Now Spybot Won't Scan My Win98 Even from Network

[JorgeA]

Friends,

Those of you who read or helped out with my Spybot question a few months ago -- remember that the problem was that Spybot Search & Destroy would never quite finish the manual scan on my Windows 98 Standard Edition tower, crashing at the very end with an "illegal operation" error message.

Well, you might like to know that I networked that Win98FE tower to my Vista machine and ran a Norton 360 scan. (I'm learning a lot about networking.) The scan worked well, and N360 didn't find anything. That's reassuring, but the most interesting thing is that I also tried running a Spybot scan of the Win98 C: drive off my Vista PC -- and when it reaches that drive in the "download directories" setting, it gets REALLY slow. In addition, it's showing me one item to fix: "AdDestination TrojansC-05." (I remember vaguely encountering this years ago; thought that it'd been taken care of long since.)

Right now the scan through the network has remained at 1218392/1252915 for about half an hour. Oh wait, as I was typing it finally moved to 1218395, then 97. I'll let you know if it actually finishes the scan. Would be amazing if whatever is causing this, also defeats Spybot from another machine.

No one else has found anything to complain about -- not N360 off the Vista, not Avast! 4.8, not SuperAntiSpyware off the Win98 PC.

--JorgeA

[Tripredacus]

I feel silly asking this, but did it finish yet?

[JorgeA]

I feel silly asking this, but did it finish yet?

Tripredacus,

Well, not a silly question at all -- I let it run overnight and it had only moved a further 125 or so files. Since it still had ~32,000 entries left to go, who knows how long it would have taken to get to the end. Half a year?? I finally stopped the scan after it sat on the same number for about two hours this morning.

When I scanned the Win98FE as a network drive through the Vista PC, both the N360 scan and the online Eset NOD scanner took "normal" amounts of time, Eset NOD finishing up in less than an hour and a half. The interesting thing about this is that, if I try to run that scanner directly on the Win98FE, it crashes about a third of the way through.

--JorgeA

Edited July 8, 2010 by JorgeA

[conway]

I feel silly asking this, but did it finish yet?

Tripredacus,

Well, not a silly question at all -- I let it run overnight and it had only moved a further 125 or so files. Since it still had ~32,000 entries left to go, who knows how long it would have taken to get to the end. Half a year?? I finally stopped the scan after it sat on the same number for about two hours this morning.

When I scanned the Win98FE as a network drive through the Vista PC, both the N360 scan and the online Eset NOD scanner took "normal" amounts of time, Eset NOD finishing up in less than an hour and a half. The interesting thing about this is that, if I try to run that scanner directly on the Win98FE, it crashes about a third of the way through.

--JorgeA

Spybot introduced an error with the Trojan sbi files for Windows 98. I reported this to Spybot but they do not want to fix it. The way to scan is to remove/rename the trojan sbi files (about 5 of them). This way it will scan and finish.

After it finish, you can copy the file back into the folder/rename one at a time and run the scan for it. Once the tojan scan finishes, remove/rename it again and copy/rename the next file. Repeat that 4 more times so that it scanned for it.

[JorgeA]

conway,

Well, that information was certainly worth waiting for!

Thank you very much. I'll explore this and see if I can figure out how to do the procedure you outline.

--JorgeA

[jds]

S&D seems to have exponential/hyperbolic memory & cpu needs as its malware database grows, such that soon enough, it needs to virtualize those memory needs. To make matters worse, it seems to shuffle memory around ad infinitum, you'd think it was bubble sorting those hundreds of megs of memory it seems to chew through, and remember, that's going to be all the more painful when it's virtual memory! Exasperating! That's why it slows to a crawl on your Vista PC, and I'm sure there's a limit to how much virtual memory W98 can handle before it crashes, which is what it's doing.

Just my view of what S&D does ... take a look at your swap file size as it scans on your W98 machine.

Joe.

[JorgeA]

Joe,

You're right, the swap file on the W98 gets huge when Spybot is running a scan. The last time I monitored it, I think it approached 1GB in size.

Although, I should say that Spybot runs fine on the Vista PC when it's scanning the Vista PC itself -- the scan finishes in about 20 minutes. The problems come when Spybot is scanning the W98 PC, either from the W98 machine itself (program crash) or from the Vista through the network (crawling scan).

--JorgeA