Spybot 1.6.2 update and Runtime Error 216

V

VibrationalMode

New member
Hi everyone, just a quick question about a weird error I received this evening. Every week I do a thorough system scan with NOD32, MalwareByte AntiMalware, and then Spybot S&D.

This week I got through all the scans, right up to the very last one. The last one was Spybot, and durring the update process before the scan, version 1.6.2 was installed. The scan then went off without finding a thing. However, when I closed Spybot, after it had concluded the scan, I got the following error:

" The instruction at "0x074d40c2" referenced memory at "0x0777dec8". The memory could not be "read" "

Followed by:

" runtime error 216 at 074D40C2 "

Now, according to Microsoft, this error is caused by the SubSeven trojan (link here). I can't find out much more than this, as being the cause, since just about everything on Google says it's SubSeven, too. I can't imagine having a trojan, since Nod32 is running, already scanned thoroughly, and have also done the same with MalwareBytes and Spybot. Then again, Spybot did update and install a patch, and I don't know if that might've been hijacked.

Has anyone ever seen this kind of an error with Spybot before? I'm not sure if it's a trojan or just a problem with Spybot's new version, and I'm not sure of what steps to take next. Obviously Nod32, MalwareBytes, and Spybot can't see it if I am infected (even did a safe-mode rescan), and I don't want to install a second A/V program on top of an existing one... Is there anything I can do to see if the virus is there otherwise? Telltale signs and the sort?

Alternatively, does anyone have any experience with this "runtime error 216"? Is it really only caused by a virus, or is it possibly something else? Thanks.
 
i also recived this error,i did post 4 days ago but got no reply,perhaps its time to ask again.

i certaily dont want to go asking for help if i am not infected and this is not a virus.
it also statred with the new updates,imo its not a virus but seems to be affecting ceratin machine and not others.

still i might be wrong and i would like to know

perhaps this could be awasered?
 
Last edited:
try looking for this;

C:\WINDOWS\system32\bingoo.exe

it was on my system not sure if thats the reason but might be.
(its not now but i need to do more looking to find anything else that might be causeing this)
 
Last edited:
kinos said:
try looking for this;

C:\WINDOWS\system32\bingoo.exe

it was on my system not sure if thats the reason but might be.
(its not now but i need to do more looking to find anything else that might be causeing this)
Click to expand...

I could not find that file on my system anywhere. Additionally, updated MBAM scans have yeilded no traces of Sub7. Given that Sub7 is roughly ten years old, I would certainly hope it could be found. I'm beginning to think more and more that Microsoft might not be correct, and this might not be a virus.
 
I have the same problem. I have version 1.6.2.46. The address that can't be read will vary. Otherwise my errors are identical to the original poster's errors.

I find the crash only happens if I terminate Spybot after it completes a scan. If I stop the scan and terminate, it doesn't crash.

As far as I know, this is always the case when I'm running from my admin account. I tried it from my non-admin account using "runas", and it didn't crash.


P.S. It seems silly that I can't search for Runtime error 216. The search engine will ignore the 216. Maybe it thinks if it narrows down the search too much, it would make things too easy for me? :)

P.P.S. Maybe it's just a coincidence but I also use NOD32.
 
Last edited:
I disabled NOD32 antivirus and ran some scans. It didn't crash. I re-enabled the antivirus and it still didn't crash. Apparently that fixed my problem, at least temporarily.
 
just for info;i am not useing nod32.

its about time someone addressed this,it been a week since i first reported this.
even if only to let us know there working on it or somthing.
 
Last edited:
I had similar error messages after the 29 July SBot update. They haven't reappeared after a reboot, but I noticed something odd:

After the update downloaded, SBot closed by itself, an old style DOS screen came up momentarily running too quickly to make out what was happening, then SBot reopened.

This happened on both my computers. XP Home SP3.

MBAM, Superantispyware, NIS 2009, the Microsoft Malicious Software Removal Tool and SBot all showed the computers as being clean.

I've never seen this behavior from a SBot update before. Weird or expected?
 
NotGeordie said:
I had similar error messages after the 29 July SBot update. They haven't reappeared after a reboot, but I noticed something odd:

After the update downloaded, SBot closed by itself, an old style DOS screen came up momentarily running too quickly to make out what was happening, then SBot reopened.

This happened on both my computers. XP Home SP3.

MBAM, Superantispyware, NIS 2009, the Microsoft Malicious Software Removal Tool and SBot all showed the computers as being clean.

I've never seen this behavior from a SBot update before. Weird or expected?
Click to expand...

i belive thats the cmd sreen;expected,it happens occasionally,dont belive ive seen it in a yr or two,thats nothing to worry about.
 
Attempting to recreate the error after reboot on my end didn't work, either. I suppose it might've been a one-time issue? I'm certainly a little more relieved that other people are seeing this at the same time and in the same manner - Unless the latest update was hijacked from SpyBot and a SubSeven trojan was delieved with the autoupdate (possible), I'm hoping this is just a one-off fluke.

And, I will note, I noticed exactly the same behavior as NotGeordie.
 
I think that happens when Spybot downloads an update to the program. I think it closes the old program and re-opens the new one. Well, that's my theory, and I'm stickin' to it.
 
Werewolf said:
I am still having the problem after running spybot, even after rebooting.
Click to expand...

I'm just curious... If you let the scan conclude, and then after finishing the scan, let the computer sit for a moment or two before closing Spybot, does this happen? I'm wondering if the error happens from closing SpyBot too quickly after finishing a scan.
 
Well, the problems back again, only now it reads: The instruction at "06CF40C2" referenced memory at "0x0698de68". The memory could not be "read", followed by "Runtime error 216 at 06CF40C2".

I did let the program idle before shutting down.

There's 4 or 5 current posts under different threads with variants of this problem. Haven't seen any hard answers yet.
 
steve17 said:
I think that happens when Spybot downloads an update to the program. I think it closes the old program and re-opens the new one. Well, that's my theory, and I'm stickin' to it.
Click to expand...

I've had S S&D open a DOS window quite often when doing an update.

These popup errors have happened to me, since I think the last update:
The instruction at "0x0a1340c2" referenced memory at "0x0a3ddec8" and
Runtime Error 216 at 0A1340C2
The addresses may vary.

See the link to my first post at:
http://forums.spybot.info/showthread.php?p=325913#poststop

My S&D scan runs overnight, so there's hours between end of program run and program close.

Possibly some S&D code conflict?
There are reports of this error type in several places in the forums, as NotGeordie mentions
 
I admit that I am becoming increasingly concerned at the lack of any offical comment on this error. It is particularly distressing that the only google searches that reference a "runtime error 216" are security bulletins indicating that the error is caused by a Backdoor/Trojan.

I hate to be paranoid, but I am beginning to wonder if one of the spybot update mirrors was used as a vector to spread something nasty. Is there any log kept of spybot's updating behavior? Is there a log anywhere indicating what mirror was used to download the updates? If there is, then those of us experiencing this error can compare what mirrors we used for the download, and see if a trend emerges.

Edit: I will admit that I am not fully convinced that something nasty was spread, so I am not trying to say definitively that a trojan is being distributed. It's merely that the odd DOS behavior, multiple reports here, and this peculiar error are starting to make me very nervous!
 
Last edited:
29 July I updated both my computers within moments of each other from SecurityWonks.net#1(USA).

One computer exhibits the problem discussed, the other does not. So - I don't think it's a mirror being hijacked.

It probably doesn't matter but the one with the problem: XP Home SP3, Intel Core2 Duo@2GHz, 2GB RAM, IE8; the other: XP Home SP3, Intel Celeron@1.6 GHz, 1GB RAM, IE8. Both on a Wired net.

Both run NIS 2009 & S S&D 1.6.2.46 constantly with SuperAntiSpyware, MBAM and MS Malicious Software Removal Tool on demand.

Neither report any infection/malware.

Odd, this thread is getting lots of views. If you were to add the other threads reporting the same problem - LOTS of views! Still waiting for hard answers (patiently, mind you).
 
Last edited:
NotGeordie said:
29 July I updated both my computers within moments of each other from SecurityWonks.net#1(USA).

One computer exhibits the problem discussed, the other does not. So - I don't think it's a mirror being hijacked.

It probably doesn't matter but the one with the problem: XP Home SP3, Intel Core2 Duo@2GHz, 2GB RAM, IE8; the other: XP Home SP3, Intel Celeron@1.6 GHz, 1GB RAM, IE8. Both on a Wired net.

Both run NIS 2009 & S S&D 1.6.2.46 constantly with SuperAntiSpyware, MBAM and MS Malicious Software Removal Tool on demand.

Neither report any infection/malware.

Odd, this thread is getting lots of views. If you were to add the other threads reporting the same problem - LOTS of views! Still waiting for hard answers (patiently, mind you).
Click to expand...

Thanks, NotGeordie! Your experience fairly much rules out my paranoid theory, and I am happier for it.

I wonder if it has to do with hardware, then. I'm running a Core2 Duo e6750 @2.66GHz, 2GB RAM, XP Professional SP3, wired connection, and I browse with the latest version of Opera. I run NOD32 constantly, and I scan weekly with SpyBot and MalwareBytes AntiMalware.
 
Hello,

This problem you experience may be caused by an infection. Just to make sure you are not infected with a rootkit, please run a scan for rootkits. Rootkits are a technology that is more and more often used by malware to hide themselves on system level, making themselves invisible to standard tools. Our RootAlyzer shows you anything that uses certain rootkit technologies, even if it's not in Spybot-S&Ds detection database.

The RootAlyzer is a single tool which goes through the file system, the registry and process related lists. When you start RootAlyzer, it performs a very quick scan of a few important places, taking about a second on modern machines. To check the full system, you have the possibility of choosing a Deep Scan.

Currently, the RootAlyzer is a work in progress (with a new project tools category in our forum to track bugs and feature requests), but it's already helping to easily locate most of the current malware rootkits. It is compatible with Windows NT/2000/XP/2k3 and Vista. If you like to check out the new RootAlyzer you will find it in our forum: http://forums.spybot.info/showthread.php?t=24185

Here is also the direct download link.

Please set your computer to show all files.

* Double-click My Computer.

* Click the Tools menu, and then click Folder Options.

* Click the View tab.

* Clear "Hide file extensions for known file types."

* Under the "Hidden files" folder, select "Show hidden files and folders."

* Clear "Hide protected operating system files."

* Click Apply, and then click OK.

Please select the tab 'deep scan' and let it fully scan your Pc. The scan will take a moment, please be patient. After the scan is done please click on 'pack suspicious files' which is located right at the bottom. This will create a .cab file on your desktop which contains the log and the suspicious files the scan has found. Please send us an e-mail (with this .cab file as attachment) to: detections(at)spybot.info .

Please also download gmer: www.gmer.net and let it do a full scan on your Pc. Subsequent you will be allowed to save the log created during the scan. Please also send us this log.

Thanks! ;)

Best regards
Sandra
Team Spybot
 
You must log in or register to reply here.
Back
Top