Mele20
Premium
join:2001-06-05
Hilo, HI
| reply to JackCam614
Re: SpyBot S&D Scan result...
That is strange. I have 160GB drive (148GB available in the beginning ...Dell uses the rest). I am using 110GB. I have a Pentium IV at 3.8 GHz hyperthreading CPU. It makes no sense why my scan would take 35 minutes and yours 6 minutes when there is not that much difference in the amount of files or the speed of our computers.
What do you mean "detections"? Isn't the 50,909 the number of files Spybot scans? It doesn't show any number at first and then it shows what it is scanning currently on the left and on the right the total number it will scan...correct?
--
"If you want to do DRM on a PC then you need to treat the user as the enemy." Ross Anderson in "`Trusted Computing' Frequently Asked Questions"
»www.msfirefox.com/ |
|
JackCam614
Premium
join:2000-08-24
New Hyde Park, NY
| said by Mele20  :That is strange. I have 160GB drive (148GB available in the beginning ...Dell uses the rest). I am using 110GB. I have a Pentium IV at 3.8 GHz hyperthreading CPU. It makes no sense why my scan would take 35 minutes and yours 6 minutes when there is not that much difference in the amount of files or the speed of our computers. What do you mean "detections"? Isn't the 50,909 the number of files Spybot scans? It doesn't show any number at first and then it shows what it is scanning currently on the left and on the right the total number it will scan...correct? I'm probably in error regarding the number of "detections". This was an assumption on my part inasmuch as our 50,909 number is "Exactly" the same. No way could we both have the same number of files on our computers.
It could be the number of files that SpyBot chooses to scan, but I'll not make any more foolish "assumptions". 
This is really going OT for this thread. Perhaps you could start a new post, and get some responses from more knowledgeable BBR Members.
Good Luck,
Jack |
|
Mele20
Premium
join:2001-06-05
Hilo, HI | Ah...I didn't realize they were the same on yours and mine (those numbers). I'll go ask in Spybot's forum. |
|
Libra
Premium
join:2003-08-06
USA
| Hi Mele and Jack,
I didn't update Spybot when I read this thread about the problem, but I just updated it now to the 11-24-06 definitions. The 50,909 number at the bottom is the number of malware Spybot is scanning for. (If you have the tracks scanned also, the number will be higher.)
On our XP computer with a Pentium 4 3.0 GHz cpu with hyperthreading (80 GB harddrive) the scan took 5.19 minutes on the Admin account and 3.13 and 2.28 minutes on the limited user accounts. It took 9.19 minutes on my Windows 98se computer.
35 minutes seems pretty long for a scan.
Sincerely, Libra |
|
Mele20
Premium
join:2001-06-05
Hilo, HI
| I checked the logs and the long scan times began Oct 14 after I got new definitions. The last scan before that was on Sept 24 and it took only seven minutes and 30 seconds. All the scans before Oct 14 were about 7 minutes. All scans from Oct 14 onward are very long, use up to 100% CPU and and each scan since that date has been LONGER by about 5 minutes than the one before it. Something is definitely wrong. I posted earlier today at the Spybot forums.
I should have remembered that the 50,909 is the number of malware it scans for. I spent some time today and looked all through my settings for Spybot and read the manual again and saw then what that number was for. I never have scanned for tracks.
Thanks for the reminder and for the feedback about how much time your scan takes. I wonder what is wrong? I am very curious now to hear from the Spybot team. Maybe all it needs is uninstalling and reinstalling but I think I will wait for a Spybot response.
--
"If you want to do DRM on a PC then you need to treat the user as the enemy." Ross Anderson in "`Trusted Computing' Frequently Asked Questions"
»www.msfirefox.com/ |
|
Libra
Premium
join:2003-08-06
USA | You're welcome Mele. I thought my scans were taking a little longer last month also, but nothing like what you've been experiencing. I'm also curious about what is causing this and hope it can be fixed soon.
Sincerely, Libra |
|
JackCam614
Premium
join:2000-08-24
New Hyde Park, NY
| reply to Libra
Hi Libra,
Thanks for the extremely helpful input. It would seem my post identifying the 50,909 as detections/definitions of malware/spyware was correct after all. Now I don't feel quite as foolish. 
Most importantly, your input will help Mele in diagnosing her problem. Like yourself, I'm curious about what may be causing Mele's problem. SpyBot prides itself on its fast scanning time, so I suspect they will be anxious to assist Mele with diagnostics and repair.
Thanks Again,
Jack |
|
Mele20
Premium
join:2001-06-05
Hilo, HI
| Unfortunately, it appears I am being ignored as there are no replies (one reply but I couldn't edit my post so I replied to add more data) from anyone. Spybot team members (4 of them) have replied to posts since mine.  This is the weekend but with team members replying, today, to other posts...well...I will wait until tomorrow. Maybe I am the only one with this problem and the four team members have no idea how to help? Yuck if that is the case but why not post and tell me at least to reinstall it and that someone would be around on Monday who knows more, etc. Maybe I should just try uninstalling and reinstalling as if I am the only one with this problem then likely it is due to corruption in Spybot. I think I will shut down my virtual machines, reboot, uninstall and reinstall and run a scan. Let's hope that fixes it.
--
"If you want to do DRM on a PC then you need to treat the user as the enemy." Ross Anderson in "`Trusted Computing' Frequently Asked Questions"
»www.msfirefox.com/ |
|
Libra
Premium
join:2003-08-06
USA
| You're welcome Jack.
Mele, You're probably aware of it, but I thought I'd mention it. Spybot has a tool to use when you uninstall Spybot (it removes all registry items, etc.). Here's a link to it if you haven't removed Spybot yet.
»www.safer-networking.org/en/faq/27.html
I hope reinstalling corrects the slow scan problem.
Sincerely, Libra |
|
Mele20
Premium
join:2001-06-05
Hilo, HI
| Darn. I didn't remember about that tool. Thanks for mentioning it. I already uninstalled it using its uninstaller and reinstalled and got every set up right (unchecked the boxes Spybot has on ignore, etc.) and changed skins (I cannot read anything with the default skin in the left column it is so pale). I didn't use the copy I have in Downloaded Programs folder because it said the File version was 0.0.0.0 and that seemed odd. So I went to Spybot's site and downloaded a fresh version. It too says the file version is 0.0.0.0 so I did not need to be concerned about that.
I just finished another scan. I turned off KAV just in case the new MP1 version was somehow affecting Spybot. This time I ran process explorer instead of just monitering with Task Manager. The scan took 30 minutes and CPU usage total was 70% most of the time. I did nothing on the computer. Just watched Spybot for 30 minutes. Almost all the CPU usage was Kernel access. I don't know if that is normal for Spybot as I used to not watch Spybot running because it scanned fast and I had no reason to watch it. Very heavy Kernel access. The usage was about 40-45% Spybot and the rest was System...now why would System use 25-30% CPU when the only thing happening was Spybot running? Maybe that is normal also?...but the long scan time and a total of 70% CPU usage average when doing nothing but running Spybot can't be right. One processor seemed taxed much more heavily...that seems odd too.
I'm going to post again in Spybot's forum. I think I will wait and see if they tell me I need to use the uninstaller tool.
--
"If you want to do DRM on a PC then you need to treat the user as the enemy." Ross Anderson in "`Trusted Computing' Frequently Asked Questions"
»www.msfirefox.com/ |
|
JackCam614
Premium
join:2000-08-24
New Hyde Park, NY
| Mele20,
I am aware that you are fully capable of fending for yourself, but I took the liberty of giving Team Spybot a little friendly prod on your thread over there. I hope you don't mind, but I figured it couldn't hurt.
Good Luck,
Jack |
|
Mele20
Premium
join:2001-06-05
Hilo, HI
| Evidently I was composing another post there while you posted. I saw yours when I posted mine. 
Thank you! You worded your post just great...I got a kick out of it and I think it should help.
Had I realized that I would end up practically taking over your thread, I would have started a new one and not said anything in yours. I'm sorry about that.
--
"If you want to do DRM on a PC then you need to treat the user as the enemy." Ross Anderson in "`Trusted Computing' Frequently Asked Questions"
»www.msfirefox.com/ |
|
JackCam614
Premium
join:2000-08-24
New Hyde Park, NY | Mele,
You're very welcome.
And don't worry about hijacking this thread, as long as you get your problem resolved, that's the only thing that matters.
Jack |
|
Libra
Premium
join:2003-08-06
USA
| reply to Mele20
Hi Mele,
I vaguely remember a problem with hyperthreading and Spybot. I doubt this is the problem, since it just started happening in October. Here's a link to that problem in case your scan is actually hanging:
»forums.spybot.info/showthread.ph···hreading
Hopefully someone from Spybot will respond to this problem soon.
Sincerely, Libra |
|
Mele20
Premium
join:2001-06-05
Hilo, HI
| Thank you Libra. That was an interesting thread. I don't think mine is hanging plus seems it would have started way before October...but I guess it could be hanging as while I watched it...I was looking at Process Explorer a lot and didn't keep my eyes on the little tabulator at the bottom all the time..so I guess it could have hung and then become ok...and maybe hung again, off and on...Maybe I should have run a scan when I reinstalled before I updated the definitions...maybe there is something about the Oct 13 definitions this computer doesn't like.
--
"If you want to do DRM on a PC then you need to treat the user as the enemy." Ross Anderson in "`Trusted Computing' Frequently Asked Questions"
»www.msfirefox.com/ |
|
Mele20
Premium
join:2001-06-05
Hilo, HI
| reply to JackCam614
I posted again Tuesday morning and thought I wrote a nice post. I did get a reply finally which I just read and replied to.
I'm not keeping Spybot as I am convinced something is wrong and I see no reason to put such a load on my computer for over 30 minutes especially seeing that one CPU is taxed a lot more than the other and that the kernel access is so high during the scan. But that team member who replied tried to tell me that the small increase in scan times that he has seen is the same as the huge increase I have seen. He ignored my questions about the heavy kernel access and one CPU being accessed much more than the other during the scan. Maybe that is normal but I sure doubt it and he could have alleviated my concern if that activity is normal but he didn't.
He also said that something must have changed in my system. Not true. He also intimated that the longer scan times are because I have more files. I actually have 5GB MORE SPACE now because I uninstalled MS Office Beta and Vista beta that I never tried but did download when it first was made available. I ran another scan after I uninstalled those programs and the scan was still at 30 minutes.
He also criticized me for waiting so long to report this and then being "impatient". Gee...I wasn't sure I had a problem until these last definitions! He was rude to me.
--
"If you want to do DRM on a PC then you need to treat the user as the enemy." Ross Anderson in "`Trusted Computing' Frequently Asked Questions"
»www.msfirefox.com/ |
|
JackCam614
Premium
join:2000-08-24
New Hyde Park, NY
| I read your posts over at the SpyBot forum, and I found nothing that should elicit such a rude response. Nor did I find anything in his post that might assist you in the resolution of your problem.
Regarding your reply to his post. May I commend you for showing a great deal of restraint, and taking the moral high ground.
His PS;----------->
ps: I personally find your comment "Gee, it's been about 72 hours since I posted and asked for some help" unwarranted and somewhat grating. Three weeks between your September 24th and the October 14th scans and another six weeks to report that you suspected a problem. Exactly what do you expect?
__________________
In my opinion, totally uncalled for.
Jack |
|
Mele20
Premium
join:2001-06-05
Hilo, HI
| Mahalo for your support and kind words. md usa spybot fan replied again earlier today with a very long, informative post about his scanning, his computer, and all the possible reasons the scan might be longer including the splitting of some of the definition files in the Oct 13 definitions. His conclusion though was:
"I don't think that any of the above will real help solve your problem. Do you keep backups that would allow you to return Spybot to the state it was in on 2006-09-24? That way running Spybot with those detection files would conclusively point to whether or not it was changes to Spybot or something that changed in your system that caused the radical change in the elapsed time of the Spybot scan."
So, I uninstalled Spybot yet again and ran RegCleaner. (I couldn't see how to get the tool Libra mentioned to run...was I supposed to click on "merge")? I then had Acronis TI assign a virtual drive letter to the Image I had made on Oct 6. I then copied the Spybot file from that image to the host machine. It had, of course, the Sept 24 definitions when the scan had been 7.5 minutes. I didn't update the definitions but just ran a scan. This time I watched with Process Explorer instead of Task Manager. With PE I can hover the mouse on either end of the window and see the current usage for each CPU. I can't do that in Task Manager. The CPU access seemed to be much more balanced this time but the Kernel access was extremely heavy.
md usa spybot fan said in his post:
"The amount of CPU used by the Kernel on your system seems extremely high compared to my observations during the running of the Spybot scan above. Although I did not attempt to quantify the utilization, I would say on the average it was maybe 20% - 25% and during extended periods of time was near zero."
For me the heavy Kernel access was almost all the time and did not abate until very suddenly when it dropped to nothing toward the end of the scan when bookmarks are scanned. The scan took 23:23! Ugh. That was with Sept 24 definitions.
So, it looks like something changed on my computer between Sept 24 and Oct 14 and that change is permanent and is the cause of the way too long scans with the heavy Kernel access. I have no idea what it could be. I may never know. VERY FRUSTRATING.
--
"If you want to do DRM on a PC then you need to treat the user as the enemy." Ross Anderson in "`Trusted Computing' Frequently Asked Questions"
»www.msfirefox.com/ |
|
JackCam614
Premium
join:2000-08-24
New Hyde Park, NY
2 edits | Aloha Mele,
I have been following the thread at the Spybot Forum, and it appears that the 'Adviser', md USA spybot fan has made an attempt at redeeming himself. (I'm glad I restrained myself, and deleted the descriptive adj. "boorish lout" from my last post, prior to posting.)
You certainly have every reason to feel frustrated at this point. May I suggest you run a free 'Full PC Tuneup' at PC Pitstop. »pcpitstop.com/
I have found them to be a very reputable, spam free, security/privacy conscious operation.
My first guess is that you may have an 'Internet Explorer Cache Overflow' problem. All versions of IE have a bug in the way they handle the browser cache. If you do, a solution for manual deletion from hidden operating system files can be found there.
I know you are not going to 'quit', or 'give up' on this problem, and PC Pitstop may help you find a solution.
Good Luck,
Jack
Edit; Link to IE Cache Overflow details (del. Oooops, TMI) |
|
Mele20
Premium
join:2001-06-05
Hilo, HI
| "boorish lout" is a perfect description of how the "Advisor" first acted. I got a big laugh out of your colorful term. Probably good that you restrained yourself...he has been reading this thread too and has linked it to his reply in the Spybot forum so he may still see it and if so ....well, he asked for it.
I'll run the PCPitstop test...hope I can. I had an awful time a couple of months ago being able to run anything there. I don't recall what I did to finally fix it but I posted in their forums so if I have trouble again, I can refresh my memory (if I still can't recall the fix) by reading my posts there. I hardly ever use IE so I doubt that is the problem (but I do hae to use it with PC Pitstop).. I know I had cache issues with IE back when I used to use it a lot.
--
"If you want to do DRM on a PC then you need to treat the user as the enemy." Ross Anderson in "`Trusted Computing' Frequently Asked Questions"
»www.msfirefox.com/ |
|
