Sign in to follow this  
Kyle B

Scan Freezes At Local Registry

Recommended Posts

Along with many others, I am having a scan-freeze problem. Unfortunately, I cannot take a screenshot of the event becasue it locks up my system for a few seconds.

 

I have tried the following:

  • Check Disk
  • Disk Defragmentation
  • Up-To-Date Definitions
  • Up-To-Date Program
  • Disk Cleanup
  • A Registry Cleaner
  • Ad-Aware Settings Properly Changed
  • Attempted Scan In Safe Mode
  • Attempted Scan After CCleaner Has Done It's Job

I have been a user of CCleaner for some time now. More recently, I was having success once I deleted all of my temporary internet files through Disk Cleanup. However, CCleaner does this on a regular basis.

 

At this point, I am stuck. I have tried everything. Shall I post a log file from FilemonNT?

 

Most importantly, I want to remind you that the stalling problem is occuring in the local registry area of my system.

 

I appreciate your support. I will be patiently awaiting your response.

 

Kyle Bilby

Share this post


Link to post
Share on other sites

Come on guys. This has been here for 4 days!!

 

Any help would be appreciated. I've been working on this problem for quite some time, and I'd like to get it fixed pronto.

Share this post


Link to post
Share on other sites

Hello Kyle,

 

I don't think there is a set resolution to the many different causes of this and they haven't been able to reproduce the event in the labs, so we just try a number of things here to see if we can find what is causing it.

 

I see you have done a number of steps, let's rule out any malware in play.

 

1. Can you go to this section here:

http://www.lavasoftsupport.com/index.php?showforum=36

and post a HijackThis log for review?

 

Instructions on creating a HijackThis Log

http://www.lavasoftsupport.com/index.php?showtopic=216

.....................................................

And to rule out any stealth malware (has been the cause in a few cases)

Please generate and post also with your HijackThis log, reports from the following two free tools

 

2. Please download Rootkit Revealer

http://www.sysinternals.com/utilities/rootkitrevealer.html

(link is at the very bottom of the page)

 

Unzip it to your desktop.

Open the rootkitrevealer folder and double-click rootkitrevealer.exe

Click the Scan button (bottom right)

It may take a while to scan (don't do anything while it's running - leave the PC idle during the scan!)

When it's done, go up to File > Save. Choose to save it to your desktop.

Open rootkitrevealer.txt on your desktop and copy the entire contents and paste them here

 

3. Post a report from this tool

 

Download the free beta trial of this tool from F-Secure called Blacklight

F-Secure Blacklight: http://www.f-secure.com/blacklight/try.shtml

Doubleclick on bibeta.exe to run it.

Click the *I accept* button near the bottom of that page.

Download and run blacklite click > scan then > next, next again then exit

there will be a new text file near blacklite.Post it please. The text file is named:

fsbl.xxxxxxx.log (the xxxxxxx stand for numbers)

!!Do not rename any files yet

 

4. After posting those logs in the HijackThis logs section, it might help to see the most current scan log from Adaware that you have? Post that here in this thread.

 

Logs are stored in :

C:\Documents and Settings\USERNAME\Application Data\Lavasoft\Ad-aware\Logs\.

An easy way to get there is to

click Start,

click Run

And type in and press ENTER: %appdata%

then click Lavasoft

then Ad-Aware

and then Logs.

scroll down to find the latest one that you have

(by date & time)

and open it right Click select all

copy and then paste the contents of it here.

(Make sure that all of your Logfile has been posted, sometimes it will require two post's to get it all)

Share this post


Link to post
Share on other sites

That happend to my computer also, the ad aware se freezes, but I found the way out

I run the program blbeta from f-secure, blacklight rootkit eliminator and detected some hidden files that once renamed (an option of such software) and reset the computer, the ad aware se works fine again.

 

This is a log generated afterwards by the blbeta

 

06/16/06 22:57:26 [info]: BlackLight Engine 1.0.37 initialized

06/16/06 22:57:26 [info]: OS: 5.0 build 2195 (Service Pack 4)

06/16/06 22:57:29 [Note]: 7019 4

06/16/06 22:57:29 [Note]: 7005 0

06/16/06 22:57:37 [Note]: 7006 0

06/16/06 22:57:37 [Note]: 7011 1064

06/16/06 22:57:38 [Note]: 7026 0

06/16/06 22:57:39 [Note]: 7026 0

06/16/06 22:58:03 [Note]: FSRAW library version 1.7.1015

06/16/06 23:01:43 [info]: Hidden file: c:\Program Files\CyberLink DVD Solution\PowerDVD\cltest.exe

06/16/06 23:01:43 [Note]: 10002 1

06/16/06 23:05:11 [info]: Hidden file: c:\WINNT\system32\cscdb.exe

06/16/06 23:05:11 [Note]: 7002 32

06/16/06 23:05:11 [Note]: 7003 1

06/16/06 23:05:11 [Note]: 10002 1

06/16/06 23:05:11 [info]: Hidden file: c:\WINNT\system32\dmehx.exe

06/16/06 23:05:11 [Note]: 7002 32

06/16/06 23:05:11 [Note]: 7003 1

06/16/06 23:05:11 [Note]: 10002 1

06/16/06 23:05:12 [info]: Hidden file: c:\WINNT\system32\favset.exe

06/16/06 23:05:12 [Note]: 7002 2

06/16/06 23:05:12 [Note]: 7003 1

06/16/06 23:05:12 [Note]: 10002 1

06/16/06 23:05:13 [info]: Hidden file: c:\WINNT\system32\filesafer23.exe

06/16/06 23:05:14 [Note]: 10002 1

06/16/06 23:05:18 [info]: Hidden file: c:\WINNT\system32\howiper.exe

06/16/06 23:05:18 [Note]: 7002 2

06/16/06 23:05:19 [Note]: 7003 1

06/16/06 23:05:19 [Note]: 10002 1

06/16/06 23:05:35 [info]: Hidden file: c:\WINNT\system32\pppcgm.exe

06/16/06 23:05:35 [Note]: 10002 1

06/16/06 23:05:47 [info]: Hidden file: c:\WINNT\system32\sphlp32.exe

06/16/06 23:05:47 [Note]: 10002 1

06/16/06 23:06:32 [info]: Hidden file: c:\WINNT\system32\wbem\wbemtest.exe

06/16/06 23:06:32 [Note]: 10002 1

06/16/06 23:25:56 [Note]: 7007 0

 

I checked on the net and found that all are malware refered with the Power DVD exception.

:)

Share this post


Link to post
Share on other sites
That happend to my computer also, the ad aware se freezes, but I found the way out

I run the program blbeta from f-secure, blacklight rootkit eliminator and detected some hidden files that once renamed (an option of such software) and reset the computer, the ad aware se works fine again.

 

This is a log generated afterwards by the blbeta

Hi Darius,

 

That is the wareout/unspyPC pest and there may be additional fixes needed for that one. Could you please post your Adaware Scan log and a Hijackthis log into your own new topic in this section here:

http://www.lavasoftsupport.com/index.php?showforum=36

 

Instructions on creating a HijackThis Log

http://www.lavasoftsupport.com/index.php?showtopic=216

 

How to post an Adaware log:

As Logs are stored in :

C:\Documents and Settings\USERNAME\Application Data\Lavasoft\Ad-aware\Logs\.

An easy way to get there is to

click Start,

click Run

And type in and press ENTER: %appdata%

then click Lavasoft

then Ad-Aware

and then Logs.

scroll down to find the latest one that you have

(by date & time)

and open it right Click select all

copy and then paste the contents of it here.

(Make sure that all of your Logfile has been posted, sometimes it will require two post's to get it all)

Share this post


Link to post
Share on other sites

As an older PC user who is really just a novice, is there any way to fix this problem that is simple? Because my SE gets frozen and I can't run a system check.

 

Like I said, I am really very new to all this.

 

 

 

 

 

 

Hi Darius,

 

That is the wareout/unspyPC pest and there may be additional fixes needed for that one. Could you please post your Adaware Scan log and a Hijackthis log into your own new topic in this section here:

http://www.lavasoftsupport.com/index.php?showforum=36

 

Instructions on creating a HijackThis Log

http://www.lavasoftsupport.com/index.php?showtopic=216

 

How to post an Adaware log:

As Logs are stored in :

C:\Documents and Settings\USERNAME\Application Data\Lavasoft\Ad-aware\Logs\.

An easy way to get there is to

click Start,

click Run

And type in and press ENTER: %appdata%

then click Lavasoft

then Ad-Aware

and then Logs.

scroll down to find the latest one that you have

(by date & time)

and open it right Click select all

copy and then paste the contents of it here.

(Make sure that all of your Logfile has been posted, sometimes it will require two post's to get it all)

Share this post


Link to post
Share on other sites

CalamityJane, I have done all that you've asked for. I greately appreciated the step-by-step instructions y'all give - you're great!!

 

However, for some odd reason (I believe this is due to reinstalling the program and still not being able to successfully complete a scan) I do not have one Ad-Aware SE log file in the described location.

 

You can find my logs here.

 

Thanks again!

Share this post


Link to post
Share on other sites

I began to have similar problems after installing an updated version of Spy Sweeper. When I turned it off, no problems.

 

Wish I'd read your post first, embargo! Turned out to be my problem too. I shut my Spy Sweeper down temporarily, and AdAwareSE ran perfectly. (But it is nice to know I haven't got any rootkits.) :P

Share this post


Link to post
Share on other sites

I began to have similar problems after installing an updated version of Spy Sweeper. When I turned it off, no problems.

same thing happended when i downloaded new version of spysweeper,,,and fixes yet besides turning off spysweeper

Share this post


Link to post
Share on other sites

I am having a freeze problem as well whenever I try to do a scan in the administrator sign on in XP. I have been able to do a smart scan while in a non administrator sign on.

 

This problem seemed to arise only after I downloaded the latest version of Spy Sweeper 5.0.5. Is there any connection or is this just a co incidence?

 

Thanks

Share this post


Link to post
Share on other sites
This problem seemed to arise only after I downloaded the latest version of Spy Sweeper 5.0.5. Is there any connection or is this just a co incidence?

 

Thanks

Yes, you need to turn off Spysweeper during a scan with Adaware or it causes the freezing. Reported in these threads (and maybe more)

 

http://www.dslreports.com/forum/remark,16483017

http://www.lavasoftsupport.com/index.php?showtopic=1456

http://www.lavasoftsupport.com/index.php?showtopic=1077

http://www.lavasoftsupport.com/index.php?showtopic=1751

http://www.castlecops.com/t161489-Spy_Swee...Aware_Scan.html

 

Reportedly also causing problems with:

Mcafee av

SuperAntiSpyware

Norton av

Share this post


Link to post
Share on other sites

I began to have similar problems after installing an updated version of Spy Sweeper. When I turned it off, no problems.

can u please tell me how the hec do u turn off web root sypr sweeper 5.05 help me please

Share this post


Link to post
Share on other sites

Hi:

I too encountered the scan freeze after updating Spy Sweeper to 5.0.5.1286. The freeze occurred on "Running Processes" scan. When I shut down Spy Sweeper the Ad-Aware scan ran to completion.

A previous post asked how to shut down Spy Sweeper. Right click the Spy sweeper icon in the notification area (right side) of the system tray and choose shut down. Start it again from Start > All programs > Webroot > Spy Sweeper

 

Frank C

Share this post


Link to post
Share on other sites

LS SteveJ, LS CalamityJane

 

I'm confirming that after updating and installing my Webroot Spy Sweeper to 5.0.5 (build 1286) last week, Ad-Aware SE Pro kept freezing up. I followed all the listed suggestions as well as reloading a new copy from your web site with no new result. I did, however, read a suggestion in the support forum to disable Spy Sweeper and the scan now works, but only with Spy Sweeper disabled. Please send out a fix with one of your updates.

 

Thanks

Share this post


Link to post
Share on other sites

GT Wags:

Don't you think that Spy Sweeper should provide the fix? Ad-Aware ran fine before their last update.

Besides, we are paying for Spy Sweeper and Ad-Aware is free. I sent a problem report to Spy Sweeper

Regards

Frank C

Share this post


Link to post
Share on other sites
I also started to freeze up when I shut down the computer. It happened a couple of times so i ran Avert Stinger in safe mode and the shut down problem has disappeared.

I have written Webroot customer Support abiout the Ad Aware scan issue and am waiting to hear back. I had a similar problem the last time Spy Sweeper was updated. Last time there was a conflict with SpyBot. But after a few days Webroot created a solution and sent out an upgrade so I hope they will do the same with this conflict with Ad Aware.

Windsurf

Share this post


Link to post
Share on other sites

Glad I checked in here - had the same problem with locking up till I followed comments and turned off Spy Sweeper 5.05.1286

 

Will have to send comments to WebRoot to see what they say.

Share this post


Link to post
Share on other sites

Hi all, thanks for the confirms that turning off SpySweeper to scan with Adaware resolves the problem.

 

This is not something caused by Adaware so it is not something we can "fix" from this end. It is SpySweeper's blocking shield in the new version (part of their shielding technology) that causes Adaware (and other security programs) to "hang"

 

LS SteveJ was able to duplicate this behavior and his explanation upon initial analysis was posted here:

http://www.dslreports.com/instant/1227122/16500072

The latest version of Spysweeper seems, on initial analysis, to be blocking memory read access to certain modules as part of its shielding technology. This means that in all probability, applications calling ReadProcessMemory on any of the processes / modules that SS is shielding, will hang... This seems to be the case with Ad-Aware, as it hangs when reading the memory of loaded windows dlls... There are some more posts about this on the Lavasoft Support forums. As I understand it, the problem has been reported to Webroot. This problem seems similar in nature to the Symantec Anti-Tamper protection which some applications, including Ad-Aware have been having problems with.

//Steve

It is the same concept with other shielding type programs that block certain things. SpywareGuard for iinstance has settings to "block" changes to the browser and homepage, etc. When you have that program set to block those things, then other other programs cannot change those either. The workaround is, if you want to scan with Adaware, temporarily shut down SpySweeper during the scan so that Adaware can complete. Then re-enable your SpySweeper program. When you are using multiple security programs with block behaviors this will be something you have to keep in mind.

Share this post


Link to post
Share on other sites

Hi:

At the risk of beating this topic to death - I want to post the text of the poblem report that I sent to Webroot and their reply. Now, I will patiently await a fix and, in the meantime, stop Spy Sweeper for the duration of the Ad-Aware Scan.

Frank C

 

Problem Reported to Webroot - Frank C July17 @1:59PM EST

There is a conflict between the new Spy Sweeper version 5.0.5.1286 and Lavasoft Ad-Aware SE Personal 1.06 r1. If Spy Sweeper is running when an Ad-Aware scan is executed, Ad-Aware stalls on “Running Processes�.

If Spy Sweeper is stopped, Ad-Aware runs to completion.

This did NOT occur before the latest Spy Sweeper upgrade.

This has also been reported in the Lavasoft Support Forum, “Scan Freezes At Local Registry� . http://www.lavasoftsupport.com/index.php?s...43&hl=freez

 

Problem response from Webroot Tues July 18 @5:18 PM EST

Solution:

Unfortunately, there is a conflict preventing Ad-Aware from scanning while Spy Sweeper is running. We are in communication with Lavasoft to find a solution for the issue. In the mean time, you will simply need to shut down spy sweeper when scanning with Ad-Aware. I apologize for any inconvenience.

Share this post


Link to post
Share on other sites
THANK GOD for this forum!!!!!!! thanks for the advice you guys about spy sweeper, it worked!!!!!!

\

 

Ditto big face.

 

Since the hang does not occur while Win Defender , Spybot , or Trendmicro Int Sec are running, it proves that Spy Sweeper is at fault.

Share this post


Link to post
Share on other sites
Sign in to follow this