Spybot Search And Destroy Causes Bsod

[JetsetBkk]

After removing "conflicker" virus from a USB flash drive, see here: http://www.thaivisa.com/forum/Happened-Con...t&p=3036808 , I ran "Spybot Search and Destroy" on the flash drive and got a BSOD!

The way I ran S&D was to right click on the drive letter in the folder pane of Explorer, and then click on "Scan Using Spybot-Search&Destroy". Almost immediately I got the BSOD.

I just about made out the name of a driver at the bottom of the BSOD before it disappeared - NTIdriver.sys, or maybe NTIdrvr.sys - which is probably the CD/DVD driver that came with the NTI software, pre-installed on the laptop.

So, like every good software engineer, I decided to scan it again and sure enough got the same BSOD again.

After checking for the conflicker virus using the information here: http://support.microsoft.com/kb/962007 , and performing the scan as recommended, there was no sign of the virus. (Actually, I let the scan run through the C: drive, but after a few hours of scanning the 1.5 terabyte data drive, I stopped the scan and checked the results logged so far. I'll re-scan the big drives later.)

So, confident all was well, I scanned the flash drive again and got another BSOD.

Thinking a bit laterally, I decided to check what was on the drive and saw that most files were Word documents with Thai names and Thai script inside.

So I decided to scan a folder on my hard drive which was an old backup of this flash drive. Sure enough, I got a BSOD.

Anyone willing to scan a Word file with a Thai name and containing Thai text... just to prove a point?

Edited September 26, 2009 by JetsetBkk

[Daffy D]

I'm running XP Pro SP2 and Word 2007

I scanned English Word doc and a scan with results - no problem

Scanned a Thai Word doc and got nothing:-

Everything else working OK no BSOD

[opalhort]

I had a similar problem with Spybot S&D earlier this year, though no BSOD just hanging PC. It turned out the problem was a very long file name in Thai. After reducing the file name lengths and upgrading Spybot S&D no more problems.

Edit: using XP SP3

opalhort

Edited September 26, 2009 by opalhort

[JetsetBkk]

Thanks for the replies DaffyD and opalhort. I got rid of conficker using a Semantic tool and am now running the MS Malicious Software Removal Tool - belt and braces approach.

When that's done I'll make a disk image and then experiment a bit more with these Thai documents. I hate those BSODs and haven't seen one in a year or more. Amazing that this one is so reproducible.

Other scans - Ad-Aware and Avira - found no malware.