnected) to see if it finishes?

[Mike_W]

Tried disable all AVG shields and scanners, rerun Spybot
Now it gets through the scan, lists a cookie, say "fix" and
it locks up. The X won't close it, and there's no activity
showing in Task Mgr.

Re-downloaded latest Spybot and AVG, re-installed, no change.

It gets a little farther in the process, then completely hangs, requiring the proce4ss to be killed instead of just exiting with a "not responding" msg.

[Greyfox]

Uninstall AVG, Spybot Completes.
Reinstall AVG, Spybot hangs at end of scan.
200 other PC's this isn't happening.

This is an example of "They play well together ... mostly!" and the difference between mostly and when they don't is usually a condition particular to the specific machine.

Because this is a client's PC and there are time constraints in returning it, you may not have the time available to track this one down, however I suspect the trigger for the problem is AVG seeing something Spybot is trying to open (or fix) as having a problem it also wants to act on. As you know, during the Spybot scan the AV system is also doing its own thing when files are opened etc.

The trigger could possibly be in the temporary internet files, perhaps a particular cookie, or in one of the browser bookmarks. As I recall the IE browser bookmarks are the last thing to be scanned. You haven't mentioned Firefox so I am assuming the browser in use is either IE6 or IE7.

You could try cleaning out the browser cache and stored cookies and also copying the content of the "Favorites" file to somewhere safe where it won't be scanned (eg a usb flash drive or an external usb hard drive) and then temporarily deleting all of the contents of "Favorites". This can be done quite quickly and at least may narrow down the search.

If Firefox is present and has a lot of bookmarks then the scan of its bookmarks can take quite a while. Again temporarily getting rid of them would be a worthwhile test to narrow down the problem.