Spybot 1.6.2 update and Runtime Error 216

[spybotsandra]

@all

We have analysed the Bug Reports that some users have sent us - and some have also reported this in the forum - there seems to be one thing in common:

When you have Firefox opened during the scan you will get the error message with the "runtime error 216".
If you close your Firefox during the scan the error won't come up.

So please test this.

Thanks.

Best regards
Sandra
Team Spybot

[SHLOC-tom]

I have been getting the 216 error for several weeks every time I closed Spybot after the scan was complete.

I am using Firefox 3.0.13 on Windows XP Pro SP3.

I just rebooted my system and ran Spybot before starting Firefox and Did Not get the error when I closed the program.

Hope this helps.

Tom

[SPuserID]

My results differ.

Test 1, IE7 up, Firefox 3.5.2 down:
Note: Cleaned up some cookies.
Result: Error 216

Test 2, IE7 down, Firefox 3.5.2 down:
Did NOT run a scan.
Result: Clean

Test 3, IE7 down, Firefox 3.5.2 down:
Ran a scan.
Nothing was cleaned.
Firefox came up in the middle of the scan; I killed it immediately.
Result: Error 216

Test 4, IE7 down, Firefox 3.5.2 down:
Firefox did not start during this test.
Result: Error 216

Test 5, IE7 Down, Firefox 3.5.2 up:
Firefox was up for this entire test.
Result: Error 216

My conclusion: Firefox 3.5.2 being up or down does not affect this problem on this machine.

Other Notes:
1. I configured Spybot to do both an Update and an Immunize every time
it starts.
2. Symantec (10.1.5.5000) does a full scan every day at noon; definitions
are updated automatically before every run.
3. Spyware Blaster runs mid-morning every day.
4. I am in the administrator’s group for this machine.
5. I did not reboot at any point during this test.
6. I did not investigate the relationship between IE7 and error 216
7. I did not investigate Google Chrome, which has recently been
uninstalled on this machine.
8. I provided all 5 logs to Sandra separately.

[bitman]

My results differ.

Test 1, IE7 up, Firefox 3.5.2 down:
Note: Cleaned up some cookies.
Result: Error 216

Test 2, IE7 down, Firefox 3.5.2 down:
Did NOT run a scan.
Result: Clean

Test 3, IE7 down, Firefox 3.5.2 down:
Ran a scan.
Nothing was cleaned.
Firefox came up in the middle of the scan; I killed it immediately.
Result: Error 216

Test 4, IE7 down, Firefox 3.5.2 down:
Firefox did not start during this test.
Result: Error 216

Test 5, IE7 Down, Firefox 3.5.2 up:
Firefox was up for this entire test.
Result: Error 216

My conclusion: Firefox 3.5.2 being up or down does not affect this problem on this machine.

< SNIP >

SPuserID,

I'd come to a slightly different conclusion.

Based on your test results, especially Test 3 where Firefox came up during the scan entirely on its own, I'd say you simply have a worse version of the same problem we do. For some reason your Firefox appears to be even more coupled into Spybot S&D than ours, so it's as if you are always running Firefox even when you apparently aren't. This may be a result of your first test and no reboot, but I'd suspect it's probably deeper than that myself so that a portion of Firefox is always in memory.

In any case, you've already done the best thing possible by sending your logs to Sandra and your more extreme issues may actually give better clues to determine the cause.

Bitman

[Switchman05]

I'm running IE 8.0 and XP Pro 2002 SP3 and I've been getting this same error since downloading 1.6.2. I've sent a copy of the error report as a MS Word Doc in an email to Spybot.

I deleted and reloaded Spybot several times and ran it with Advanced mode via the menu bar item "Mode" and select "Settings" --> "File Sets" in the left bar. and unchecked "trojansc" and "malwarec.sbi".

It still abends after running when trying to close Spybot.

I hope this can be resolved quickly. I've become concerned about the integrity of Spybot and thinking of (if any) alternatives.

Please help.
Ron

[David12846]

@all

...there seems to be one thing in common:

When you have Firefox opened during the scan you will get the error message with the "runtime error 216".
If you close your Firefox during the scan the error won't come up.

So please test this.

Best regards
Sandra
Team Spybot

For me, it didn't matter if (a) Firefox was open during a scan, (b) open then closed during a scan, or (c) not opened at all during the current logon session. Between each test, I shut down the PC. When I ran SpyBot in each test, I "Checked for Problems" (No problems reported), then used the screen to "Immunize". I have Global Hosts UN-checked on the immunize screen. The 216 error appeared after all 3 tests.

I removed SpyBot entirely after I did the test above. I then shut down my PC, and re-downloaded SpyBot using IE7. When I started SpyBot, I did NOT accept the updates. The update screen showed the following were available (but I did not download them):

- - - - -
1) Advanced detection library 1.6.3 ( 784KB - 2009-07-29 )
2) Immunization database ( 546 KB - 2008-11-05 )
3) Tea Timer update 1.6.6 ( 1011 KB - 2009-03-11 )
4) English descriptions ( 281 KB - 2008-09-10 )
- - - - -

I then ran the 3 tests above( a, b, and c), re-booting the PC between each test. The 216 error did NOT appear after each test.

I then re-booted, ran SpyBot and checked for up-dates (Firefox not started). The 4 updates listed above were available. I accepted all 4 of them. I then ran SpyBot and only "Checked for Problems". SpyBot reported no problems. I then closed SpyBot.... and the 216 error appeared !!

[nottageek]

I run WinXP SP3 as an Admin account, use Firefox 3.0.12, and get the error messages regardless of whether FF is open or closed throughout the complete scan, or closed while the scan is in progress.

I do not get any error messages when I do the following:

1. In a C prompt, ENTER

at hh:mm /interactive cmd.exe

(where hh:mm is the current time in 24-hour format >PLUS 2 MINUTES<)

to get

C:\>at hh:mm /interactive cmd.exe
Added a new job ID = 1

2. Wait 2 minutes for the new command prompt

C:\Windows\system32>

to appear.

3. RClick on your Spybot S&D icon and select "Properties", COPY the "Target:" address within quotes, for example

"C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe"

Then in the new command prompt RClick and select PASTE to get:

C:\Windows\system32>"C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe"

4. Press ENTER to run the program.

This simulates an interactive window of the system account with its privileges, and allows any spyware removal tool to reveal and remove things that otherwise would not be seen.

I learned this several years ago from one of the very knowledgeable people at CastleCops, and is probably the geekiest thing I know — remember, I am nottageek.

Anyway, since I don't get any error messages running a scan this way, I have a very non-geeky hunch that it's significant and can lead to a solution to this problem.

[Ras1974]

My test scenario:

1. Booted up the p.c..
2. Started SpybotSD and ran a complete scan.
3. Closed the program and the 2 error pop-ups appeared.

Firefox was not started at all prior to or during the scan so i guess this is not a Firefox related issue.

[oldtimer]

I think we ought to put Firefox to bed on this issue. I get the 216 error every time I quit spybot after a successful scan. I don't have and have never had Firefox on this machine. Running XP Sp2 and IE7.

[samtso]

Hello @ all,

first of all, thanks for keeping an eye on this thread.

Yes, we are still trying to track this error down. Unfortunately we have not been able to reproduce this issue on various test machines, which makes it even harder to find the origin of this bug.
So we are still collecting information about this. Although a few users reported that disabling some sbi files could fix the error, as I already suggested in one of my prior posts, this has not been a solution for everyone.
Regarding the distribution of this error, we are currently receiving a few emails each day, indicating, that a special setup seems to be relevant. Therefore I ask everyone who is still experiencing this bug to please send a complete bug report to detections@spybot.info with a reference to this thread.

Hi all, I have the same problem since early this month, I have try many ways in the past, such as re-reg all dll files, delete all prefetch files, as suggest by others on the web. I just found this thread today, via google search, and try to test to disable different sbi files in the setting, I found that the problem gone if I disable "MalwareC.sbi".

Will it cause insecure if I disable this sbi? what's the different between "MalwareC.sbi" & "Malware.sbi"?

Thanks!

p.s. I have not installed Firefox, I am using IE7