Spybot 1.6.2 update and Runtime Error 216

Hi everyone, just a quick question about a weird error I received this evening. Every week I do a thorough system scan with NOD32, MalwareByte AntiMalware, and then Spybot S&D.

This week I got through all the scans, right up to the very last one. The last one was Spybot, and durring the update process before the scan, version 1.6.2 was installed. The scan then went off without finding a thing. However, when I closed Spybot, after it had concluded the scan, I got the following error:

" The instruction at "0x074d40c2" referenced memory at "0x0777dec8". The memory could not be "read" "

Followed by:

" runtime error 216 at 074D40C2 "

Now, according to Microsoft, this error is caused by the SubSeven trojan (link here). I can't find out much more than this, as being the cause, since just about everything on Google says it's SubSeven, too. I can't imagine having a trojan, since Nod32 is running, already scanned thoroughly, and have also done the same with MalwareBytes and Spybot. Then again, Spybot did update and install a patch, and I don't know if that might've been hijacked.

Has anyone ever seen this kind of an error with Spybot before? I'm not sure if it's a trojan or just a problem with Spybot's new version, and I'm not sure of what steps to take next. Obviously Nod32, MalwareBytes, and Spybot can't see it if I am infected (even did a safe-mode rescan), and I don't want to install a second A/V program on top of an existing one... Is there anything I can do to see if the virus is there otherwise? Telltale signs and the sort?

Alternatively, does anyone have any experience with this "runtime error 216"? Is it really only caused by a virus, or is it possibly something else? Thanks.

i also recived this error,i did post 4 days ago but got no reply,perhaps its time to ask again.

i certaily dont want to go asking for help if i am not infected and this is not a virus.
it also statred with the new updates,imo its not a virus but seems to be affecting ceratin machine and not others.

still i might be wrong and i would like to know

perhaps this could be awasered?

try looking for this;

C:\WINDOWS\system32\bingoo.exe

it was on my system not sure if thats the reason but might be.
(its not now but i need to do more looking to find anything else that might be causeing this)

Quote:

---

Originally Posted by kinos

try looking for this;

C:\WINDOWS\system32\bingoo.exe

it was on my system not sure if thats the reason but might be.
(its not now but i need to do more looking to find anything else that might be causeing this)

---

I could not find that file on my system anywhere. Additionally, updated MBAM scans have yeilded no traces of Sub7. Given that Sub7 is roughly ten years old, I would certainly hope it could be found. I'm beginning to think more and more that Microsoft might not be correct, and this might not be a virus.

I am also having this problem after updating Spybot tonight. I hope some answers come soon.

I have the same problem. I have version 1.6.2.46. The address that can't be read will vary. Otherwise my errors are identical to the original poster's errors.

I find the crash only happens if I terminate Spybot after it completes a scan. If I stop the scan and terminate, it doesn't crash.

As far as I know, this is always the case when I'm running from my admin account. I tried it from my non-admin account using "runas", and it didn't crash.


P.S. It seems silly that I can't search for Runtime error 216. The search engine will ignore the 216. Maybe it thinks if it narrows down the search too much, it would make things too easy for me? :)

P.P.S. Maybe it's just a coincidence but I also use NOD32.

I disabled NOD32 antivirus and ran some scans. It didn't crash. I re-enabled the antivirus and it still didn't crash. Apparently that fixed my problem, at least temporarily.

just for info;i am not useing nod32.

its about time someone addressed this,it been a week since i first reported this.
even if only to let us know there working on it or somthing.

I had similar error messages after the 29 July SBot update. They haven't reappeared after a reboot, but I noticed something odd:

After the update downloaded, SBot closed by itself, an old style DOS screen came up momentarily running too quickly to make out what was happening, then SBot reopened.

This happened on both my computers. XP Home SP3.

MBAM, Superantispyware, NIS 2009, the Microsoft Malicious Software Removal Tool and SBot all showed the computers as being clean.

I've never seen this behavior from a SBot update before. Weird or expected?

Quote:

---

Originally Posted by NotGeordie

I had similar error messages after the 29 July SBot update. They haven't reappeared after a reboot, but I noticed something odd:

After the update downloaded, SBot closed by itself, an old style DOS screen came up momentarily running too quickly to make out what was happening, then SBot reopened.

This happened on both my computers. XP Home SP3.

MBAM, Superantispyware, NIS 2009, the Microsoft Malicious Software Removal Tool and SBot all showed the computers as being clean.

I've never seen this behavior from a SBot update before. Weird or expected?

---

i belive thats the cmd sreen;expected,it happens occasionally,dont belive ive seen it in a yr or two,thats nothing to worry about.

Attempting to recreate the error after reboot on my end didn't work, either. I suppose it might've been a one-time issue? I'm certainly a little more relieved that other people are seeing this at the same time and in the same manner - Unless the latest update was hijacked from SpyBot and a SubSeven trojan was delieved with the autoupdate (possible), I'm hoping this is just a one-off fluke.

And, I will note, I noticed exactly the same behavior as NotGeordie.

I am still having the problem after running spybot, even after rebooting.

I think that happens when Spybot downloads an update to the program. I think it closes the old program and re-opens the new one. Well, that's my theory, and I'm stickin' to it.

Quote:

---

Originally Posted by Werewolf

I am still having the problem after running spybot, even after rebooting.

---

I'm just curious... If you let the scan conclude, and then after finishing the scan, let the computer sit for a moment or two before closing Spybot, does this happen? I'm wondering if the error happens from closing SpyBot too quickly after finishing a scan.

Well, the problems back again, only now it reads: The instruction at "06CF40C2" referenced memory at "0x0698de68". The memory could not be "read", followed by "Runtime error 216 at 06CF40C2".

I did let the program idle before shutting down.

There's 4 or 5 current posts under different threads with variants of this problem. Haven't seen any hard answers yet.

Quote:

---

Originally Posted by steve17

I think that happens when Spybot downloads an update to the program. I think it closes the old program and re-opens the new one. Well, that's my theory, and I'm stickin' to it.

---

I've had S S&D open a DOS window quite often when doing an update.

These popup errors have happened to me, since I think the last update:
The instruction at "0x0a1340c2" referenced memory at "0x0a3ddec8" and
Runtime Error 216 at 0A1340C2
The addresses may vary.

See the link to my first post at:
http://forums.spybot.info/showthread...25913#poststop

My S&D scan runs overnight, so there's hours between end of program run and program close.

Possibly some S&D code conflict?
There are reports of this error type in several places in the forums, as NotGeordie mentions

I admit that I am becoming increasingly concerned at the lack of any offical comment on this error. It is particularly distressing that the only google searches that reference a "runtime error 216" are security bulletins indicating that the error is caused by a Backdoor/Trojan.

I hate to be paranoid, but I am beginning to wonder if one of the spybot update mirrors was used as a vector to spread something nasty. Is there any log kept of spybot's updating behavior? Is there a log anywhere indicating what mirror was used to download the updates? If there is, then those of us experiencing this error can compare what mirrors we used for the download, and see if a trend emerges.

Edit: I will admit that I am not fully convinced that something nasty was spread, so I am not trying to say definitively that a trojan is being distributed. It's merely that the odd DOS behavior, multiple reports here, and this peculiar error are starting to make me very nervous!

29 July I updated both my computers within moments of each other from SecurityWonks.net#1(USA).

One computer exhibits the problem discussed, the other does not. So - I don't think it's a mirror being hijacked.

It probably doesn't matter but the one with the problem: XP Home SP3, Intel Core2 Duo@2GHz, 2GB RAM, IE8; the other: XP Home SP3, Intel Celeron@1.6 GHz, 1GB RAM, IE8. Both on a Wired net.

Both run NIS 2009 & S S&D 1.6.2.46 constantly with SuperAntiSpyware, MBAM and MS Malicious Software Removal Tool on demand.

Neither report any infection/malware.

Odd, this thread is getting lots of views. If you were to add the other threads reporting the same problem - LOTS of views! Still waiting for hard answers (patiently, mind you).

Quote:

---

Originally Posted by NotGeordie

29 July I updated both my computers within moments of each other from SecurityWonks.net#1(USA).

One computer exhibits the problem discussed, the other does not. So - I don't think it's a mirror being hijacked.

It probably doesn't matter but the one with the problem: XP Home SP3, Intel Core2 Duo@2GHz, 2GB RAM, IE8; the other: XP Home SP3, Intel Celeron@1.6 GHz, 1GB RAM, IE8. Both on a Wired net.

Both run NIS 2009 & S S&D 1.6.2.46 constantly with SuperAntiSpyware, MBAM and MS Malicious Software Removal Tool on demand.

Neither report any infection/malware.

Odd, this thread is getting lots of views. If you were to add the other threads reporting the same problem - LOTS of views! Still waiting for hard answers (patiently, mind you).

---

Thanks, NotGeordie! Your experience fairly much rules out my paranoid theory, and I am happier for it.

I wonder if it has to do with hardware, then. I'm running a Core2 Duo e6750 @2.66GHz, 2GB RAM, XP Professional SP3, wired connection, and I browse with the latest version of Opera. I run NOD32 constantly, and I scan weekly with SpyBot and MalwareBytes AntiMalware.

Hello,

This problem you experience may be caused by an infection. Just to make sure you are not infected with a rootkit, please run a scan for rootkits. Rootkits are a technology that is more and more often used by malware to hide themselves on system level, making themselves invisible to standard tools. Our RootAlyzer shows you anything that uses certain rootkit technologies, even if it's not in Spybot-S&Ds detection database.

The RootAlyzer is a single tool which goes through the file system, the registry and process related lists. When you start RootAlyzer, it performs a very quick scan of a few important places, taking about a second on modern machines. To check the full system, you have the possibility of choosing a Deep Scan.

Currently, the RootAlyzer is a work in progress (with a new project tools category in our forum to track bugs and feature requests), but it's already helping to easily locate most of the current malware rootkits. It is compatible with Windows NT/2000/XP/2k3 and Vista. If you like to check out the new RootAlyzer you will find it in our forum: http://forums.spybot.info/showthread.php?t=24185

Here is also the direct download link.

Please set your computer to show all files.

* Double-click My Computer.

* Click the Tools menu, and then click Folder Options.

* Click the View tab.

* Clear "Hide file extensions for known file types."

* Under the "Hidden files" folder, select "Show hidden files and folders."

* Clear "Hide protected operating system files."

* Click Apply, and then click OK.

Please select the tab 'deep scan' and let it fully scan your Pc. The scan will take a moment, please be patient. After the scan is done please click on 'pack suspicious files' which is located right at the bottom. This will create a .cab file on your desktop which contains the log and the suspicious files the scan has found. Please send us an e-mail (with this .cab file as attachment) to: detections(at)spybot.info .

Please also download gmer: www.gmer.net and let it do a full scan on your Pc. Subsequent you will be allowed to save the log created during the scan. Please also send us this log.

Thanks! ;)

Best regards
Sandra
Team Spybot

Thank you for your input and assistance, spybotsandra. This is distressing news, but I am glad to have an official word.

Rootalyzer found nothing when I ran it, and I was not given the option to pack suspicious files, probably because the deep scan was blank at the end of the run. I find that a little peculiar, because I know that there are some SecuROM related files that RootkitRevealer usually finds when I run it (Harmless and needed for some games, but still they com up during those scans).

Unfortunately I didn't have time to run a gmer scan this morning. I will do so post-haste when I have the time in a few hours.

I let GMER run and do a complete scan, but I am uncertain if I used the program correctly. I selected 'scan' while on the 'Rootkit/Malware' tab, and the process began to scroll through every file on my harddrive. After roughly an hour of processing through the data, two discrepancies were found. One was PROCEXP111.SYS - A file almost certainly assocaited with Sysinternals Process Explorer app, which I run constantly. The second was amon.sys - which I believe is associated with NOD32's AMON real-time virus protection.

I selected 'Save' after the process had completed. This is what it saved to a file:


GMER 1.0.15.15011 [vuxkwcqn.exe] - http://www.gmer.net

Rootkit scan 2009-08-04 12:51:26

Windows 5.1.2600 Service Pack 3





---- Kernel code sections - GMER 1.0.15 ----



? C:\WINDOWS\system32\Drivers\PROCEXP111.SYS The system cannot find the file specified. !



---- Devices - GMER 1.0.15 ----



AttachedDevice \FileSystem\Ntfs \Ntfs amon.sys (Amon monitor/Eset )



---- EOF - GMER 1.0.15 ----



I will email this as directed. Again, I apologize for not having a rootalyzer .cab package to send, but the program didn't seem to find anything during a deep scan, and provided no option to package them. Thank you again for your help and consideration.

If this IS an infection, then why did it only start happening after we all downloaded the latest spybot update?

Quote:

---

Originally Posted by Werewolf

If this IS an infection, then why did it only start happening after we all downloaded the latest spybot update?

---

It's curious, but not unheard of. I agree that it seems a bit peculiar, but if update caused some behavioral change in the way Spybot works, it might conflict with the trojan in a new way.

Don't get me wrong - I hope to high holy habanero ham heaven that it's not an infection. Because if it is, this is the most insidious thing I've ever seen.

Gotcha.

I am running the scans now, and will be sending my logs to spybot. If any infections are found (or not) I will be sure to report back here right away. I hope you all do the same, so that we can all get this under wraps.

On a whim, I ran another GMER scan, and got this result:

GMER 1.0.15.15011 [vuxkwcqn.exe] - http://www.gmer.net
Rootkit scan 2009-08-05 00:29:48
Windows 5.1.2600 Service Pack 3


---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Ntfs \Ntfs amon.sys (Amon monitor/Eset )
AttachedDevice \FileSystem\Ntfs \Ntfs oUltraf.sys

---- EOF - GMER 1.0.15 ----


I don't know what oUltraf.sys is, but I can't put it in an archive, because it is being currently used by the system(!!). I can't upload it to VirusTotal, either. Googling about it seems to indicate this is possibly a kernal level system file, or some such, well beyond the reach of A/V software. Just keeping everyone posted about this issue.

So this is leaning towards being an actual infection???

The runtime error has been worrying me since last week and when I found this thread yesterday it was a big relief. I was really hoping someone would come in by now and say that it was just a bug.

The server I usually update with is Safer-Networking #1 and I'm using XP SP2.
I'll post a GMER log sometime today, if I don't have a heart attack first.

After todays update (05 Aug) I noted that my error after closing SBot changed to 'instruction at 0x06db40c2' vice 0x06cf40c2 and referenced memory at 0x0705e060 vice 0x0698de68' and the Runtime error 216 changed from 06CF40C2 to 06DB40C2.

I don't know if this means anything significant.

Again, this only happens on computer 1 (below), not on #2. Updates came from SecurityWonks.Net2 (USA) within moments of each other for both computers.

Again, Spybot, Malwarebytes, SuperAntispyware, NIS 2009 and MS Malsoft Removal tool show no problems.

I'm reluctant to run analytical software that I'm not familiar with, especially if it's only partially developed - so if I'm just cluttering this forum, let me know. I'll stop.

I am watching with interest.

I have sent in the suspicious file oUltraf.sys for analysis. I could archive and manipulate the file during the first part of system startup. Later in the day is when it seems to be inaccessable, for some reason, perhaps because the backdoor was open at that time? Additionally, I submitted it to Virustotal, which gave back 3/41 positives. I am uncertain as to what to make of the results I've seen for google searching.

I am quickly reaching a point of exhaustion. If this is an infection (which it seems to be) I am flabbergasted that it got through onto my system. I don't run executables from the web, I run NOD constantly, and MBAM and Spybot weekly, and I have autorun disabled. I am planning on taking the 'Nuke it from orbit' path and reformatting, but given the behavior of this, if it is an infection, I don't know the slightest way to prevent it's happening again.

Thanks. We got your sample for analysis. The file is using kernel functions but at this moment we are not sure, if this really is a rootkit. This could be a part of a legit software. We give this issue a high priority and are further investigating this.

You will get a special detection file, in case this is malware and the analysis has been accomplished.

Best,
Roberto.

Quote:

---

Originally Posted by roberto

Thanks. We got your sample for analysis. The file is using kernel functions but at this moment we are not sure, if this really is a rootkit. This could be a part of a legit software. We give this issue a high priority and are further investigating this.

You will get a special detection file, in case this is malware and the analysis has been accomplished.

Best,
Roberto.

---

Roberto, you are a professional and a gentleperson. Thank you and your team for giving this the attention and effort you have. Even if it turns out to be an infection, I'm still happy to have hard working people like you guys in our corner.

As a note I forgot to include in the email, or here: That oUltraf.sys file was located in C:\Documents and Settings\{My username}\Local Settings\Temp\ , which seems somewhat suspicious in it's own right.

Quote:

---

Originally Posted by VibrationalMode

As a note I forgot to include in the email, or here: That oUltraf.sys file was located in C:\Documents and Settings\{My username}\Local Settings\Temp\ , which seems somewhat suspicious in it's own right.

---

I too have been having this error for sometime now. I run McAfee 8.7i nightly as well as Spybot. Nothing has ever popped up. The scan actually completes, and once the program closes, then the error pops up. I would have thought that if it were an infection, it would prevent spybot from running in the first place. I haven't run a rootkit program yet. Seems to me that it's an incompatibility issue and not infection. Also, I didn't find the oUltraf.sys file in that directory or anywhere else.

Quote:

---

Originally Posted by NotGeordie

After todays update (05 Aug) I noted that my error after closing SBot changed to 'instruction at 0x06db40c2'...

I'm reluctant to run analytical software that I'm not familiar with, especially if it's only partially developed - so if I'm just cluttering this forum, let me know. I'll stop.

---

After today's two includes updates, I no longer get errors on program close! I hope that's good.

Are you reluctant to run Sandra's suggested GMER and/or RootAlyzer?
Today, GMER didn't find two hidden processes in red text, as it did on the 4th.

I don't want to cause clutter either, but this is helping me keep in touch, thus I'm hoping this is ok. This thread seems fine for general chatter on this topic.

Question: can .JPGs contain rootkit or other malware, or can I disregard JPG and other graphic files, i.e. BMP, etc.?

FWIW, I ran Spybot S&D from a system account (i.e., in a WinXP Command Prompt from C:\WINDOWS\system32\>...) and I was unable to reproduce any of the earlier errors.

I'll leave it to you more-experienced people to decide if this is really as important as I think it is.

same error pop-ups here, i guess the newest definitions are checked last in the scan and in my case more than 566000 items are checked during the scan. when i abort the scan at say 545000 checked items the error will not occur. my guess would be faulty latest definitions files.

Logically this makes a lot more sense to me than all of us being infected (i hope ...)

i guess some part of the definitions of late causes something in the program / process to lock(?) when closing down resulting in a crash. i guess all updates are exactly the same from the different servers?

According to kinos post after deactivating the trojans.sbi the runtime error did not occur any longer on his system. To make sure that this is not just a coincidence, please give it a try and report in. :thanks:

[To make sure that this is not just a coincidence, please give it a try and report in. :thanks:[/QUOTE]

No luck, Buster. I deactivated the Trojans.sbi, ran a scan twice and got the same error messages.

@ NotGeordie Thanks for reporting so quickly. Lets try something else. Please turn off all file sets but the usage tracks.

Another possible reason may be the new advcheck.dll, which has been released last week. Hence we would like you to install the old advcheck.dll, which can be found here. Please download the zip file, unzip and start the included .exe file. Thanks!