Problem Please help

[kjs]

I downloaded the Microsoft AntiSpyware and it has been
working great up until yesterday. I opened the software
and for some reason my daily scans were turned off and my
computer had not been scanned in 3 days. I turned it
back on and ran a scan.

It got almost all the way through and my computer just
restarted all on its own. I tried it several times and
it would get to that certain point and restart.

It goes so fast I can't see what file it stops on.

Anyone have a suggest or hopefully a cure???
..

 

[Ron Kinner]

It is also possible that you picked up some malware that
AntiSpy is choking on. Get HijackThis.exe from
http://tomcoyote.org/hjt/hjt199//HijackThis.exe

Save it to C:\hjt (new folder) then Open it and select
Scan and Save Log. Note where you saved the log then
send it to me as an attachment. Put Hijack in the subject
so I'll know it's not spam.

Ron Kinner
Microsoft MVP 2004 & 2005
(e-mail address removed)


PS I can also help you read your minidump

 

[kjs]

Everytime I try to save that file it shuts my pc down.

 

[Bill Sanderson]

I changed the settings and got the blue screen but it didn't tell me
anything. It just asked if I installed anything new and the last thing I
installed was the Microsoft Spyware. Anyhow, I then did a reboot in safe
mode. It found the following and didn't crash: Marketscore.Internet
Accelerator. I deleted it. I also ran my Spybot after that and it found 4
that Microsoft didnt' find: Avenue A. Inc, Double Click, Marketscore adn
Media Plex. I ran my Yahoo spyware and it found 2 viruses: Win32.Dyfuca.A
and Win32.Dyfuca.M.
--------------------------------------------------------------------
Good work. Spybot found cookies that Microsoft Antispyware doesn't scan
for. The viruses are important, though--in a situation with an unknown
"problem" of some sort, I'd always recommend doing both antivirus and
spyware scanning. There are areas of overlap, and viruses/trojans can then
download spyware.

You sent quite a bit more than the most recent few dumps.

I'd recommend being cautious about memory dumps--they contain whatever is in
memory at the time the crash happened, and that can contain confidential
information. It probably would have been better to transmit it via email,
which I should have mentioned.

I can't look at the dump tonight, and I'm not sure I'll have time tomorrow,
I'm afraid. I have passed it on to an expert, but these things can take
time.

I've also taken steps to make sure that the dump files are not available to
the entire world--which is the case when they are left on a public
newsserver.

 

[MSBLOWSANDSODOESSPYWARE]

Good luck. I have the same problem. It seems the bad guys
have figured a way to CRASH MSASB1. What happens to me
(Win2000 PRO - Fully patched) is the Scan goes thru files
and processes and starts on the registry but as it gets
near the end of the registry something starts eating all
the virtual memory and the scan goes real slow, then the
video stops responding, then I get "Low Virtual Memory"
messages then it freezes and crashes. Nice piece of
software MS !!. Oh and one last thing - YES I AM FU%&$#
running it in SAFE MODE. Yes believe it or not your
beloved Fu%$* safe mode isn't so safe.. Spyware blows and
MS blows worse.. There must be some lawyers out there who
want to get rich off suing all the advertisers and suing
MS. Please lawyers help me to help you to help all of
us!!!

 

[kjs]

I was not aware of that. Thanks for the warning. Can I delete that file
off?

I tried several times running scans in Safe mode. They get cleaned but my
system still crashes. I am at a loss.

 

[Ron Kinner]

Can you download HijackThis to another pc and run it from
a floppy? Save the log to a floppy. And post it from the
other PC?

You can also try AutoStart Viewer from DiamondCS.

http://www.diamondcs.com.au/index.php?page=products

If you click on Main and then Save it will create a log
file in the same folder.

Also silentrunners.vbs from http://silentrunners.org might
work to create a log.

Ron

 

[Bill Sanderson]

I believe the post has been removed from the servers--I wouldn't worry about
that.

At the moment--I'd go with Ron Kinner's advice--see whether you can create a
log file with either HijackThis or SilentRunners.VBS, and get it to him via
email.

 

[Bill Sanderson]

You are correctly describing the behavior.

I'm not sure you are correct in ascribing it to Microsoft, although they are
certainly responsible for releasing this beta to the public.

In terms of working around the problem yoyu are seeing, you are going to
need to clean this threat via some other method, at this point.

Did Microsoft Antispyware give you any name to attach to the problem?

As a starting point, I'd recommend Trend Micro's online scanner:

http://housecall.trendmicro.com

This handles both viruses and spyware.

If it is able to ID something, but not clean it--google on trend micro's
system cleaner, and get it and the current definitions, unzip the
definitions in the same folder as sysclean.exe. and run it in safe mode.