Page 2 of 2 FirstFirst 12
Results 11 to 18 of 18

Thread: Spybot stuck on initial scan when it finds Win32.Qhost.ahnj

  1. #11
    Member of Team Spybot (m/f)'s Avatar
    Join Date
    Feb 2006
    Posts
    274

    Default

    Sorry to be that late to clarify: It does not mean you have it on your system, Spybot just scans your system for Win32.Qhost.ahnj. It works like this:

    we got rules like: Look for a file that size in that folder with parameters 1,2,3 (just an example, of course)

    Now if the specified folder contains many files, every file has to be checked for the size, if there are many files of that size, every file has to be checked for the parameters. Each check takes time, that means: the more files, the more checks.

    Win32.Qhost.ahnj rules contain many folders, many sizes. -> many checks, long time to scan.

    I hope that helps understanding
    (m/f)

  2. #12
    Junior Member
    Join Date
    Jan 2017
    Posts
    1

    Default Same problem

    Quote Originally Posted by (m/f) View Post
    Sorry to be that late to clarify: It does not mean you have it on your system, Spybot just scans your system for Win32.Qhost.ahnj. It works like this:

    we got rules like: Look for a file that size in that folder with parameters 1,2,3 (just an example, of course)

    Now if the specified folder contains many files, every file has to be checked for the size, if there are many files of that size, every file has to be checked for the parameters. Each check takes time, that means: the more files, the more checks.

    Win32.Qhost.ahnj rules contain many folders, many sizes. -> many checks, long time to scan.

    I hope that helps understanding
    Hi, yes I have the exact same problem for nearly a month now. I have let the program run for 14 hours without passing Win32.Qhost.ahnj, previously a scan would take around 3 hours so I would conclude that there is possibly a glitch in your otherwise excellent program. I ran the Semantic Win32.Qhost.ahnj remover program which ran for around two hours and then just disappeared, so I have no idea if it found anything or not, but spybot still froze on the same place!
    I have now just put Win32.Qhost.ahnj on the disregard list as you suggested and it has now moved past the position that it previously froze.
    regards

  3. #13
    Junior Member
    Join Date
    Apr 2017
    Posts
    2

    Default Same issue

    Quote Originally Posted by (m/f) View Post
    Sorry to be that late to clarify: It does not mean you have it on your system, Spybot just scans your system for Win32.Qhost.ahnj. It works like this:

    we got rules like: Look for a file that size in that folder with parameters 1,2,3 (just an example, of course)

    Now if the specified folder contains many files, every file has to be checked for the size, if there are many files of that size, every file has to be checked for the parameters. Each check takes time, that means: the more files, the more checks.

    Win32.Qhost.ahnj rules contain many folders, many sizes. -> many checks, long time to scan.

    I hope that helps understanding
    Yesterday I had to kill Spybot while it was stuck on Win32.Qhost.ahnj as the "Stop scan" button did not work. So on the third time, I decided to just let it run.

    How many days should I let this run before shutting the scan down?

    ps. I have been infected with a very, very new rasomware that has yet to complete on anyone's PC that I know of so there is never a hint at which variant.

    Files all keep their native extension and there are Chinese characters left in .txt files that form a sentence.

    The executable was wswposys.exe. I have posted some details and an encrypted file at :
    https://www.bleepingcomputer.com/forums/t/645501/new-ransomware-infection;-no-note-id-ransomware-cannot-identify/

    One other guy has had the same issue also with no ransom note.

  4. #14
    Member of Team Spybot tashi's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    30,446

    Default

    Hello Hankt,

    Quote Originally Posted by Hankt View Post
    Yesterday I had to kill Spybot while it was stuck on Win32.Qhost.ahnj as the "Stop scan" button did not work. So on the third time, I decided to just let it run.

    How many days should I let this run before shutting the scan down?
    There is nothing to gain by letting the scan run for days, especially if your computer is infected with ransomeware.

    Best regards.
    Microsoft MVP Reconnect 2018-
    Windows Insider MVP 2016-2018
    Microsoft Consumer Security MVP 2006-2016

  5. #15
    Junior Member
    Join Date
    Apr 2017
    Posts
    2

    Lightbulb

    Quote Originally Posted by tashi View Post
    Hello Hankt,


    There is nothing to gain by letting the scan run for days, especially if your computer is infected with ransomeware.

    Best regards.
    With numerous hits on this virus profile causing Spybot to either actually freeze or appear to freeze, would it be possible to put a little more detail in the user interface for files being scanned? Maybe then it would be easier to decipher a long-running, highly detailed virus scan from a state where Spybot has stopped working.

    Thanks,

    Hank

  6. #16
    Member of Team Spybot tashi's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    30,446

    Default

    Hello Hankt,

    Quote Originally Posted by Hankt View Post
    With numerous hits on this virus profile causing Spybot to either actually freeze or appear to freeze, would it be possible to put a little more detail in the user interface for files being scanned? Maybe then it would be easier to decipher a long-running, highly detailed virus scan from a state where Spybot has stopped working.
    "Win32.Qhost.ahnj" is a Trojan, the scanner shows the items Spybot is checking for in its database.

    Which edition of Spybot do you have please.

    https://www.safer-networking.org/private/

    Best regards.
    Microsoft MVP Reconnect 2018-
    Windows Insider MVP 2016-2018
    Microsoft Consumer Security MVP 2006-2016

  7. #17
    Member of Team Spybot roberto's Avatar
    Join Date
    Oct 2005
    Posts
    59

    Default Update is scheduled for 2017-05-10

    Hello Hankt,

    I could reproduce this behaviour. So we have updated the detection signatures for "Win32.Qhost.ahnj". The new rules should solve your scanning problem. We will publish this update on 2017-05-10.

    Kind regards,
    Roberto.
    Please help us improving Spybot and download our distributed testing client.

  8. #18
    Member of Team Spybot tashi's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    30,446

    Default

    Thank you roberto.
    Microsoft MVP Reconnect 2018-
    Windows Insider MVP 2016-2018
    Microsoft Consumer Security MVP 2006-2016

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •