Spybot 1.6.2 update and Runtime Error 216

[VibrationalMode]

Hi everyone, just a quick question about a weird error I received this evening. Every week I do a thorough system scan with NOD32, MalwareByte AntiMalware, and then Spybot S&D.

This week I got through all the scans, right up to the very last one. The last one was Spybot, and durring the update process before the scan, version 1.6.2 was installed. The scan then went off without finding a thing. However, when I closed Spybot, after it had concluded the scan, I got the following error:

" The instruction at "0x074d40c2" referenced memory at "0x0777dec8". The memory could not be "read" "

Followed by:

" runtime error 216 at 074D40C2 "

Now, according to Microsoft, this error is caused by the SubSeven trojan (link here). I can't find out much more than this, as being the cause, since just about everything on Google says it's SubSeven, too. I can't imagine having a trojan, since Nod32 is running, already scanned thoroughly, and have also done the same with MalwareBytes and Spybot. Then again, Spybot did update and install a patch, and I don't know if that might've been hijacked.

Has anyone ever seen this kind of an error with Spybot before? I'm not sure if it's a trojan or just a problem with Spybot's new version, and I'm not sure of what steps to take next. Obviously Nod32, MalwareBytes, and Spybot can't see it if I am infected (even did a safe-mode rescan), and I don't want to install a second A/V program on top of an existing one... Is there anything I can do to see if the virus is there otherwise? Telltale signs and the sort?

Alternatively, does anyone have any experience with this "runtime error 216"? Is it really only caused by a virus, or is it possibly something else? Thanks.

[kinos]

i also recived this error,i did post 4 days ago but got no reply,perhaps its time to ask again.

i certaily dont want to go asking for help if i am not infected and this is not a virus.
it also statred with the new updates,imo its not a virus but seems to be affecting ceratin machine and not others.

still i might be wrong and i would like to know

perhaps this could be awasered?

[kinos]

try looking for this;

C:\WINDOWS\system32\bingoo.exe

it was on my system not sure if thats the reason but might be.
(its not now but i need to do more looking to find anything else that might be causeing this)

[VibrationalMode]

try looking for this;

C:\WINDOWS\system32\bingoo.exe

it was on my system not sure if thats the reason but might be.
(its not now but i need to do more looking to find anything else that might be causeing this)

I could not find that file on my system anywhere. Additionally, updated MBAM scans have yeilded no traces of Sub7. Given that Sub7 is roughly ten years old, I would certainly hope it could be found. I'm beginning to think more and more that Microsoft might not be correct, and this might not be a virus.

[Werewolf]

I am also having this problem after updating Spybot tonight. I hope some answers come soon.

[steve17]

I have the same problem. I have version 1.6.2.46. The address that can't be read will vary. Otherwise my errors are identical to the original poster's errors.

I find the crash only happens if I terminate Spybot after it completes a scan. If I stop the scan and terminate, it doesn't crash.

As far as I know, this is always the case when I'm running from my admin account. I tried it from my non-admin account using "runas", and it didn't crash.


P.S. It seems silly that I can't search for Runtime error 216. The search engine will ignore the 216. Maybe it thinks if it narrows down the search too much, it would make things too easy for me?

P.P.S. Maybe it's just a coincidence but I also use NOD32.

[Buster]

@ NotGeordie Thanks for reporting so quickly. Lets try something else. Please turn off all file sets but the usage tracks.

[Buster]

Another possible reason may be the new advcheck.dll, which has been released last week. Hence we would like you to install the old advcheck.dll, which can be found here. Please download the zip file, unzip and start the included .exe file. Thanks!

[NotGeordie]

Another possible reason may be the new advcheck.dll, which has been released last week. Hence we would like you to install the old advcheck.dll, which can be found here. Please download the zip file, unzip and start the included .exe file. Thanks!

Well, I tried that, but unfortunately, we're not there yet. The same errors came up after running Spybot. I did move the advcheck163.exe and advcheck163.zip into a temp file before executing the .exe you suggested. Should I place them back into their original folder, or is it more complex than that?

Of note, after executing the old .exe from the zip file you recommended there was NO advcheck.exe or advcheck.zip in my Program Files\Spybot-Search & Destroy\Updates folder, which is where the '163' versions did reside. Perhaps the instal didn't work and I should try again? Or is this what you expected to see?

I'll place the '162' versions in there manually, run again and see what happens, just for the heck of it.

[Buster]

@ NotGeordie
Sorry, I should have mentioned to end Spybot and Teatimer prior to this. Usually the advcheck.dll should be replaced by this installer. Did you enter the correct program path in the wizzard? The new old advcheck (1.62) should be placed at your Spybot - Search & Destroy program directory, most often "%programfiles%\Spybot - Search & Destroy\advcheck.dll"

@ Ras1974
Thanks, I'll keep waiting for your results. ;-)