Another virtual bouncer result

[trudger]

Greetings,

I run WinXP Home SP2 on an HTT system I've owned since Dec. 2004. I've been running Spybot the entire time. To the best of my knowledge, hyperthreading has never interfered with the functioning of Spybot or any other program.

In the way of protection, I use SpywareGuard, SpywareBlaster, Spybot S&D (v. 1.4 with detection updates 03/24/2006) and Ad-Aware SE (definitions dated 03/25/2006), all kept current. I run Spybot and Ad-Aware scans at least once a week (more often if I suspect something), and virus scans daily using AVG AntiVirus (Free Edition), which is also kept current.

The AVG and Ad-Aware scans I ran earlier today came back clean. However, Spybot returned the following:

"Congratulations! No immediate theats were found.
Error during check!: Virtual Bouncer [3] (Access violation at address 005A751C in module 'SpybotSD.exe'. Read of address 05283FFF) ()"

I've read through some of the posts here and also searched the Internet, but I've been unable to locate anything that seems pertinent to my situation. I've also run Panda ActiveScan, which came back zeros across the board.

There has been no slow-down in my computer's performance, I've noticed no inordinately high CPU usage, I'm not seeing any pop-ups, my homepage hasn't been hijacked, a search of my system (including hidden files) returns no results for "Virtual Bouncer" or "VBouncer" and, although I may be wrong, it appears that Spybot completed its scan before displaying the error.

I'm somewhat baffled by this turn of events. Could someone please tell me what's going on? Thanks very much!

-trudger

[spybotsandra]

Hello,

If you are running Spybot - Search & Destroy on a system that has Hyperthreading Technology (HTT) please read the following thread:

Spybot-S&D will not complete a scan?
http://forums.spybot.info/showthread.php?t=110

Here is another post that might help:
http://forums.spybot.info/showpost.php?p=390&postcount=4

Best regards
Sandra
Team Spybot

[trudger]

Thanks, Sandra. Before trying anything else, I ran another Spybot scan just now. It successfully completed and displayed the standard "Congratulations" language. No error messages were shown.

So does this mean I'm okay? I still don't understand what happened and would really appreciate further information about this particular sequence of events.

To the best of my knowledge, VirtualBouncer is malware/adware. It appears to have been included in the Spybot updates for 07/06/2003.

I've researched this item further, and none of the characteristic files or registry entries that are said to accompany VirtualBouncer are present on my machine. This leads me to believe that my system is not infected.

If this is true, then why would Spybot use the name Virtual Bouncer in a bright red message after one scan, then not display any such message after the next scan, when I've made no changes in the interim?

If the red message -- "Error during check!: Virtual Bouncer [3] (Access violation at address 005A751C in module 'SpybotSD.exe'. Read of address 05283FFF) ()" -- is Spybot's way of saying that the scan didn't complete, why is the name "Virtual Bouncer" invoked?

If the above message is supposed to indicate a problem, then why am I unable to locate any of its constituent parts on my system, and why am I not seeing any of the typical behavior it manifests, such as pop-up ads, system slow-down and higher than usual resource usage?

I've been using Spybot for years, and nothing like this has ever happened. Could you (or someone) please explain it to me in more detail so I can understand it more fully? I'd truly apprciate it!

Thanks again,
trudger

[ModmanQ6]

+1......Same here...

[Rosenfeld]

What I think the message is saying is that the error occurred at the point that it was checking for Virtual bouncer. It does not mean that it claims to have found Virtual bouncer. Any software will occasionally malfunction...

[trudger]

Thank you, Rosenfeld. Your explanation makes sense! I think what threw me was the "Congratulations! No immediate threats were found" message that appeared just before the error message.

I've only snagged spyware once in my 10+ years on the Internet (with no idea how or where I picked it up, considering all of the protection I had), and it was a bear to remove -- it took three weeks, with many messages back and forth on one of the Hijack This boards. The thought that I might be in for another such experience was definitely not a happy one! :eek:

I do realize that no software is perfect, and Spybot has served me well in all of the years I've been using it. Now that I have a better idea of what happened, I'll know not to start cringing if it ever happens again!

[md usa spybot fan]

re: "Error during check!: Virtual Bouncer [x] (Access violation at address 005A751C in module 'SpybotSD.exe'. Read of address xxxxxFFF) ()"

My take on the error is that it is some sort of transient error that occurs periodically during the scan for Virtual Bouncer related Malware/Trojans. There have been documented reports of this error going back to early December 2005.

Although the error may terminate the scan for the particular Virtual Bouncer signature that Spybot was scanning for (pure speculation), there are reported cases that indicate that the scan continues because other problems (detections) have been reported after the error.

Until the cause of the error is determined and corrected by "Team Spybot", I suggest that if you get this error during a scan:
Just ignore the scan results.
Exit Spybot.
Restart Spybot.
And run another scan.
References that I found with the error (including this one):
Error During Check! Virtual Bouncer [1] (Access Violation at Address 005A751C in.....
http://forums.spybot.info/showthread.php?t=798
Memory access problem
http://forums.spybot.info/showthread.php?t=733
virtual bouncer [3] ?
http://forums.spybot.info/showthread.php?t=3237
Another virtual bouncer result
http://forums.spybot.info/showthread.php?t=3238
13 year old needing help with CMD Service
http://forums.spybot.info/showthread.php?t=3267

[trudger]

The additional info is much appreciated. Thanks!