Problem with SpyBotSD 1

[sggaunt]

Just ran Spybot and it detected Backweb-lite (I recently got a new camera) and 'n-case'
Then the scan stopped with an error and message to remove the n-case stuff problems at reboot
At reboot the scan commenced then stopped again, I checked the registry for 'salm' and found a folder, this has now gone but spybot still wont complete a scan.
Does anyone know why spybot wont run correctly is the 180 search assistant still there and breaking it?

This artical seems to suggest that its not so easy to get rid of.
Uninstall 180 search assistant 16 pages of this!!




Steve:
A Delphi Programmer
A Feersum Endjinn indeed

 

[dsimpaired]

I would try downloading spysubtract from intermute and also sysclean from trend micro, these two have been saving me lately...

http://www.intermute.com/products/spysubtract.html

http://www.trendmicro.com/download/dcs.asp

 

[LloydSev]

maybe try MS AntiSpyware?

Works on Win2k and WinXP.

Computer/Network Technician
CCNA

 

[sggaunt]

Dosnt work on XP + 0 which is what I have

Steve:
A Delphi Programmer
A Feersum Endjinn indeed

 

[LloydSev]

That is incorrect.

Microsoft AntiSpyware works on Windows 2000, Windows XP, and Windows 2003 Server.

Here are the system requirements for MS AntiSpyware:

http://www.microsoft.com/athome/security/spyware/software/requirements.mspx

And here is the homepage for it:

http://www.microsoft.com/athome/security/spyware/software/default.mspx

Computer/Network Technician
CCNA

 

[sggaunt]

Sorry to argue but it only supports XP SP1 and SP2.
It dosnt run on my sytem, I tried it.




Steve:
A Delphi Programmer
A Feersum Endjinn indeed

 

[LloydSev]

When was the last time you tried Windows Update?

Computer/Network Technician
CCNA

 

[tazuk]

Steve

Have you run an HijackThis scan against the problem machine?
Analyze the log here and post it here for confirmation before acting on the analyzer's suggestions.

HTH

TazUk

Blue-screening PCs since 1998

 

[sggaunt]

Tazuk

My HiJack thi9s log show no new entry since the last clear scan.
I downloaded and ran the spysubtract evaluation it found some spyware but removed it, and now scans clear.
AdAware No Spyware.
I downloaded sysclean first run detected a leftover from SDBot file.
but subsiqunt runs (1 in safe mode show no problems)
AVG no detections.

This is the exact message I get from SpybotSD

Red triangle with message
Xuron55 The process cannot access the file C:\windows\win.ini
If I exclude Xuron55 (spyware) from the scan I get the same message at Carbrotor (Trogen)
If I exclude this same message at Interfun(Keylogger)
If I exclude that same message at Coolwebsearch (we all know what this is however The coolwebsearch tool show no infection.







Steve:
A Delphi Programmer
A Feersum Endjinn indeed

 

[sggaunt]

Hmm, I ran the log analyser tool and it said there was a problem with a hosts file(01 entry), hijack this wouldn't delete it (IE browser was still open at this time) when I close HiJack this and camme off the net this entry was gone,
still checking an address entry its not sure of.



Steve:
A Delphi Programmer
A Feersum Endjinn indeed

 

[sggaunt]

After a lot of tests (systematically excluding things from SpyBotSD) this is what I think is happening
If the following threats are excluded from the scan it will compelete.
Xuron55 (spybot)
Carbotor
Redlable
Mulitibinder
win32.Optix.c (Trogens)
Interfun (Dialer)
Coolwebsearch (Hijacker)(don't know which variant to many to exclude one by one I suspect any)

But I dont think any of these are present, what I think is happening is that something is stopping SpyBotSD from scanning win.ini (or sys.ini) and all these nastys modify this file (win.ini seems normal)
I discovered that I cannot open win.ini, when spybotSD is open in fact I cant open any file. Shut down SPybotSD and access is restored.




Steve:
A Delphi Programmer
A Feersum Endjinn indeed

 

[tazuk]

Apologies for delay in replying Steve - got tied up trying to update a friend's website.

Which version of Spybot are you running? If it's v3.1 final there is a patch for various Spybot problems which may have an impact on INI scanning (at least according to some of the threads I've looked at on other forums). The TX patch can be found here.

HTH

TazUk

Blue-screening PCs since 1998

 

[sggaunt]

Thanks Tazuk. Yes It is 3.1. Downloading now, the machine in question is not here, so I cant try this until tonight.


Steve:
A Delphi Programmer
A Feersum Endjinn indeed

 

[BadBigBen]

Hi there,

@tazuk - newest version of SpyBot S&D is at present 1.4RC2b (

http://fileforum.betanews.com/detail/Spybot_Search_and_Destroy/1043809773/1)

still considered BETA but runs smooth and clean...

@sqquant - yes, do update, the probs could also be part of a hangup, when it attempted to clean the nasties upon bootup... besides that you may wish to do a clean install of SpyBot S&D...



Ben

If it works don't fix it! If it doesn't use a sledgehammer...

 

[tazuk]

BigBadBen --

Yeh I'm aware of the newest version of Spybot thanks.

As yet I haven't had the time to install / test it on my sacrificial laptop, so didn't suggest it here as I tend not to recommend installs of anything I haven't tried and tested personally.

TazUk

Blue-screening PCs since 1998

 

[sggaunt]

tazuk
That patched version scans right through without any problems (I did remember to put the exclusions back!!)
Do you know anything about the history of this version?


Steve:
A Delphi Programmer
A Feersum Endjinn indeed

 

[tazuk]

Steve -

A (very!) high-level description of the patch is here.
I've been running the patched version for some time, so it must have been out for a while. I believe it's a quick fix for a bugs in Spybot relating to DSO Exploit detection and scanning, with a library update included.

It's probably worth a scan with an online scanner like (my current favourite BitDefender) if you haven't done so already, just for peace of mind.


HTH.

TazUk

Blue-screening PCs since 1998

 

[BadBigBen]

@tazuk - thought to point it out, just in case you or others did not know this...



Ben

If it works don't fix it! If it doesn't use a sledgehammer...

 

[tazuk]

Sure np BadBigBen - I must get round to playing with it once I've got a chance.

TazUk

Blue-screening PCs since 1998