Problem with Scandisk

[JohnE]

A friend of mine asked me to look at his computer which had being playing up for about 2 months. Needless to say it was riddled with spyware and general malware. No actual viruses but the usual autodiallers etc.

I've managed to remove everything but there's a strange problem left over.... If I try to run Scandisk (this is under Windows 98, BTW) it just seems to get stuck in a loop, repeatedly stopping and re-starting. Sometimes the progress bar gets about 10% of the way along before re-starting, sometimes as much as 50% but it never gets much past 50%. If I run Scandisk in Safe Mode, everything's fine - so I suspect that Scandisk itself is okay. Something must be preventing it from running properly in normal mode.

I wondered if this might be a side effect of one of the malware apps. Scandisk was misbehaving in exactly the same way before I removed anything but it's still misbehaving afterwards. Has anyone else come across anything like this?

[JohnE]

Hmmm.... I've discovered something that's probably significant. On my friend's system, something is writing to his registry at regular intervals. The intervals do vary though. Somtimes it gets written to once every minute, sometimes it's once every 2 minutes and sometimes, once every 4 minutes. I don't know what causes the variation.

Fortunately, I can dual boot my own system into Windows 98. On my system however, there is no such activity.

[Prometheus]

Use a bootable diagnostic disc.

I assume you are running scandisk from within windows. If you are, then if anything creates files or changes existing files while scandisk is running, scandisk will start over.

It appears that you have not removed all the spy/adware because the first thing they do is make sure it hasn't been tampered with. If it has and the program is still resident in memory, it will recreate the files.

Use Spybot Search and Destroy and Ad-Aware. Also, go to run on the start menu and type in msconfig. Uncheck anything that should not be running and reboot.

Oh yea, I forgot to mention, virus, trojens, etc act the same way so a good anti-virus program is a must.

[JohnE]

Thanks guys. Incidentally, CiKoTiC, you're right in assuning that Scandisk is being run from within Windows. If I force it to run after the next re-boot, it works correctly.

Norton Antivirus and Ad-Aware both report no problems. I haven't tried Spybot yet but I'll give that a try later today. However, I've discovered that the thing that's writing every 4 minutes is Norton Internet Security (in fact, it's possibly writing once per minute but only flushing them to disk after every 4 writes). I think this is a pretty good assumption because it writes its own log files at the same time.

Do you happen to know if it's possible to reduce the frequency that NIS uses for updating its own files?

[JohnE]

Okay.... just found out that this is a known issue with the Norton software. According to Symantec, the fix is to configure Windows 98 to use a permanent swap file (which I did) but it didn't solve the problem. Still, at least I know what's causing it.....