Returnil strangeness after uninstalling SuperAntiSpyware

On my wife's Windows 7 64-bit system which is running RSS 2011 REL14, I have noticed something strange with Returnil after uninstalling SAS and then running the 64-bit version of the SAS Uninstaller Assistant. To be exact I uninstalled SAS, rebooted, ran the uninstaller assistant, and then rebooted again.

Previous to uninstalling SAS when the Returnil virtual mode was activated I would see the Returnil progress bar scroll across several times and then the progress bar would disappear and the Returnil icon would immediately change color to indicate that the virtual mode was active.

After uninstalling SAS and running the SAS Uninstaller Assistant when I activate Returnil's virtual mode I see the progress bar briefly (one or ocassionaly two passes) and then it disappears. Then it takes many seconds for the Returnil icon to change to indicate the virtual mode is active.

Just thought I would report it and see if Coldmoon (or anyone else willing to try) could replicate this. If it can be replicated perhaps Coldmoon can find out what causes it. Returnil's virtual mode is still working normally as far as I can tell other than the issue I mentioned. I am considering installing Returnil again over the top of itself to see if it goes back to the way it normally operates.

 

What build/version of SAS and build of the uninstaller?

Mike

 

I wish I could answer as to which version of SAS I had installed but I had installed it so long ago and updated it enough times that I honestly can't be sure. I believe it may have been 4.55.1000. As for the SAS uninstaller it was the current version from the link in my first post.

I did a repair install of RSS REL14 a few moments ago so hopefully that will have solved the problem. It seems to have fixed it judging by the first attempt at going into virtual mode but I will try it a few more times and report back later.

 

Ok - let me know how it goes. In the interim I have notified the engineering team of your report.

Mike

 

Well, after switching the computer into virtual mode a few times I have found that I still get the progress bar for a shorter duration than I used to but the icon color does change again almost as soon as the progress bar disappears. So I guess I came out ahead in the deal as it doesn't seem to take Returnil as long to go into virtual mode anymore.

 

It could indicate that something in SAS might be slowing the VM initialization. The QC team will take this to the lab to see if they can reproduce the slowdown and what might be causing the problem in the first place.

Mike

 

SUPERAntiSpyware should not be interfering - if you need us to take a look, let us know.

 

Hi,
Just got a reply back from our team that they could not reproduce any issues with either program.

@Firebytes

Any chance you had other security programs installed at the same time or just prior to your setup of RSS?

Mike

 

Maybe it was just a glitch on my system?? Oh by the way, this was with SAS free, so it wasn't running real-time.

Anyway, the other security programs installed are Avast free (disabled during install of RSS), MalwareBytes free, PrivateFirewall (disabled during install of RSS). I never had the problem of the long lag between the progress bar stopping and the icon color changing though until I did the SAS uninstall.

After the repair install of RSS everything is satisfactory for me again. I just wanted to report what had happened. I appreciate you looking into it and thanks to Nick for his concern.

 

My search for answers would begin and maybe end with Avast! AV. It can interfere with a number of things even with its real time monitor turned off and I would also suspect it being involved in why you needed to use the SAS removal tool to complete SAS's removal.

Try testing this in a VM with simple combinations and then try all together as the last test. The more you add, the more complex the situation and the harder it is to narrow in on any one single cause...

Mike

 

While anything is possible, the only thing I can recall having Avast interfere with on any of my systems was PrivateFirewall. I changed versions of Avast and solved that problem. Plus Avast and Returnil were getting along fine on the system in question. It was only when I uninstalled SAS that I got the big delay in having the Returnil icon change. Also, I didn't run the SAS uninstall utility due to a problem with uninstalling SAS normally. I just did it in an attempt to be thorough in the removal of SAS.

Thanks again.