Spybot 1.6.2 update and Runtime Error 216 [Archive]

VibrationalMode

2009-08-01, 07:42

Hi everyone, just a quick question about a weird error I received this evening. Every week I do a thorough system scan with NOD32, MalwareByte AntiMalware, and then Spybot S&D.

This week I got through all the scans, right up to the very last one. The last one was Spybot, and durring the update process before the scan, version 1.6.2 was installed. The scan then went off without finding a thing. However, when I closed Spybot, after it had concluded the scan, I got the following error:

" The instruction at "0x074d40c2" referenced memory at "0x0777dec8". The memory could not be "read" "

Followed by:

" runtime error 216 at 074D40C2 "

Now, according to Microsoft, this error is caused by the SubSeven trojan (link here (http://support.microsoft.com/kb/259279=)). I can't find out much more than this, as being the cause, since just about everything on Google says it's SubSeven, too. I can't imagine having a trojan, since Nod32 is running, already scanned thoroughly, and have also done the same with MalwareBytes and Spybot. Then again, Spybot did update and install a patch, and I don't know if that might've been hijacked.

Has anyone ever seen this kind of an error with Spybot before? I'm not sure if it's a trojan or just a problem with Spybot's new version, and I'm not sure of what steps to take next. Obviously Nod32, MalwareBytes, and Spybot can't see it if I am infected (even did a safe-mode rescan), and I don't want to install a second A/V program on top of an existing one... Is there anything I can do to see if the virus is there otherwise? Telltale signs and the sort?

Alternatively, does anyone have any experience with this "runtime error 216"? Is it really only caused by a virus, or is it possibly something else? Thanks.

kinos

2009-08-01, 21:10

i also recived this error,i did post 4 days ago but got no reply,perhaps its time to ask again.

i certaily dont want to go asking for help if i am not infected and this is not a virus.
it also statred with the new updates,imo its not a virus but seems to be affecting ceratin machine and not others.

still i might be wrong and i would like to know

perhaps this could be awasered?

kinos

2009-08-02, 00:58

VibrationalMode

2009-08-02, 01:06

try looking for this;

C:\WINDOWS\system32\bingoo.exe

it was on my system not sure if thats the reason but might be.
(its not now but i need to do more looking to find anything else that might be causeing this)

I could not find that file on my system anywhere. Additionally, updated MBAM scans have yeilded no traces of Sub7. Given that Sub7 is roughly ten years old, I would certainly hope it could be found. I'm beginning to think more and more that Microsoft might not be correct, and this might not be a virus.

Werewolf

2009-08-02, 05:54

I am also having this problem after updating Spybot tonight. I hope some answers come soon.

steve17

2009-08-02, 17:49

I have the same problem. I have version 1.6.2.46. The address that can't be read will vary. Otherwise my errors are identical to the original poster's errors.

I find the crash only happens if I terminate Spybot after it completes a scan. If I stop the scan and terminate, it doesn't crash.

As far as I know, this is always the case when I'm running from my admin account. I tried it from my non-admin account using "runas", and it didn't crash.

P.S. It seems silly that I can't search for Runtime error 216. The search engine will ignore the 216. Maybe it thinks if it narrows down the search too much, it would make things too easy for me? :)

P.P.S. Maybe it's just a coincidence but I also use NOD32.

steve17

2009-08-03, 15:17

I disabled NOD32 antivirus and ran some scans. It didn't crash. I re-enabled the antivirus and it still didn't crash. Apparently that fixed my problem, at least temporarily.

kinos

2009-08-03, 15:55

just for info;i am not useing nod32.

its about time someone addressed this,it been a week since i first reported this.
even if only to let us know there working on it or somthing.

NotGeordie

2009-08-03, 16:00

I had similar error messages after the 29 July SBot update. They haven't reappeared after a reboot, but I noticed something odd:

After the update downloaded, SBot closed by itself, an old style DOS screen came up momentarily running too quickly to make out what was happening, then SBot reopened.

This happened on both my computers. XP Home SP3.

MBAM, Superantispyware, NIS 2009, the Microsoft Malicious Software Removal Tool and SBot all showed the computers as being clean.

I've never seen this behavior from a SBot update before. Weird or expected?

kinos

2009-08-03, 16:19

VibrationalMode

2009-08-03, 17:24

Attempting to recreate the error after reboot on my end didn't work, either. I suppose it might've been a one-time issue? I'm certainly a little more relieved that other people are seeing this at the same time and in the same manner - Unless the latest update was hijacked from SpyBot and a SubSeven trojan was delieved with the autoupdate (possible), I'm hoping this is just a one-off fluke.

And, I will note, I noticed exactly the same behavior as NotGeordie.

Werewolf

2009-08-03, 19:18

I am still having the problem after running spybot, even after rebooting.

steve17

2009-08-03, 21:24

I think that happens when Spybot downloads an update to the program. I think it closes the old program and re-opens the new one. Well, that's my theory, and I'm stickin' to it.

VibrationalMode

2009-08-03, 21:26

I am still having the problem after running spybot, even after rebooting.

I'm just curious... If you let the scan conclude, and then after finishing the scan, let the computer sit for a moment or two before closing Spybot, does this happen? I'm wondering if the error happens from closing SpyBot too quickly after finishing a scan.

NotGeordie

2009-08-03, 21:40

Well, the problems back again, only now it reads: The instruction at "06CF40C2" referenced memory at "0x0698de68". The memory could not be "read", followed by "Runtime error 216 at 06CF40C2".

I did let the program idle before shutting down.

There's 4 or 5 current posts under different threads with variants of this problem. Haven't seen any hard answers yet.

Dugie

2009-08-04, 04:40

I think that happens when Spybot downloads an update to the program. I think it closes the old program and re-opens the new one. Well, that's my theory, and I'm stickin' to it.

I've had S S&D open a DOS window quite often when doing an update.

These popup errors have happened to me, since I think the last update:
The instruction at "0x0a1340c2" referenced memory at "0x0a3ddec8" and
Runtime Error 216 at 0A1340C2
The addresses may vary.

See the link to my first post at:
http://forums.spybot.info/showthread.php?p=325913#poststop

My S&D scan runs overnight, so there's hours between end of program run and program close.

Possibly some S&D code conflict?
There are reports of this error type in several places in the forums, as NotGeordie mentions

VibrationalMode

2009-08-04, 08:22

I admit that I am becoming increasingly concerned at the lack of any offical comment on this error. It is particularly distressing that the only google searches that reference a "runtime error 216" are security bulletins indicating that the error is caused by a Backdoor/Trojan.

I hate to be paranoid, but I am beginning to wonder if one of the spybot update mirrors was used as a vector to spread something nasty. Is there any log kept of spybot's updating behavior? Is there a log anywhere indicating what mirror was used to download the updates? If there is, then those of us experiencing this error can compare what mirrors we used for the download, and see if a trend emerges.

Edit: I will admit that I am not fully convinced that something nasty was spread, so I am not trying to say definitively that a trojan is being distributed. It's merely that the odd DOS behavior, multiple reports here, and this peculiar error are starting to make me very nervous!

NotGeordie

2009-08-04, 09:22

VibrationalMode

2009-08-04, 09:33

29 July I updated both my computers within moments of each other from SecurityWonks.net#1(USA).

One computer exhibits the problem discussed, the other does not. So - I don't think it's a mirror being hijacked.

It probably doesn't matter but the one with the problem: XP Home SP3, Intel Core2 Duo@2GHz, 2GB RAM, IE8; the other: XP Home SP3, Intel Celeron@1.6 GHz, 1GB RAM, IE8. Both on a Wired net.

Both run NIS 2009 & S S&D 1.6.2.46 constantly with SuperAntiSpyware, MBAM and MS Malicious Software Removal Tool on demand.

Neither report any infection/malware.

Odd, this thread is getting lots of views. If you were to add the other threads reporting the same problem - LOTS of views! Still waiting for hard answers (patiently, mind you).

Thanks, NotGeordie! Your experience fairly much rules out my paranoid theory, and I am happier for it.

I wonder if it has to do with hardware, then. I'm running a Core2 Duo e6750 @2.66GHz, 2GB RAM, XP Professional SP3, wired connection, and I browse with the latest version of Opera. I run NOD32 constantly, and I scan weekly with SpyBot and MalwareBytes AntiMalware.

spybotsandra

2009-08-04, 15:07

Hello,

This problem you experience may be caused by an infection. Just to make sure you are not infected with a rootkit, please run a scan for rootkits. Rootkits are a technology that is more and more often used by malware to hide themselves on system level, making themselves invisible to standard tools. Our RootAlyzer shows you anything that uses certain rootkit technologies, even if it's not in Spybot-S&Ds detection database.

The RootAlyzer is a single tool which goes through the file system, the registry and process related lists. When you start RootAlyzer, it performs a very quick scan of a few important places, taking about a second on modern machines. To check the full system, you have the possibility of choosing a Deep Scan.

Currently, the RootAlyzer is a work in progress (with a new project tools category in our forum to track bugs and feature requests), but it's already helping to easily locate most of the current malware rootkits. It is compatible with Windows NT/2000/XP/2k3 and Vista. If you like to check out the new RootAlyzer you will find it in our forum: http://forums.spybot.info/showthread.php?t=24185

Here is also the direct download link (http://www.spybotupdates.biz/files/rootalyz-0.3.4.47.zip).

Please set your computer to show all files.

* Double-click My Computer.

* Click the Tools menu, and then click Folder Options.

* Click the View tab.

* Clear "Hide file extensions for known file types."

* Under the "Hidden files" folder, select "Show hidden files and folders."

* Clear "Hide protected operating system files."

* Click Apply, and then click OK.

Please select the tab 'deep scan' and let it fully scan your Pc. The scan will take a moment, please be patient. After the scan is done please click on 'pack suspicious files' which is located right at the bottom. This will create a .cab file on your desktop which contains the log and the suspicious files the scan has found. Please send us an e-mail (with this .cab file as attachment) to: detections(at)spybot.info .

Please also download gmer: www.gmer.net and let it do a full scan on your Pc. Subsequent you will be allowed to save the log created during the scan. Please also send us this log.

Thanks! ;)

Best regards
Sandra
Team Spybot

VibrationalMode

2009-08-04, 18:07

Thank you for your input and assistance, spybotsandra. This is distressing news, but I am glad to have an official word.

Rootalyzer found nothing when I ran it, and I was not given the option to pack suspicious files, probably because the deep scan was blank at the end of the run. I find that a little peculiar, because I know that there are some SecuROM related files that RootkitRevealer usually finds when I run it (Harmless and needed for some games, but still they com up during those scans).

Unfortunately I didn't have time to run a gmer scan this morning. I will do so post-haste when I have the time in a few hours.

VibrationalMode

2009-08-04, 23:28

I let GMER run and do a complete scan, but I am uncertain if I used the program correctly. I selected 'scan' while on the 'Rootkit/Malware' tab, and the process began to scroll through every file on my harddrive. After roughly an hour of processing through the data, two discrepancies were found. One was PROCEXP111.SYS - A file almost certainly assocaited with Sysinternals Process Explorer app, which I run constantly. The second was amon.sys - which I believe is associated with NOD32's AMON real-time virus protection.

I selected 'Save' after the process had completed. This is what it saved to a file:

GMER 1.0.15.15011 [vuxkwcqn.exe] - http://www.gmer.net

Rootkit scan 2009-08-04 12:51:26

Windows 5.1.2600 Service Pack 3

---- Kernel code sections - GMER 1.0.15 ----

? C:\WINDOWS\system32\Drivers\PROCEXP111.SYS The system cannot find the file specified. !

---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Ntfs \Ntfs amon.sys (Amon monitor/Eset )

---- EOF - GMER 1.0.15 ----

I will email this as directed. Again, I apologize for not having a rootalyzer .cab package to send, but the program didn't seem to find anything during a deep scan, and provided no option to package them. Thank you again for your help and consideration.

Werewolf

2009-08-05, 06:23

If this IS an infection, then why did it only start happening after we all downloaded the latest spybot update?

VibrationalMode

2009-08-05, 06:40

If this IS an infection, then why did it only start happening after we all downloaded the latest spybot update?

It's curious, but not unheard of. I agree that it seems a bit peculiar, but if update caused some behavioral change in the way Spybot works, it might conflict with the trojan in a new way.

Don't get me wrong - I hope to high holy habanero ham heaven that it's not an infection. Because if it is, this is the most insidious thing I've ever seen.

Werewolf

2009-08-05, 07:42

Gotcha.

I am running the scans now, and will be sending my logs to spybot. If any infections are found (or not) I will be sure to report back here right away. I hope you all do the same, so that we can all get this under wraps.

VibrationalMode

2009-08-05, 10:34

On a whim, I ran another GMER scan, and got this result:

GMER 1.0.15.15011 [vuxkwcqn.exe] - http://www.gmer.net
Rootkit scan 2009-08-05 00:29:48
Windows 5.1.2600 Service Pack 3

---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Ntfs \Ntfs amon.sys (Amon monitor/Eset )
AttachedDevice \FileSystem\Ntfs \Ntfs oUltraf.sys

---- EOF - GMER 1.0.15 ----

I don't know what oUltraf.sys is, but I can't put it in an archive, because it is being currently used by the system(!!). I can't upload it to VirusTotal, either. Googling about it seems to indicate this is possibly a kernal level system file, or some such, well beyond the reach of A/V software. Just keeping everyone posted about this issue.

HH788

2009-08-05, 13:47

So this is leaning towards being an actual infection???

The runtime error has been worrying me since last week and when I found this thread yesterday it was a big relief. I was really hoping someone would come in by now and say that it was just a bug.

The server I usually update with is Safer-Networking #1 and I'm using XP SP2.
I'll post a GMER log sometime today, if I don't have a heart attack first.

NotGeordie

2009-08-05, 15:16

After todays update (05 Aug) I noted that my error after closing SBot changed to 'instruction at 0x06db40c2' vice 0x06cf40c2 and referenced memory at 0x0705e060 vice 0x0698de68' and the Runtime error 216 changed from 06CF40C2 to 06DB40C2.

I don't know if this means anything significant.

Again, this only happens on computer 1 (below), not on #2. Updates came from SecurityWonks.Net2 (USA) within moments of each other for both computers.

Again, Spybot, Malwarebytes, SuperAntispyware, NIS 2009 and MS Malsoft Removal tool show no problems.

I'm reluctant to run analytical software that I'm not familiar with, especially if it's only partially developed - so if I'm just cluttering this forum, let me know. I'll stop.

I am watching with interest.

VibrationalMode

2009-08-05, 16:49

I have sent in the suspicious file oUltraf.sys for analysis. I could archive and manipulate the file during the first part of system startup. Later in the day is when it seems to be inaccessable, for some reason, perhaps because the backdoor was open at that time? Additionally, I submitted it to Virustotal, which gave back 3/41 positives. I am uncertain as to what to make of the results I've seen for google searching.

I am quickly reaching a point of exhaustion. If this is an infection (which it seems to be) I am flabbergasted that it got through onto my system. I don't run executables from the web, I run NOD constantly, and MBAM and Spybot weekly, and I have autorun disabled. I am planning on taking the 'Nuke it from orbit' path and reformatting, but given the behavior of this, if it is an infection, I don't know the slightest way to prevent it's happening again.

roberto

2009-08-05, 19:02

VibrationalMode

2009-08-05, 19:33

Thanks. We got your sample for analysis. The file is using kernel functions but at this moment we are not sure, if this really is a rootkit. This could be a part of a legit software. We give this issue a high priority and are further investigating this.

You will get a special detection file, in case this is malware and the analysis has been accomplished.

Best,
Roberto.

Roberto, you are a professional and a gentleperson. Thank you and your team for giving this the attention and effort you have. Even if it turns out to be an infection, I'm still happy to have hard working people like you guys in our corner.

As a note I forgot to include in the email, or here: That oUltraf.sys file was located in C:\Documents and Settings\{My username}\Local Settings\Temp\ , which seems somewhat suspicious in it's own right.

TerminalMan

2009-08-05, 20:33

As a note I forgot to include in the email, or here: That oUltraf.sys file was located in C:\Documents and Settings\{My username}\Local Settings\Temp\ , which seems somewhat suspicious in it's own right.

I too have been having this error for sometime now. I run McAfee 8.7i nightly as well as Spybot. Nothing has ever popped up. The scan actually completes, and once the program closes, then the error pops up. I would have thought that if it were an infection, it would prevent spybot from running in the first place. I haven't run a rootkit program yet. Seems to me that it's an incompatibility issue and not infection. Also, I didn't find the oUltraf.sys file in that directory or anywhere else.

Dugie

2009-08-06, 00:10

After todays update (05 Aug) I noted that my error after closing SBot changed to 'instruction at 0x06db40c2'...

I'm reluctant to run analytical software that I'm not familiar with, especially if it's only partially developed - so if I'm just cluttering this forum, let me know. I'll stop.

After today's two includes updates, I no longer get errors on program close! I hope that's good.

Are you reluctant to run Sandra's suggested GMER and/or RootAlyzer?
Today, GMER didn't find two hidden processes in red text, as it did on the 4th.

I don't want to cause clutter either, but this is helping me keep in touch, thus I'm hoping this is ok. This thread seems fine for general chatter on this topic.

Question: can .JPGs contain rootkit or other malware, or can I disregard JPG and other graphic files, i.e. BMP, etc.?

nottageek

2009-08-06, 00:14

FWIW, I ran Spybot S&D from a system account (i.e., in a WinXP Command Prompt from C:\WINDOWS\system32\>...) and I was unable to reproduce any of the earlier errors.

I'll leave it to you more-experienced people to decide if this is really as important as I think it is.

Ras1974

2009-08-06, 00:44

same error pop-ups here, i guess the newest definitions are checked last in the scan and in my case more than 566000 items are checked during the scan. when i abort the scan at say 545000 checked items the error will not occur. my guess would be faulty latest definitions files.

Logically this makes a lot more sense to me than all of us being infected (i hope ...)

Ras1974

2009-08-06, 01:21

i guess some part of the definitions of late causes something in the program / process to lock(?) when closing down resulting in a crash. i guess all updates are exactly the same from the different servers?

Buster

2009-08-06, 08:39

According to kinos post (http://forums.spybot.info/showpost.php?p=326661&postcount=8) after deactivating the trojans.sbi the runtime error did not occur any longer on his system. To make sure that this is not just a coincidence, please give it a try and report in. :thanks:

NotGeordie

2009-08-06, 09:41

[To make sure that this is not just a coincidence, please give it a try and report in. :thanks:[/QUOTE]

No luck, Buster. I deactivated the Trojans.sbi, ran a scan twice and got the same error messages.

Buster

2009-08-06, 10:37

@ NotGeordie Thanks for reporting so quickly. Lets try something else. Please turn off all file sets but the usage tracks.

Buster

2009-08-06, 10:57

NotGeordie

2009-08-06, 10:59

@ NotGeordie Thanks for reporting so quickly. Lets try something else. Please turn off all file sets but the usage tracks.

Ok, I did that Buster. The Error reports (both "The instruction at; etc." and the "Runtime error 216") did not come up.

My usage tracks were revealed, I shut down - no error reports.

Hmmmm.

Ras1974

2009-08-06, 11:15

I still think it has to do with the recent updates concerning the last part of the scan. I also believe the very last part of the scan includes scanning the downloading directories. I don`t know if the recent updates also covered that part.

I really can`t believe the errors are due to malware. The pop-ups are generated because process SpybotSD.exe cannot be shut down. So it looks like a bug in the program to me.

Buster

2009-08-06, 11:22

@ NotGoerdie
Ok, so lets see if this also happens using the old advcheck linked in my last post.

@ Ras1974
If you are experiencing the same as NotGoerdie, please try the old advcheck.dll linked above.

Ras1974

2009-08-06, 11:32

Thanks for your super quick reply buster, i will try that tonight @home. I`m at work now. I will post my results tonight in this thread.

NotGeordie

2009-08-06, 11:42

Another possible reason may be the new advcheck.dll, which has been released last week. Hence we would like you to install the old advcheck.dll, which can be found here (http://www.spybotupdates.com/updates/files/advcheck162.zip). Please download the zip file, unzip and start the included .exe file. Thanks!

Well, I tried that, but unfortunately, we're not there yet. The same errors came up after running Spybot. I did move the advcheck163.exe and advcheck163.zip into a temp file before executing the .exe you suggested. Should I place them back into their original folder, or is it more complex than that?

Of note, after executing the old .exe from the zip file you recommended there was NO advcheck.exe or advcheck.zip in my Program Files\Spybot-Search & Destroy\Updates folder, which is where the '163' versions did reside. Perhaps the instal didn't work and I should try again? Or is this what you expected to see?

I'll place the '162' versions in there manually, run again and see what happens, just for the heck of it.

Buster

2009-08-06, 11:59

@ NotGeordie
Sorry, I should have mentioned to end Spybot and Teatimer prior to this. Usually the advcheck.dll should be replaced by this installer. Did you enter the correct program path in the wizzard? The new old advcheck (1.62) should be placed at your Spybot - Search & Destroy program directory, most often "%programfiles%\Spybot - Search & Destroy\advcheck.dll"

@ Ras1974
Thanks, I'll keep waiting for your results. ;-)

NotGeordie

2009-08-06, 12:12

@ NotGeordie
Sorry, I should have mentioned to end Spybot and Teatimer prior to this. Usually the advcheck.dll should be replaced by this installer. Did you enter the correct program path in the wizzard? The new old advcheck (1.62) should be placed at your Spybot - Search & Destroy program directory, most often "%programfiles%\Spybot - Search & Destroy\advcheck.dll"

OK, my last attempt, previous post didn't work. I'll undo what I've done, shut down TeaTimer/Spybot and try again. I'll get back to you after I walk the dog (his priority, not mine!).

Ras1974

2009-08-06, 12:21

:funny:

NotGeordie

2009-08-06, 13:09

Sorry Buster, no luck. I turned off Teatimer, closed S&D, ran the 1.6.2 advcheck.exe, then a scan. Same error.

I rebooted, ran again. Same error.

I disconnected from the net, turned off My NIS 2009, ran the .exe again, scanned. Same error.

Of note, perhaps, even after running the 1.6.2 advcheck.exe I noticed that the advcheck.dll in my S & D folder reads version 1.6.3.17, created 25/07/2008.

I don't know.

Can you tell me how to restore things back to the way they were? Or, I have a few minutes if you want me to try something else.

Ras1974

2009-08-06, 13:22

NotGeordie, should the .dll not have today as created date? What if you rename the current .dll and then again run the .exe to get the new .dll in the SpybotSD program file directory. After that run the scan again, wish i was home so that i could also try :sad:

NotGeordie

2009-08-06, 13:44

Don't know about that RAS.

Got to go to hospital (really, this is giving me the plotz).

I'll check back in about 6-7 hours.

Ras1974

2009-08-06, 14:25

Never heard of that expression before NotGeordie, but i can imagine how you feel, i`ll give it a go tonight. Just check back later on. Don`t worry, you`ll see, just a bug and no malware.

Buster

2009-08-06, 15:03

You can download the latest advcheck.dll here (http://www.spybotupdates.com/updates/files/advcheck163.zip). The date is correct. The file has been created that day, zipped and now "copied" on your system, no need to worry.
Got to go to hospital
Hope everything is fine under given circumstances.

Ras1974

2009-08-06, 15:11

your service is great buster, can`t wait to get home :thanks:

VibrationalMode

2009-08-06, 18:24

Sorry for my lack of communication in this thread so far! I admit, given some of the odd things I was seeing, my paranoia exceeded my patience. I reformatted my computer, and installed the Win7 7100 RC yesterday. It's been a slow process of getting the machine back together, but I plan to install Spybot S&D and run a test as soon as I have the time.

I figure if I see the same errors on a freshly installed machine running a new x64 OS, then it's safe to say it's not malware.

TerminalMan

2009-08-06, 18:51

I tried only scanning on the usage tracks as suggested and received no errors upon shut down of Spybot. I unzipped the advcheck162 file in the updates directory and ran the .exe file from there. Afterwards, I ran a complete scan. Upon exiting Spybot, I received the familiar errors. I reinstalled the advcheck163 file the same way, and ran another complete scan. Upon shut down, once again I received the errors.

Has anyone uninstalled Spybot completely, reinstalled, and seen the error again?

Ras1974

2009-08-06, 19:16

the advcheck.dll solution did not work for me, but thanks though buster.

oldtimer

2009-08-06, 23:37

Terminal man, I did the complete uninstall and reinstall. Still got the 216 error when I exited after the first scan with the new program.

VibrationalMode

2009-08-07, 00:15

I have been unable to reproduce the error on the machine after reformatting and installing Windows 7 RC 7100. I'm running pretty much everything I was under XP, only I've migrated over to NOD32 v4. Since it seemed to be a sporadic issue, I'll certainly report back here if I see it happen again.

Also, kudos to the spybot team again. Not only does Spybot work wonderfully in Win7 (Horray for immunizations on Opera), but your feedback and service here are excellent.

Buster

2009-08-07, 08:13

Okay, thanks all you for your tests so far.:bigthumb: Looks like this is caused by one of our sbi files. To find out which one is causing this error, please select one by one and run a scan after each selection. Looks like we are getting closer to to find the origin of this Error 216.

NotGeordie

2009-08-07, 11:31

Hi all, especially Buster, who has worked so hard on this.

I hate to throw a spanner in the works, but this is what I did and why and what happened.

Working with Buster, I had changed a few files in Spybot looking for possible options to identify the problem. Just to make sure that I was working with the same system as everyone else, after those changes and before running with different .sbi sets disabled, I compared the Spybot files on computer #1 (below) with computer #2 (below, which never exhibited the Runtime error). There were some significant differences which I attributed to the work Buster and I had done.

So - in order to get to the same benchmark as the rest of you I completely uninstalled Spybot using the 'Revo uninstaller' and deleted all remainders including registry keys manually.

I then re-installed Spybot.

1st run - no errors.
2nd run - no errors.
I rebooted - 3rd run - no errors.
I surfed a bit (just to see if anything changed) then checked for updates (there were none, of course, except the English description, which I never bother to download).
4th run - no errors.

I don't pretend to understand, but there it is. My Spybot seems to be fixed.

I'll continue to watch this thread with interest and to offer my (somewhat incompetent) help if needed.

By the way, especially as TerminalMan asked, I had uninstalled and reinstalled as a first step to problem solution. It didn't help then. Perhaps the Revo uninstaller (which I didn't use the first time)and hunting down reg keys helped. I don't pretend to know.

Buster

2009-08-07, 12:12

@ NotGeordie
Did you already reboot your system since the re-installation?

NotGeordie

2009-08-07, 12:50

Yes, Buster. I ran twice before re-booting, no errors. I re-booted and have now run it 6 times with no errors.

Does it make any sense to you?

Buster

2009-08-07, 13:17

Did you already download the latest advcheck.dll update?:scratch:

NotGeordie

2009-08-07, 13:29

Did you already download the latest advcheck.dll update?:scratch:

I didn't do so manually from any site and, carelessly I neglected to check the dates of the updates I downloaded when I did the re-install.

If the new advcheck.dll was downloaded as part of the standard downloads upon re-installing, then I guess I did.

The advcheck.dll in my Spybot folder is Version 1.6.3.17, size 1.47MB.

Does that help?

NotGeordie

2009-08-07, 13:55

The advcheck.dll in my Spybot folder is Version 1.6.3.17, size 1.47MB.

Does that help?

Oh, and if it's helpful, Date Created for the .dll is 07/08/2009 4:08AM, but I think that refers to the time I did the re-install. I could be wrong. It's happened before.

Buster

2009-08-07, 13:56

Hmm, this is exactly the same advcheck.dll which caused the error in the past. Lets see, if somebody else can figure out which sbi file is causing this, who still has this error. But anyway, this is also an interesting information. Thanks for reporting NotGeordie! :bigthumb:

kinos

2009-08-07, 22:44

info;
i did the same unistalled with revo,the only diff is i downloaded the english help files.

kinos

2009-08-07, 23:06

i downloaded the advcheck.dll ticked the trojan.sbi file set;no errors.

i have made some changes to my pc i am now useing nod32
(webroot isnt the product it used to be imo)

i was useing webroot anti spyware/anti v with za free.

i will try more file sets but i cant sit here for ages (pian from prolased disc/trapped satic nerve) i will post anthing i find thou.

whocando

2009-08-08, 16:46

I have Spybot ver 1.6.3.51 installed

I don't have
nod32
advcheck.dll
advcheck163.dll
oUltraf.sys
amon.sys

I am running
xp home sp3
norton 360
advcheck163.exe

I have recently been getting the same error messages as all of you.

sixshot

2009-08-09, 06:22

I am having the same 216 error, I narrowed it down to malewareC.sbi, hope this helps

Ras1974

2009-08-09, 12:39

is the SpybotSD team itself testing to fix this issue? are you guys able to reproduce this error?

NotGeordie

2009-08-09, 12:56

@ Ras: a little unfair, don't you think? Buster (Member Team Spybot) has been suggesting a lot of things to try and is obviously working to figure it out.

A contribution would be to try running with various .sbi files loaded singly and posting your results. Give him something to work with, but not on Sunday.

They'll get it figured out.

Ras1974

2009-08-09, 13:34

I did not meant it like that NotGeordie. I am just curious if the SpybotSD team itself is trying to reproduce this error on their own machines. Or if they encountered this error themselves on (one of) their own p.c.`s. Because i have no idea how many users are affected by this.

The error is irritating but not too big. I mean the error comes up after you`ve already done everything you wanted to do with SpybotSD.

kinos

2009-08-09, 21:18

thats strange that sbi set never caused problems on my comp it was the trojan.sbi set that did.however its seems like differnt file sets are causeing differnt problems for each off us.

since i download that advcheck.dll i cant repoduce the error

the only other thing ive done is run sfc,thats out in the wild i know but heck this has got complicated and i am just trying to help.

is anyone useing I.E btw?
or are we all useing opera or firefox?
if so any add ons?

this threads getting a bit long to read all.

Buster

2009-08-10, 18:16

TerminalMan

2009-08-10, 18:46

I tried a "moderate" level uninstall with Revo uninstaller and then re-installed Spybot. After updating the software and immunizing, I ran a scan and upon shut down of the program, received the ill-fated error yet again. I have not rebooted yet, but plan to do that next. I am using Firefox for browsing, but still have IE 8 on my computer. I have yet to try disabling the .sbi files one at a time. Anyone else have luck with uninstalling besides NotGeordie (and do you do the most aggressive uninstall?)?

NotGeordie

2009-08-10, 19:36

Anyone else have luck with uninstalling besides NotGeordie (and do you do the most aggressive uninstall?)?

Yes, I did the most aggressive uninstall, followed it with CCleaner which picked up some remaining keys and then manually rooted through the registry for any remaining bits (there were a couple).

I suppose that what I did was to effectively remove every bit of Spybot that I could find and then installed 'completely' fresh.

I've been running full scans with Spybot since then, a few times a day to see if I can get the error to show up again, but it hasn't reappeared.

Beats me.

TerminalMan

2009-08-10, 22:33

Tried a more aggressive uninstall and had no success. I then tried individual file sets... I've narrowed it down to the following (at least on my computer):

trojans.sbi
spyware.sbi

Unchecking both those sets allows me to exit the program without error. Now that I know that, what's the next step?

kinos

2009-08-11, 00:34

i did the same as NotGeordie and done a aggressive uninstall with revo,then plucked out any remaints,then ran checkdisk,before i re-installed.
updated,got errors,installed that advcheck.dll,ran checkdisk rebooted,removed tracks with mru blaster (javas cool) then no errors.
thats it i cant see anything else i can say that will help.

David12846

2009-08-11, 05:49

A week ago I deleted SpyBot completely. I re-installed it a few days ago and accepted all the updates. I'm also getting the Runtime Error 216 like others are getting.

I wish I had time to monkey around with all the suggested fixes, but I don't. :sad: I DID have time to run my Panda Rootkit Finder with a reboot, but it found nothing (A different rootkit finder was suggested in a previous posting). I could not get SpyBot "Tools>Bug Report" to send my bug report as suggested by Buster (below). The mail settings tripped me up (Thunderbird). I copied and pasted the "system generated report" into a standard e-mail along with the Configuration.ini file attached. Hope that is sufficient.

David

Hello @ all,

first of all, thanks for keeping an eye on this thread. :bigthumb:
...Therefore I ask everyone who is still experiencing this bug to please send a complete bug report to detections@spybot.info with a reference to this thread. :thanks:

TexasDayLily

2009-08-11, 19:18

I've been experiencing these same errors on closing SpybotSD after completing a scan.

I've tried to isolate the conditions where I get the errors and when I don't. Today I figured out that the error occurs when firefox is up during the scan and not when it is not up. I reproduced the error twice today while firefox was up and I avoided the error in between the two error runs buy closing firefox. My firefox has about 90 tabs open (I saved the session) and I use a lot of extentions. On the first error I noticed a quick message "Registry hives may take a while to unload" (from memory) before the first popup message occurred. I was distracted on the second run which reproduced the error so I didn't see the message.

Here's MR Tech's Toolkit - My Config listing for my firefox.
Generated: Tue Aug 11 2009 10:49:27 GMT-0500 (Central Daylight Time)
User Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.2) Gecko/20090729 Firefox/3.5.2 (.NET CLR 3.5.30729)
Build ID: 20090729225027

Enabled Extensions: [20]

* Adblock Plus 1.1
* Adblock Plus: Element Hiding Helper 1.0.6
* Add Bookmark Here ² 3.5.20090621
* FireFTP 1.0.5
* Forecastbar Enhanced 0.9.6
* Java Console 6.0.14
* Java Console 6.0.15
* Java Quick Starter 1.0
* Launchy 4.2.1
* Link Alert 0.9
* Linkification 1.3.6
* MR Tech Toolkit 6.0.3.4
* NoScript 1.9.8
* OpenBook 2.0.1.1
* Session Manager 0.6.6.2
* Sunrise XP 1.0
* Tab Kit 0.5.6
* WOT 20090414
* Xmarks 3.1.0
* Zotero 1.0.10

Disabled Extensions: [22]

* All-in-One Sidebar 0.7.10
* Bookmark Duplicate Detector 0.7.5
* Bookmarks LinkChecker 0.6.8.4
* Calculator 1.1.12
* Dafizilla Table2Clipboard 0.2.1
* DictionarySearch 3.5.1
* Firefox Search Sidebar 1.2
* FirefoxView 1.0
* FireShot 0.77
* FlashGot 1.2
* Greasemonkey 0.8.20090123.1
* IE View Lite 1.3.4
* iMacros for Firefox 6.2.4.0
* Image Zoom 0.3.1
* InfoLister 0.10.1
* Microsoft .NET Framework Assistant 1.0
* Personas for Firefox 1.2.2
* ProCon Latte 1.7.9.7
* Screengrab 0.96.1
* Tagging For Multiple Bookmarks 1.7
* TagSifter 4.1.4
* Tweak Network 1.3

Total Extensions: 42

Installed Themes: [1]

* Default

Installed Plugins: (17)

* Adobe Acrobat
* Foxit Reader Plugin for Mozilla
* Java Deployment Toolkit 6.0.140.8
* Java Deployment Toolkit 6.0.150.3
* Java(TM) Platform SE 6 U15
* Microsoft Office 2003
* Microsoft® DRM
* Microsoft® Windows Media Player Firefox Plugin
* Mozilla Default Plug-in
* QuickTime Plug-in 7.6.2
* RealArcade Mozilla Plugin
* ScorchNetscapePlugin
* Shockwave Flash
* Shockwave for Director
* Windows Genuine Advantage
* Windows Media Player Plug-in Dynamic Link Library
* Windows Presentation Foundation

I was not able to verify that the bug report actually sent since it didn't respond after I accurately filled in all the SMTP information and user Mail Settings. I'm going to try to send the same information by a direct mail.

Therefore I ask everyone who is still experiencing this bug to please send a complete bug report to detections@spybot.info with a reference to this thread. :thanks:

David12846

2009-08-12, 05:37

I've been experiencing these same errors on closing SpybotSD after completing a scan.

... Today I figured out that the error occurs when firefox is up during the scan and not when it is not up. I reproduced the error twice today while firefox was up and I avoided the error in between the two error runs buy closing firefox. ...

For me, the error appears even with Firefox NOT open. I booted up, ran SpyBot, checked for problems, immunized, and closed SpyBot (The hives unload during the closing). A few seconds after SpyBot disappears from the screen, the error messages appear.

usefullll

2009-08-12, 17:32

I had the same run-time error as well,hope it'll be fix soon.

Marty81

2009-08-13, 08:38

I've done some tests. Hopefully this will shed some light on the issue. At first I thought it was an issue with running Windows Update and then running Spybot before restarting, but now I'm more certain it has to do with having Firefox open before and/or during the scan. I have 3 computers, one of which I am *positive* is not infected with anything, and I'm able to reproduce this error on all of them.

First computer (running firefox 3.5.2, first time I got the error):
Opened firefox
Did windows update, didn't restart
Updated spybot to new detections
Scanned with spybot. *CRASH* on exit with error.

Second computer (running Firefox 3.5.2):
Opened firefox
Scanned with older spybot detections file (mid-July)
Closed spybot. No problem.
Did windows update, didn't restart
Scanned with older spybot detections file again (mid-July)
Closed spybot. No problem.
Updated spybot to new detections
Scanned with spybot. *CRASH* on exit with error.
Rebooted (finished Windows update).
Scanned with spybot without firefox open.
Closed spybot. No problem.
Opened firefox.
Scanned with spybot.
Closed spybot. No problem.
Opened spybot and visited the immunizations tab (received warning about firefox being open...I haven't updated my immunizations yet).
Scanned with spybot. *CRASH* on exit with error.

Third computer (known uninfected, running Firefox 3.0.12):
Scanned with older spybot detections file (mid-July)
Closed spybot. No problem.
Updated spybot to new detections
Scanned with spybot.
Closed spybot. No problem.
Did windows update, didn't reboot.
Scanned with spybot.
Closed spybot. No problem.
Opened firefox.
Scanned with spybot. *CRASH* on exit with error.
Rebooted (finished Windows update).
Scanned with spybot without firefox open.
Closed spybot. No problem.
Opened firefox.
Scanned with spybot. *CRASH* on exit with error.
Opened spybot and visited the immunizations tab (received warning about firefox being open...I haven't updated my immunizations yet).
Scanned with spybot. *CRASH* on exit with error.

Buster

2009-08-13, 16:13

Hello,

thanks for this very detailed error report. We are currently trying to reproduce this according to your description. Everyone else who wants to test this on his own, an installer containing old include files can be downloaded here (http://www.safer-networking.org/files/spybotsd_includes-2009-07-22.exe). :thanks:
Once more thanks to everyone who submitted a report in the past days. :bigthumb:

TerminalMan

2009-08-13, 20:15

Tried the old include file that buster posted with no success. Also tried using it in conjunction with the advcheck162 file, but that produced the same error. Afterwards, I updated spybot and returned to advcheck163, ran a scan, and still got the error upon exiting the program...

Is it possible that using the advcheck162 and old include files didn't actually revert to what my spybot program would have been like at that date, before the error cropped up?

Also, I show no difference whether or not Firefox is running.

TexasDayLily

2009-08-13, 21:37

I've run some more tests trying to simplify the Firefox 1.5.2 configuration to the point where the SpybotSD does not crash, if possible.

First Try - safe mode
Started Firefox - default profile in safe mode (with extensions noted in prior post)
Started Spybot.
Updated spybot - no new updates since I updated yesterday.
Immunized - nothing unprotected.
Scanned with spybot. Crash on exit with error.

Second Try - new profile in safe mode
Started Firefox - profile manager in safe mode (firefox --profilemanager --safe-mode)
Created new profile
Selected new profile and selected on popup window all changes to disable and reset to default settings permanently
then click "make changes and restart"
This caused all plugins from default profile to be installed but disabled
Only the following extensions were automatically installed and disabled (I think I'd have to uninstall them from the the external application.)
* Sunrise XP 1.0
* Java Quick Starter 1.0
Started Firefox - profile manager in safe mode (firefox --profilemanager --safe-mode)
Verified plugins and extensions installed and disabled
Started Spybot.
Updated spybot - no new updates since I updated yesterday.
Immunized - new profile required immunization
Scanned with spybot. Crash on exit with error.

That's all I can do for right now.

bitman

2009-08-13, 23:01

I can confirm that Firefox 3.5.2 can aggravate and cause this situation.

On a Windows 2000 (PII 400) system that has Firefox 3.5.2 installed, I had never experienced this error before, though I had manually scanned with the same updates dated 08-05-2009 when downloaded on 08-07-2009. The system also has AdvCheck163.exe installed in the main Spybot S&D folder with a verified good digital certificate.

After opening Firefox and running a manual scan, I received the same error messages mentioned in this thread and verified as the first time via Event Viewer. I normally run a scan with everything else closed, so interaction is undoubtedly involved.

Since Firefox was also Immunized, I have removed that with 'Undo' and am re-running a scan. This will take over an hour on this old system though, so I chose to post this portion now and will return later to update with those results.

Bitman

< EDIT > For the record, AV installed is Avast! current version, 4.9 I believe.

bitman

2009-08-14, 04:50

The results of testing by TexasDayLily are similar to my own, since only the fact that Firefox is open during the scan itself appears to matter. Removing all Immunization as well as closing TeaTimer seemed to have no effect on the issue. In fact, starting the scan with Firefox open but closing it shortly after the scan has started (before the 1,000 item mark) doesn't cause the error.

I'll also mention that my Firefox installation is the simplest possible, with only a default install and absolutely no add-ons of any sort, just a basic install of 3.0 upgraded to 3.5, 3.5.1 and then 3.5.2 over the last few months. In fact, it's barely used since it was installed primarily to test the browser on a custom web server application.

So it appears that the issue in my case relates only to Firefox being open during scan and then exiting Spybot S&D after an otherwise 'clean' result.

Since this really isn't an issue for me based on my normal usage patterns, I won't be spending any more time on this myself unless there is a specific potential fix the Spybot Team wishes to confirm. The slowness of this PC is simply too agonizing and I have no interest in installing Firefox anywhere else.

Bitman

spybotsandra

2009-08-14, 13:15

@all

We have analysed the Bug Reports that some users have sent us - and some have also reported this in the forum - there seems to be one thing in common:

When you have Firefox opened during the scan you will get the error message with the "runtime error 216".
If you close your Firefox during the scan the error won't come up.

So please test this.

Thanks. :)

Best regards
Sandra
Team Spybot

SHLOC-tom

2009-08-14, 19:48

I have been getting the 216 error for several weeks every time I closed Spybot after the scan was complete.

I am using Firefox 3.0.13 on Windows XP Pro SP3.

I just rebooted my system and ran Spybot before starting Firefox and Did Not get the error when I closed the program.

Hope this helps.

Tom

SPuserID

2009-08-14, 20:33

My results differ.

Test 1, IE7 up, Firefox 3.5.2 down:
Note: Cleaned up some cookies.
Result: Error 216

Test 2, IE7 down, Firefox 3.5.2 down:
Did NOT run a scan.
Result: Clean

Test 3, IE7 down, Firefox 3.5.2 down:
Ran a scan.
Nothing was cleaned.
Firefox came up in the middle of the scan; I killed it immediately.
Result: Error 216

Test 4, IE7 down, Firefox 3.5.2 down:
Firefox did not start during this test.
Result: Error 216

Test 5, IE7 Down, Firefox 3.5.2 up:
Firefox was up for this entire test.
Result: Error 216

My conclusion: Firefox 3.5.2 being up or down does not affect this problem on this machine.

Other Notes:
1. I configured Spybot to do both an Update and an Immunize every time
it starts.
2. Symantec (10.1.5.5000) does a full scan every day at noon; definitions
are updated automatically before every run.
3. Spyware Blaster runs mid-morning every day.
4. I am in the administrator’s group for this machine.
5. I did not reboot at any point during this test.
6. I did not investigate the relationship between IE7 and error 216
7. I did not investigate Google Chrome, which has recently been
uninstalled on this machine.
8. I provided all 5 logs to Sandra separately.

bitman

2009-08-14, 22:55

My results differ.

Test 1, IE7 up, Firefox 3.5.2 down:
Note: Cleaned up some cookies.
Result: Error 216

Test 2, IE7 down, Firefox 3.5.2 down:
Did NOT run a scan.
Result: Clean

Test 3, IE7 down, Firefox 3.5.2 down:
Ran a scan.
Nothing was cleaned.
Firefox came up in the middle of the scan; I killed it immediately.
Result: Error 216

Test 4, IE7 down, Firefox 3.5.2 down:
Firefox did not start during this test.
Result: Error 216

Test 5, IE7 Down, Firefox 3.5.2 up:
Firefox was up for this entire test.
Result: Error 216

My conclusion: Firefox 3.5.2 being up or down does not affect this problem on this machine.

< SNIP >
SPuserID,

I'd come to a slightly different conclusion.

Based on your test results, especially Test 3 where Firefox came up during the scan entirely on its own, I'd say you simply have a worse version of the same problem we do. For some reason your Firefox appears to be even more coupled into Spybot S&D than ours, so it's as if you are always running Firefox even when you apparently aren't. This may be a result of your first test and no reboot, but I'd suspect it's probably deeper than that myself so that a portion of Firefox is always in memory.

In any case, you've already done the best thing possible by sending your logs to Sandra and your more extreme issues may actually give better clues to determine the cause.

Bitman

Switchman05

2009-08-14, 23:00

I'm running IE 8.0 and XP Pro 2002 SP3 and I've been getting this same error since downloading 1.6.2. I've sent a copy of the error report as a MS Word Doc in an email to Spybot.

I deleted and reloaded Spybot several times and ran it with Advanced mode via the menu bar item "Mode" and select "Settings" --> "File Sets" in the left bar. and unchecked "trojansc" and "malwarec.sbi".

It still abends after running when trying to close Spybot.

I hope this can be resolved quickly. I've become concerned about the integrity of Spybot and thinking of (if any) alternatives.

Please help.
Ron

David12846

2009-08-15, 05:50

@all

...there seems to be one thing in common:

When you have Firefox opened during the scan you will get the error message with the "runtime error 216".
If you close your Firefox during the scan the error won't come up.

So please test this.

Best regards
Sandra
Team Spybot

For me, it didn't matter if (a) Firefox was open during a scan, (b) open then closed during a scan, or (c) not opened at all during the current logon session. Between each test, I shut down the PC. When I ran SpyBot in each test, I "Checked for Problems" (No problems reported), then used the screen to "Immunize". I have Global Hosts UN-checked on the immunize screen. The 216 error appeared after all 3 tests.

I removed SpyBot entirely after I did the test above. I then shut down my PC, and re-downloaded SpyBot using IE7. When I started SpyBot, I did NOT accept the updates. The update screen showed the following were available (but I did not download them):

- - - - -
1) Advanced detection library 1.6.3 ( 784KB - 2009-07-29 )
2) Immunization database ( 546 KB - 2008-11-05 )
3) Tea Timer update 1.6.6 ( 1011 KB - 2009-03-11 )
4) English descriptions ( 281 KB - 2008-09-10 )
- - - - -

I then ran the 3 tests above( a, b, and c), re-booting the PC between each test. The 216 error did NOT appear after each test.

I then re-booted, ran SpyBot and checked for up-dates (Firefox not started). The 4 updates listed above were available. I accepted all 4 of them. I then ran SpyBot and only "Checked for Problems". SpyBot reported no problems. I then closed SpyBot.... and the 216 error appeared !!

nottageek

2009-08-15, 07:07

I run WinXP SP3 as an Admin account, use Firefox 3.0.12, and get the error messages regardless of whether FF is open or closed throughout the complete scan, or closed while the scan is in progress.

I do not get any error messages when I do the following:

1. In a C prompt, ENTER

at hh:mm /interactive cmd.exe

(where hh:mm is the current time in 24-hour format >PLUS 2 MINUTES<)

to get

C:\>at hh:mm /interactive cmd.exe
Added a new job ID = 1

2. Wait 2 minutes for the new command prompt

C:\Windows\system32>

to appear.

3. RClick on your Spybot S&D icon and select "Properties", COPY the "Target:" address within quotes, for example

"C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe"

Then in the new command prompt RClick and select PASTE to get:

C:\Windows\system32>"C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe"

4. Press ENTER to run the program.

This simulates an interactive window of the system account with its privileges, and allows any spyware removal tool to reveal and remove things that otherwise would not be seen.

I learned this several years ago from one of the very knowledgeable people at CastleCops, and is probably the geekiest thing I know — remember, I am nottageek.

Anyway, since I don't get any error messages running a scan this way, I have a very non-geeky hunch that it's significant and can lead to a solution to this problem.

Ras1974

2009-08-15, 12:12

My test scenario:

1. Booted up the p.c..
2. Started SpybotSD and ran a complete scan.
3. Closed the program and the 2 error pop-ups appeared.

Firefox was not started at all prior to or during the scan so i guess this is not a Firefox related issue.

oldtimer

2009-08-15, 22:12

I think we ought to put Firefox to bed on this issue. I get the 216 error every time I quit spybot after a successful scan. I don't have and have never had Firefox on this machine. Running XP Sp2 and IE7.

samtso

2009-08-16, 15:12

Hello @ all,

first of all, thanks for keeping an eye on this thread. :bigthumb:

Yes, we are still trying to track this error down. Unfortunately we have not been able to reproduce this issue on various test machines, which makes it even harder to find the origin of this bug.
So we are still collecting information about this. Although a few users reported that disabling some sbi files could fix the error, as I already suggested in one of my prior posts, this has not been a solution for everyone.
Regarding the distribution of this error, we are currently receiving a few emails each day, indicating, that a special setup seems to be relevant. Therefore I ask everyone who is still experiencing this bug to please send a complete bug report to detections@spybot.info with a reference to this thread. :thanks:

Hi all, I have the same problem since early this month, I have try many ways in the past, such as re-reg all dll files, delete all prefetch files, as suggest by others on the web. I just found this thread today, via google search, and try to test to disable different sbi files in the setting, I found that the problem gone if I disable "MalwareC.sbi".

Will it cause insecure if I disable this sbi? what's the different between "MalwareC.sbi" & "Malware.sbi"?

Thanks!

p.s. I have not installed Firefox, I am using IE7

David12846

2009-08-16, 18:24

...I removed SpyBot entirely. I then shut down my PC, and re-downloaded SpyBot. When I started SpyBot, I did NOT accept the updates. The update screen showed the following were available (but I did not download them):

- - - - -
1) Advanced detection library 1.6.3 ( 784KB - 2009-07-29 )
2) Immunization database ( 546 KB - 2008-11-05 )
3) Tea Timer update 1.6.6 ( 1011 KB - 2009-03-11 )
4) English descriptions ( 281 KB - 2008-09-10 )
- - - - -

I then ran 3 tests (Firefox running, not running, running but closed during SpyBot scan) , re-booting the PC between each test. The 216 error did NOT appear after each test.

I then re-booted, ran SpyBot and checked for up-dates. The 4 updates listed above were available. I accepted all 4 of them. I then ran SpyBot and only "Checked for Problems". SpyBot reported no problems. I then closed SpyBot.... and the 216 error appeared !!

As someone else said, they doubt FireFox is to blame :bigthumb:. I tend to agree. To me, it appears as if one of the updates in the list above is the culprit.

Maybe someone else (a SpyBot guru?) could/would run through my senario of reloading SpyBot without accepting the updates then execute SpyBot to be certain the 216 error does not appear (Maybe execute it 2 or 3 times to be sure... programs have an uncanny habit of making changes). Then accept the updates one at a time and execute SpyBot after each update to see whether the 216 error appears (again, run it 2 or 3 times between each update just to be sure) . Maybe "we" can narrow it down to a bad update :oops: .

While I'm here posting, I also use "Primary Response SafeConnect" (by Sana Security). It checks for programs that change behavior. A few times recently when I boot-up, it alerts me that TeaTimer has changed the way it behaves :confused:. Before the 216 error, the "program change for TeaTimer" alert did not appear.

David

frommich

2009-08-17, 06:53

To add to the data gathering process:

I started getting the 216 message a few weeks back. Spybot runs every night. Most nights I leave Firefox windows open.

As a test, after getting the 216 message this morning, I closed Firefox and ran Search & Destroy again. No error message. (No intervening reboot.)

I'm running:

XP Home SP3 all fixes to date installed,
Firefox 3.5.2 all fixes installed, Adblock Plus 1.1, AVG Safe Search 8.5

Also, for what it is worth, this version of Firefox is crashing a lot and having problems re-opening all its windows / tabs when it re-starts.

Not blaming Spybot nor Firefox but there seems to be a connection. Just happy it is not a hardware problem.

samtso

2009-08-17, 07:49

I don't think it's caused by Firefox as I didn't install Firefox on my PC. I am using IE7, running on WinXp SP3. I started to have the error 216 problem since early this month. :confused:

The only thing I can do now is disable "MalwareC.sbi" in the setting, and the problem is gone. I don't know why would this happen and still looking solution for that.

Sam

bitman

2009-08-17, 08:22

Those of you stating that Firefox isn't the 'problem', you're missing the point. Firefox is simply the only currently known item that is clearly known to be able to cause the situation on some systems. It may not be the fault of Firefox itself, which is why I specifically indicated that Firefox 'aggravated' the situation in my post above.

For those who don't have Firefox installed, do you have any browsers installed other then Internet Explorer? What we're looking for is most likely a core component of the browser, not the actual browser itself and most of the other third-party browsers share the same core Mozilla components.

If not, then something else on your PC (and possibly even ours) may be involved. The only thing that a few of us know for certain is that we can turn this problem on and off like a switch based on whether we open Firefox or not during a scan.

My own guess is that a change in the new Advanced Check Library is interacting with certain core components of Firefox and possibly other programs in an unintended way, resulting in the error message sequence occuring upon exit after a scan. The fact that those testing specific SBI modules are also finding differing results points to the probability that several different combinations of programs might be involved as symptoms along with Firefox.

The fact that several Windows Updates were also released in this same time period including some related to significant changes in the ALT Libraries which are also reflected in multiple other vendors recent updates simply confuses the issue even further.

If you really are tryng to help, then find the specific program contributing to your particular situation, those of us with Firefox have already done that. We understand fully that this doesn't appear to be the issue in your case, so what is?

Bitman

frommich

2009-08-17, 10:21

when i abort the scan at say 545000 checked items the error will not occur.

I'll let those of you more technically knowledgeable about spybot to decide if this is relevant. Tonight, Firefox was open when spybot started. I closed Firefox when spybot was 550,xxx / 574,xxx thru processing. When spybot finished a little while later, I was able to close it with no errors.

Buster

2009-08-17, 11:05

@ all

Thanks for posting all these information. As some users are getting the error message although there has not been no FireFox installed so far, please test the following two files. Please download the old include files (http://www.safer-networking.org/files/spybotsd_includes-2009-07-22.exe) and the old advcheck.dll (http://www.spybotupdates.com/updates/files/advcheck163.zip) and restart your system after the files have been installed. Subsequent please run a scan. Thanks!

samtso

2009-08-17, 12:48

Finally, I've done the following:
1. Uninstalled the Spybot, delete all Spybot create folders and clean up the registry.
2. Reboot the system and install the Spybot 1.62 again.
3. Uncheck "Download update immediately" in the middle of the setup dialog.
4. Finished installation, reboot and run Spybot to check, not successful, it ask me to do update first as no system files can be found.
5. Check for update and update those available updates one by one, according to their release date.
6. Perform a Spybot check after each update, no error 216 anymore.
7. Do the "Advanced detection library 1.6.3" update finally, then perform Spybot check again, error 216 comes out.
8. Download the old advcheck162.zip and run the exe file inside.
9. Check the advcheck.dll file inside the "Spybot - Search & Destroy" folder under "Program Files", the advcheck.dll still 1.6.3.17.
10. rename the "advcheck.dll" file, run the exe file inside the advcheck162.zip again.
11. Check advcheck.dll again, version is now 1.6.2.13.
12. Run Spybot check again, no error 216 message.

I think the problem solved after roll back to advcheck162.

My PC is running WinXP SP3, IE7, and AVG8.5. No IE8, Firefox or Chrome been installed before.

I have a notebook that running WinXP SP3, IE7, and AVG8.5 as well. This notebook installed IE8 and Chrome before, but not Firefox, both IE8 & Chrome been uninstalled a couple months ago. This notebook do not have the error 216 problem.

I hope the above information is useful. Anyway, it's a great relief that it's not a trojan or hardware problem, cause it bothers me for weeks!

Thank you for all of you and I will keep following this thread.:thanks:

Sam

Buster

2009-08-17, 13:34

Hello Sam,

thanks for reporting! Let's see if this also fixes the issues on other systems.

samtso

2009-08-17, 17:09

Hello Sam,

thanks for reporting! Let's see if this also fixes the issues on other systems.

I just done some combination and found the following:
1. use advcheck.dll 1.6.2.13 + enable all sbi files in File Sets
result: no error
2. use advcheck.dll 1.6.3.17 + disable MalwareC.sbi in File Sets
result: no error
3. use advcheck.dll 1.6.3.17 + enable all sbi files in File Sets
result: runtime error 216
Does this test mean something to you?

Sam

Buster

2009-08-17, 17:48

Thanks for testing this. :bigthumb: Yes it has a meaning to us. :) There is one more test I would like you to do. Please disable the hijackers.sbi and enable the malwarec.sbi once again.:thanks:

samtso

2009-08-17, 19:51

Just done the test, disable hijackers.sbi and enable malwarec.sbi with advcheck.dll 1.6.3.17.
Result: no luck, runtime error 216 again.:sad:

Sam

TerminalMan

2009-08-17, 20:14

Finally got something to work for me. After Samtso's post, I decided to try the advcheck162.exe file again and see if I could get it to work. I unzipped the file, and ran the executeable. To save time, I ran only the file sets that gave me the error:

trojans.sbi
spyware.sbi

Upon exit, I received the errors. Then I checked the spybot directory to find the version of advcheck.dll used for the scan. I couldn't find it, so I went to folder options and selected to view hidden system files. Afterwards, I located the file and checked the version. It was still listed as 1.6.3! No wonder it never worked for me. Following Samtso's advice, I renamed advcheck.dll to advcheck.dll_old, and re-ran the executeable. Afterwards, I ran a spybot scan on my trouble file sets. Upon exit, NO ERROR! I think enabled all file sets and ran a scan. Once again, upon exit, no error.

BTW, I had firefox 3.5.2 open the entire time.

So now the question is, can I continue to run with the 1.6.2 version? I usually run a scan overnight, and perform the updates and immunizations then. Will the computer load the 1.6.3 version if I enable the auto-updates? And is there a way to just load the new definitions, etc... without updating the engine?

samtso

2009-08-18, 07:27

Hello TerminalMan,

I just manually do an update and don't see the advcheck163 available :D:, I think the update log already show this been updated, so it will not bother to come up again. You may do a manually update to test it.

Sam

nottageek

2009-08-19, 04:31

To confirm what others have reported —

advcheck.dll was renamed advcheck.dll_old before installing advcheck162.exe.

I then scanned for problems with Firefox 3.0.12 open, and upon completion closed Spybot without any error messages.

Thanks for finding a solution to this problem!:bigthumb:

oldtimer

2009-08-20, 00:36

Need a little clarification. Are you saying the problem is solved? I, for one, am not comfortable altering program files that I know nothing about. I would expect the fix would come down in an update and resolve the problem. Am I wrong?

bo.elam

2009-08-20, 05:06

I personally feel the same as the previous poster. As a matter of fact I have
not updated since July 23 and don't want to do it unless I know this problem
has for sure been taken care of. Can somebody that really knows confirm that this is fixed, without guessing. I will wait about 7 to 10 days more for a fix, if
its not done by them I will , with a broken heart, uninstall Spybot. When the July 27 update was ready and I started reading about this run time issue with
that particular update I decided to wait before updating. If I felt that only a
small percentage of users were having this problem I would have updated but
all I have read this past month here and in a couple places elsewhere is a lot of guessing and extremely wrong advice. The first suggestions here and elsewhere
was that this problem was a virus.Incredible.
I thank Spybot for what has meant but I dont want to waist my machine if this is a guessing game forever.
Bo

frommich

2009-08-20, 05:51

I too agree that this is not yet fixed but it seems to have been narrowed down to a particular update. I trust that the Spybot folks are hard at work figuring out exactly why spybot & firefox are not playing nice.

I am continuing to leave firefox open each night, updating and running spybot. The error keeps occurring each morning when I close spybotg but I am ignoring it for now. I assume that when spybot figures this one out, there will be an update and the error will go away. I just hope that I remember that when the absence of error occurs, I remember to post that it is gone.

samtso

2009-08-20, 06:17

Yes, the problem is not solved yet, it's just a solution to temporary get rid of the runtime error 216. I think Spybot Team already know where the problem came from and will fix it soon.

Sam

Ras1974

2009-08-20, 10:52

Of course the errors are irritating but they come up after you`ve already done everything you wanted to do with SpybotSD. So there is no loss in functionality because of this errors. Because the SpybotSD team cannot reproduce this error they are suggesting several tests. But they are working on a solution.

So please don`t give up on SpybotSD. It has been a defence against nasties for as long i can remember.

bitman

2009-08-20, 15:36

That's right, all of the testing many of you have performed is helping to narrow down where the real issue lies. Everyone else is simply wasting their breath, since complaining won't help provide a solution any faster. They appear to have an idea which files are involved, but may still need to determine exactly what portions of these processes or detections are creating the issue itself.

And as also mentioned, this doesn't appear to affect any true functionality, it's just an annoying error message that shouldn't be happening, so its priority will be something less than critical.

Typically, an update will be released the Wednesday following any true 'fix' that is discovered. Expecting anything else in this situation is just wishful thinking.

Bitman

frommich

2009-08-20, 23:42

1. Ran Spybot with Firefox open on a Vista machine today. No error message when I closed spybot. (Machine not currently available so can't say what version of Firefox but I updated spybot before running.)

2. Home machine - XP:

a) Firefox open.
b) Ran Spybot.
c) Closed Firefox. Waited until the Firefox.exe disappeared from both Applications and Processes tabs of Task Manager. It takes a lot longer for Firefox process to actually close after the windows close.
d) Closed Spybot. appeared to close without the error.
e) opened Firefox as soon as the Spybot window disappeared. Error message appeared.

Tried again
a) thru d) the same.
e) Waited until Spybot disappeared from the Processes tab in Task Manager.
f) Opened Firefox - no error message.

don't know whether this is helpful or not in determining when and why this error message is popping up.

nottageek

2009-08-21, 05:11

Thanks for finding a solution to this problem!:bigthumb:

Sorry, people. I should have added the disclaimer, "...your mileage may vary"

Buster

2009-08-21, 12:42

Hello @ all!

Thanks to your cooperation we have been able to narrow the error down to a specific parameter. Our dev team is working hard on a fix for this and as bitman already stated as soon a fix will be available it will be included in the update.

Ras1974

2009-08-24, 16:14

Are you gonna post a reply when it is fixed? Can`t wait! Thanks in advance!

MtShasta

2009-08-25, 10:45

Am getting errors on my desktop XP/SP3, IE-7, 1.6.2.46 build 8/12/09 and 8/19/09.
Am not getting errors on my laptop XP/SP3, IE-6, 1.6.2.46 build 8/5/09.
Have never run FireFox.

samtso

2009-08-30, 11:26

Are you gonna post a reply when it is fixed? Can`t wait! Thanks in advance!

Hi Ras1974,

Just ran a scan with the new update relased on Aug 26th, still got the Error 216 if use advcheck.dll v.1.6.3.17. I think we need to wait until they release a new version of the advcheck.

For ver. 1.6.2.13 & 1.6.2.15, both can finish the scan with no error.

Regards,
Sam

Ras1974

2009-09-01, 14:43

Thanks but i meant a reply from a Member of Team Spybot when the issue is fixed.

dageeza2009

2009-09-03, 00:38

See my post on updating problems. have reinstalled Spybot 1.6.2 and all updates, scans etc now working properly with no application errors.

headhole

2009-09-08, 05:10

mailed them yesterday with all details and didn't get a reply yet.
the folowing text was mailed:
Since last upgrade of spybot every time i run the software, and only after scan with or with out fix, the software crashes.
i get a window telling: the instruction at "0x071b40c2" referenced memory at "0x0745e018". The memory could not be "read". Click ok to terminate the program.

After i click OK, a new window tell: Runtime error 216 at 071B40C2.

I use windows xp pro sp3 fully updated.

spybotsandra

2009-09-08, 18:23

MarkInCentralTexas

2009-09-08, 18:33

Hi Sandra ...

(A New Member here ...) and after only about a week of seeing this 216 Run time error, I decided to get on line and find out whats been happening to fix .. it. Seems many others have seen the 216 problem for a longer period than I, so I'd say my timing was pretty good, in that when just as I was going to add my 2 cents worth... (American slang for "useless unsolicited dribble"), your post appear with the fix ... I've downloaded and will install shortly. Thanks to the Spybot team for all your efforts!!!

Mark

MarkInCentralTexas

2009-09-08, 19:25

I've downloaded the spybotsd_advcheck-1.6.4.18.exe and attempted execution. The install wizard fails due to no advcheck.dll in the <C:\PROGRAM FILES\Spybot - Search & Destroy> directory.

I'm currently running 1.6.2.48, last updated on Sept 2, '09.

Am I missing something ?

headhole

2009-09-09, 05:54

i use spybot 1.6.2.42 and the advcheck fixed the problem. :bigthumb:

spybotsandra

2009-09-09, 10:36

@MarkInCentralTexas

Hello,

We recommend a fresh install of Spybot - Search & Destroy.

Please uninstall Spybot - Search & Destroy according to the following link (http://www.safer-networking.org/en/howto/uninstall.html).
Then make a fresh install of Spybot - Search & Destroy 1.6.2.
You will find links to several download locations (http://www.safer-networking.org/en/mirrors/index.html) on our website.

Or choose the direct installation file (http://www.spybotupdates.com/files/spybotsd162.exe).

Then download the fresh advcheck here (http://www.spybotupdates.com/files/spybotsd_advcheck-1.6.4.18.exe#hash(md5:23AD12D34C6E9EBC459DDAD9A5F32A08).
Run the exe file, it is a manual update for your advcheck.dll.

Best regards
Sandra
Team Spybot

samtso

2009-09-09, 18:30

Just run a scan with the latest update, the error 216 gone:eek:

Thanks,
Sam

oldtimer

2009-09-09, 19:46

Kudos to the Spybot team. Just downloaded this weeks updates, ran a scan and everything completed normally with no 216 error. Yea!

frommich

2009-09-10, 14:06

Hello,

We are sorry that it took so long - but we have finally found and fixed the error. Please download a fresh advcheck here (http://www.spybotupdates.com/files/spybotsd_advcheck-1.6.4.18.exe#hash(md5:23AD12D34C6E9EBC459DDAD9A5F32A08).
Run the exe file, it is a manual update for your advcheck.dll.

Best regards
Sandra
Team Spybot

1st time I tried to run the exe file, I got an error. Renamed advcheck. (it is a hidden file, had to display hidden files to find it). Then exe ran fine and the 216 message went away.

Thank you.

MarkInCentralTexas

2009-09-10, 19:30

Hi All,

Thanks Sandra for the reply and solution. First, a couple of corrections: 1) Version is 1.6.2.46 (not ...48), 2) advcheck.dll is NOT missing. It was hidden, duh, :red: (same as frommich), another optimization for security must have reset it to do not show.

Second, my actions (8 Sept/9 Sept): Copied advcheck.dll and SpybotSD.exe from wife's computer to thumb drive, attempted copy from thumb drive to laptop folder. Confirm rewrite over existing file ?... hmmm, canceled copy, checked and set folder options to show hidden/system files and sure enough, saw they was present (there's the 'duh' factor'). So, I re-ran <spybotsd_advcheck-1.6.4.18.exe> with the same result as before. I asked myself why is this hidden ... wife's file wasn't ... I reasoned this be why the dll update was not successful.

@MarkInCentralTexas

Hello,

We recommend a fresh install of Spybot - Search & Destroy.

Please uninstall Spybot - Search & Destroy according to the following link (http://www.safer-networking.org/en/howto/uninstall.html).
Then make a fresh install of Spybot - Search & Destroy 1.6.2.
You will find links to several download locations (http://www.safer-networking.org/en/mirrors/index.html) on our website.

Or choose the direct installation file (http://www.spybotupdates.com/files/spybotsd162.exe).

Then download the fresh advcheck here (http://www.spybotupdates.com/files/spybotsd_advcheck-1.6.4.18.exe#hash(md5:23AD12D34C6E9EBC459DDAD9A5F32A08).
Run the exe file, it is a manual update for your advcheck.dll.

Best regards
Sandra
Team Spybot

Okay, so I'd not received the instant notification emails on new posts to this thread following mine of 8 Sept, but in a discussion with my wife also that night, she had suggested the very same actions as in Sandra post, of 9 Sept above (Sandra, did you talk to my wife ? :D: ). Anyway, it was already very late, I had other projects,tasks and errands for 9 Sept, and since the error occurred for me on SpybotSD closure only, I put it off ...

Action (10 Sept): So, I still 'had' the problem this morning. I checked the forums and see the new posts, Sandra's uninstall/reinstall, and frommich's comments. Now, I know I cannot delete 'hidden' system files (even though I own the *&$#% computer), so I (know I can) rename the advcheck.dll file (quick fix), rerun <spybotsd_advcheck-1.6.4.18.exe>, open/wait/close SpybotSD, the 216 error on closure goes away, and life is wonderful again.

:wav:

Now, this solved the immediate problem, but ultimately I will do the uninstall/reinstall per Sandra's suggestion, as this will cleanup any other oddities. So, a Big Thank You to Sandra, and the Spybot S & D team involved in resolving this 216 (for me, closure) annoyance.

:rockon:

Mark

spybotsandra

2009-09-11, 12:03

Thanks. :)
Glad to hear.

Ras1974

2009-09-12, 12:46

Too cool for school, the team fixed it! Thankssss!

My test scenario:

1. Updated via the usual way. A pop-up appeard stating that the advcheck.dll was read only. There was a retry button to (try to) overwrite it. I pressed it. The pop-up disappeared.
2. Ran a complete scan, and upon closing the errors appeared again, so the overwriting of the old dll did not work via the regular update process.
3. Ran the spybotsd_advcheck-1.6.4.18.exe, same problem, the execution could not be succesfully completed because of the read only dll. Even after pressing the rety button.
4. Renamed the old dll file.
5. Looked for updates again via the regular process, of couse there were none.
6. Ran again the spybotsd_advcheck-1.6.4.18.exe en this time the execution could be succesfully completed.
7. Checked the dll and a new one was created.
8. Ran a complete scan, closed and the problem was solved.

So my conclusions:

A. No uninstall is needed.
B. Just rename the old dll en either update via the regular way or use the spybotsd_advcheck-1.6.4.18.exe.

Kind regards,
Ras