Page 4 of 15 FirstFirst 1234567814 ... LastLast
Results 31 to 40 of 144

Thread: Spybot 1.6.2 update and Runtime Error 216

  1. #31
    Junior Member
    Join Date
    Aug 2009
    Posts
    18

    Default

    Quote Originally Posted by roberto View Post
    Thanks. We got your sample for analysis. The file is using kernel functions but at this moment we are not sure, if this really is a rootkit. This could be a part of a legit software. We give this issue a high priority and are further investigating this.

    You will get a special detection file, in case this is malware and the analysis has been accomplished.

    Best,
    Roberto.
    Roberto, you are a professional and a gentleperson. Thank you and your team for giving this the attention and effort you have. Even if it turns out to be an infection, I'm still happy to have hard working people like you guys in our corner.

    As a note I forgot to include in the email, or here: That oUltraf.sys file was located in C:\Documents and Settings\{My username}\Local Settings\Temp\ , which seems somewhat suspicious in it's own right.

  2. #32
    Junior Member
    Join Date
    Aug 2009
    Posts
    6

    Default

    Quote Originally Posted by VibrationalMode View Post
    As a note I forgot to include in the email, or here: That oUltraf.sys file was located in C:\Documents and Settings\{My username}\Local Settings\Temp\ , which seems somewhat suspicious in it's own right.
    I too have been having this error for sometime now. I run McAfee 8.7i nightly as well as Spybot. Nothing has ever popped up. The scan actually completes, and once the program closes, then the error pops up. I would have thought that if it were an infection, it would prevent spybot from running in the first place. I haven't run a rootkit program yet. Seems to me that it's an incompatibility issue and not infection. Also, I didn't find the oUltraf.sys file in that directory or anywhere else.

  3. #33
    Junior Member
    Join Date
    Nov 2005
    Location
    Nova Scotia
    Posts
    12

    Default

    Quote Originally Posted by NotGeordie View Post
    After todays update (05 Aug) I noted that my error after closing SBot changed to 'instruction at 0x06db40c2'...

    I'm reluctant to run analytical software that I'm not familiar with, especially if it's only partially developed - so if I'm just cluttering this forum, let me know. I'll stop.
    After today's two includes updates, I no longer get errors on program close! I hope that's good.

    Are you reluctant to run Sandra's suggested GMER and/or RootAlyzer?
    Today, GMER didn't find
    two hidden processes in red text, as it did on the 4th.

    I don't want to cause clutter either, but this is helping me keep in touch, thus I'm hoping this is ok. This thread seems fine for general chatter on this topic.

    Question: can .JPGs contain rootkit or other malware, or can I disregard JPG and other graphic files, i.e. BMP, etc.?
    Dugie
    Win 2000 Pro SP 4, AMD Sempron 3000

  4. #34
    Junior Member
    Join Date
    Aug 2009
    Posts
    4

    Default

    FWIW, I ran Spybot S&D from a system account (i.e., in a WinXP Command Prompt from C:\WINDOWS\system32\>...) and I was unable to reproduce any of the earlier errors.

    I'll leave it to you more-experienced people to decide if this is really as important as I think it is.

  5. #35
    Junior Member
    Join Date
    Aug 2009
    Posts
    18

    Default

    same error pop-ups here, i guess the newest definitions are checked last in the scan and in my case more than 566000 items are checked during the scan. when i abort the scan at say 545000 checked items the error will not occur. my guess would be faulty latest definitions files.

    Logically this makes a lot more sense to me than all of us being infected (i hope ...)
    Last edited by Ras1974; 2009-08-06 at 00:46.

  6. #36
    Junior Member
    Join Date
    Aug 2009
    Posts
    18

    Default

    i guess some part of the definitions of late causes something in the program / process to lock(?) when closing down resulting in a crash. i guess all updates are exactly the same from the different servers?

  7. #37
    Member of Team Spybot Buster's Avatar
    Join Date
    Oct 2005
    Location
    Bochum/Germany
    Posts
    389

    Default

    According to kinos post after deactivating the trojans.sbi the runtime error did not occur any longer on his system. To make sure that this is not just a coincidence, please give it a try and report in.
    "The advantage of wisdom is that you can always act the fool. The opposite is quite tough."

    K. Tucholsky

    _______________________________________________________________

    Please help us improve Spybot and download our distributed testing client.

  8. #38
    Member
    Join Date
    Jul 2009
    Posts
    33

    Default

    [To make sure that this is not just a coincidence, please give it a try and report in. [/QUOTE]

    No luck, Buster. I deactivated the Trojans.sbi, ran a scan twice and got the same error messages.
    --------------------------------------------
    (1) XP Home SP3, IntelCore2Duo@2GHz, 2GB RAM, IE8
    (2) XP Home SP3, IntelCeleron@1.6GHz, 1GB RAM, IE8
    Wired Home Net

  9. #39
    Member of Team Spybot Buster's Avatar
    Join Date
    Oct 2005
    Location
    Bochum/Germany
    Posts
    389

    Default

    @ NotGeordie Thanks for reporting so quickly. Lets try something else. Please turn off all file sets but the usage tracks.
    "The advantage of wisdom is that you can always act the fool. The opposite is quite tough."

    K. Tucholsky

    _______________________________________________________________

    Please help us improve Spybot and download our distributed testing client.

  10. #40
    Member of Team Spybot Buster's Avatar
    Join Date
    Oct 2005
    Location
    Bochum/Germany
    Posts
    389

    Default

    Another possible reason may be the new advcheck.dll, which has been released last week. Hence we would like you to install the old advcheck.dll, which can be found here. Please download the zip file, unzip and start the included .exe file. Thanks!
    "The advantage of wisdom is that you can always act the fool. The opposite is quite tough."

    K. Tucholsky

    _______________________________________________________________

    Please help us improve Spybot and download our distributed testing client.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •