Spybot 1.6.2 update and Runtime Error 216

A week ago I deleted SpyBot completely. I re-installed it a few days ago and accepted all the updates. I'm also getting the Runtime Error 216 like others are getting.

I wish I had time to monkey around with all the suggested fixes, but I don't. :sad: I DID have time to run my Panda Rootkit Finder with a reboot, but it found nothing (A different rootkit finder was suggested in a previous posting). I could not get SpyBot "Tools>Bug Report" to send my bug report as suggested by Buster (below). The mail settings tripped me up (Thunderbird). I copied and pasted the "system generated report" into a standard e-mail along with the Configuration.ini file attached. Hope that is sufficient.

David

Buster said:
Hello @ all,

first of all, thanks for keeping an eye on this thread. :bigthumb:
...Therefore I ask everyone who is still experiencing this bug to please send a complete bug report to detections@spybot.info with a reference to this thread. :thanks:
Click to expand...
 
Last edited:
I've been experiencing these same errors on closing SpybotSD after completing a scan.

I've tried to isolate the conditions where I get the errors and when I don't. Today I figured out that the error occurs when firefox is up during the scan and not when it is not up. I reproduced the error twice today while firefox was up and I avoided the error in between the two error runs buy closing firefox. My firefox has about 90 tabs open (I saved the session) and I use a lot of extentions. On the first error I noticed a quick message "Registry hives may take a while to unload" (from memory) before the first popup message occurred. I was distracted on the second run which reproduced the error so I didn't see the message.

Here's MR Tech's Toolkit - My Config listing for my firefox.
Generated: Tue Aug 11 2009 10:49:27 GMT-0500 (Central Daylight Time)
User Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.2) Gecko/20090729 Firefox/3.5.2 (.NET CLR 3.5.30729)
Build ID: 20090729225027

Enabled Extensions: [20]

* Adblock Plus 1.1
* Adblock Plus: Element Hiding Helper 1.0.6
* Add Bookmark Here ² 3.5.20090621
* FireFTP 1.0.5
* Forecastbar Enhanced 0.9.6
* Java Console 6.0.14
* Java Console 6.0.15
* Java Quick Starter 1.0
* Launchy 4.2.1
* Link Alert 0.9
* Linkification 1.3.6
* MR Tech Toolkit 6.0.3.4
* NoScript 1.9.8
* OpenBook 2.0.1.1
* Session Manager 0.6.6.2
* Sunrise XP 1.0
* Tab Kit 0.5.6
* WOT 20090414
* Xmarks 3.1.0
* Zotero 1.0.10


Disabled Extensions: [22]

* All-in-One Sidebar 0.7.10
* Bookmark Duplicate Detector 0.7.5
* Bookmarks LinkChecker 0.6.8.4
* Calculator 1.1.12
* Dafizilla Table2Clipboard 0.2.1
* DictionarySearch 3.5.1
* Firefox Search Sidebar 1.2
* FirefoxView 1.0
* FireShot 0.77
* FlashGot 1.2
* Greasemonkey 0.8.20090123.1
* IE View Lite 1.3.4
* iMacros for Firefox 6.2.4.0
* Image Zoom 0.3.1
* InfoLister 0.10.1
* Microsoft .NET Framework Assistant 1.0
* Personas for Firefox 1.2.2
* ProCon Latte 1.7.9.7
* Screengrab 0.96.1
* Tagging For Multiple Bookmarks 1.7
* TagSifter 4.1.4
* Tweak Network 1.3


Total Extensions: 42

Installed Themes: [1]

* Default


Installed Plugins: (17)

* Adobe Acrobat
* Foxit Reader Plugin for Mozilla
* Java Deployment Toolkit 6.0.140.8
* Java Deployment Toolkit 6.0.150.3
* Java(TM) Platform SE 6 U15
* Microsoft Office 2003
* Microsoft® DRM
* Microsoft® Windows Media Player Firefox Plugin
* Mozilla Default Plug-in
* QuickTime Plug-in 7.6.2
* RealArcade Mozilla Plugin
* ScorchNetscapePlugin
* Shockwave Flash
* Shockwave for Director
* Windows Genuine Advantage
* Windows Media Player Plug-in Dynamic Link Library
* Windows Presentation Foundation

I was not able to verify that the bug report actually sent since it didn't respond after I accurately filled in all the SMTP information and user Mail Settings. I'm going to try to send the same information by a direct mail.




Buster said:
Therefore I ask everyone who is still experiencing this bug to please send a complete bug report to detections@spybot.info with a reference to this thread. :thanks:
Click to expand...
 
Last edited:
TexasDayLily said:
I've been experiencing these same errors on closing SpybotSD after completing a scan.

... Today I figured out that the error occurs when firefox is up during the scan and not when it is not up. I reproduced the error twice today while firefox was up and I avoided the error in between the two error runs buy closing firefox. ...
Click to expand...

For me, the error appears even with Firefox NOT open. I booted up, ran SpyBot, checked for problems, immunized, and closed SpyBot (The hives unload during the closing). A few seconds after SpyBot disappears from the screen, the error messages appear.
 
I've done some tests. Hopefully this will shed some light on the issue. At first I thought it was an issue with running Windows Update and then running Spybot before restarting, but now I'm more certain it has to do with having Firefox open before and/or during the scan. I have 3 computers, one of which I am *positive* is not infected with anything, and I'm able to reproduce this error on all of them.

First computer (running firefox 3.5.2, first time I got the error):
Opened firefox
Did windows update, didn't restart
Updated spybot to new detections
Scanned with spybot. *CRASH* on exit with error.

Second computer (running Firefox 3.5.2):
Opened firefox
Scanned with older spybot detections file (mid-July)
Closed spybot. No problem.
Did windows update, didn't restart
Scanned with older spybot detections file again (mid-July)
Closed spybot. No problem.
Updated spybot to new detections
Scanned with spybot. *CRASH* on exit with error.
Rebooted (finished Windows update).
Scanned with spybot without firefox open.
Closed spybot. No problem.
Opened firefox.
Scanned with spybot.
Closed spybot. No problem.
Opened spybot and visited the immunizations tab (received warning about firefox being open...I haven't updated my immunizations yet).
Scanned with spybot. *CRASH* on exit with error.

Third computer (known uninfected, running Firefox 3.0.12):
Scanned with older spybot detections file (mid-July)
Closed spybot. No problem.
Updated spybot to new detections
Scanned with spybot.
Closed spybot. No problem.
Did windows update, didn't reboot.
Scanned with spybot.
Closed spybot. No problem.
Opened firefox.
Scanned with spybot. *CRASH* on exit with error.
Rebooted (finished Windows update).
Scanned with spybot without firefox open.
Closed spybot. No problem.
Opened firefox.
Scanned with spybot. *CRASH* on exit with error.
Opened spybot and visited the immunizations tab (received warning about firefox being open...I haven't updated my immunizations yet).
Scanned with spybot. *CRASH* on exit with error.
 
Hello,

thanks for this very detailed error report. We are currently trying to reproduce this according to your description. Everyone else who wants to test this on his own, an installer containing old include files can be downloaded here. :thanks:
Once more thanks to everyone who submitted a report in the past days. :bigthumb:
 
Tried the old include file that buster posted with no success. Also tried using it in conjunction with the advcheck162 file, but that produced the same error. Afterwards, I updated spybot and returned to advcheck163, ran a scan, and still got the error upon exiting the program...

Is it possible that using the advcheck162 and old include files didn't actually revert to what my spybot program would have been like at that date, before the error cropped up?

Also, I show no difference whether or not Firefox is running.
 
I've run some more tests trying to simplify the Firefox 1.5.2 configuration to the point where the SpybotSD does not crash, if possible.

First Try - safe mode
Started Firefox - default profile in safe mode (with extensions noted in prior post)
Started Spybot.
Updated spybot - no new updates since I updated yesterday.
Immunized - nothing unprotected.
Scanned with spybot. Crash on exit with error.


Second Try - new profile in safe mode
Started Firefox - profile manager in safe mode (firefox --profilemanager --safe-mode)
Created new profile
Selected new profile and selected on popup window all changes to disable and reset to default settings permanently
then click "make changes and restart"
This caused all plugins from default profile to be installed but disabled
Only the following extensions were automatically installed and disabled (I think I'd have to uninstall them from the the external application.)
* Sunrise XP 1.0
* Java Quick Starter 1.0
Started Firefox - profile manager in safe mode (firefox --profilemanager --safe-mode)
Verified plugins and extensions installed and disabled
Started Spybot.
Updated spybot - no new updates since I updated yesterday.
Immunized - new profile required immunization
Scanned with spybot. Crash on exit with error.


That's all I can do for right now.
 
I can confirm that Firefox 3.5.2 can aggravate and cause this situation.

On a Windows 2000 (PII 400) system that has Firefox 3.5.2 installed, I had never experienced this error before, though I had manually scanned with the same updates dated 08-05-2009 when downloaded on 08-07-2009. The system also has AdvCheck163.exe installed in the main Spybot S&D folder with a verified good digital certificate.

After opening Firefox and running a manual scan, I received the same error messages mentioned in this thread and verified as the first time via Event Viewer. I normally run a scan with everything else closed, so interaction is undoubtedly involved.

Since Firefox was also Immunized, I have removed that with 'Undo' and am re-running a scan. This will take over an hour on this old system though, so I chose to post this portion now and will return later to update with those results.

Bitman

< EDIT > For the record, AV installed is Avast! current version, 4.9 I believe.
 
Last edited:
The results of testing by TexasDayLily are similar to my own, since only the fact that Firefox is open during the scan itself appears to matter. Removing all Immunization as well as closing TeaTimer seemed to have no effect on the issue. In fact, starting the scan with Firefox open but closing it shortly after the scan has started (before the 1,000 item mark) doesn't cause the error.

I'll also mention that my Firefox installation is the simplest possible, with only a default install and absolutely no add-ons of any sort, just a basic install of 3.0 upgraded to 3.5, 3.5.1 and then 3.5.2 over the last few months. In fact, it's barely used since it was installed primarily to test the browser on a custom web server application.

So it appears that the issue in my case relates only to Firefox being open during scan and then exiting Spybot S&D after an otherwise 'clean' result.

Since this really isn't an issue for me based on my normal usage patterns, I won't be spending any more time on this myself unless there is a specific potential fix the Spybot Team wishes to confirm. The slowness of this PC is simply too agonizing and I have no interest in installing Firefox anywhere else.

Bitman
 
@all

We have analysed the Bug Reports that some users have sent us - and some have also reported this in the forum - there seems to be one thing in common:

When you have Firefox opened during the scan you will get the error message with the "runtime error 216".
If you close your Firefox during the scan the error won't come up.

So please test this.

Thanks. :)

Best regards
Sandra
Team Spybot
 
I have been getting the 216 error for several weeks every time I closed Spybot after the scan was complete.

I am using Firefox 3.0.13 on Windows XP Pro SP3.

I just rebooted my system and ran Spybot before starting Firefox and Did Not get the error when I closed the program.

Hope this helps.

Tom
 
My results differ

My results differ.

Test 1, IE7 up, Firefox 3.5.2 down:
Note: Cleaned up some cookies.
Result: Error 216

Test 2, IE7 down, Firefox 3.5.2 down:
Did NOT run a scan.
Result: Clean

Test 3, IE7 down, Firefox 3.5.2 down:
Ran a scan.
Nothing was cleaned.
Firefox came up in the middle of the scan; I killed it immediately.
Result: Error 216

Test 4, IE7 down, Firefox 3.5.2 down:
Firefox did not start during this test.
Result: Error 216

Test 5, IE7 Down, Firefox 3.5.2 up:
Firefox was up for this entire test.
Result: Error 216

My conclusion: Firefox 3.5.2 being up or down does not affect this problem on this machine.

Other Notes:
1. I configured Spybot to do both an Update and an Immunize every time
it starts.
2. Symantec (10.1.5.5000) does a full scan every day at noon; definitions
are updated automatically before every run.
3. Spyware Blaster runs mid-morning every day.
4. I am in the administrator’s group for this machine.
5. I did not reboot at any point during this test.
6. I did not investigate the relationship between IE7 and error 216
7. I did not investigate Google Chrome, which has recently been
uninstalled on this machine.
8. I provided all 5 logs to Sandra separately.
 
Last edited:
SPuserID said:
My results differ.

Test 1, IE7 up, Firefox 3.5.2 down:
Note: Cleaned up some cookies.
Result: Error 216

Test 2, IE7 down, Firefox 3.5.2 down:
Did NOT run a scan.
Result: Clean

Test 3, IE7 down, Firefox 3.5.2 down:
Ran a scan.
Nothing was cleaned.
Firefox came up in the middle of the scan; I killed it immediately.
Result: Error 216

Test 4, IE7 down, Firefox 3.5.2 down:
Firefox did not start during this test.
Result: Error 216

Test 5, IE7 Down, Firefox 3.5.2 up:
Firefox was up for this entire test.
Result: Error 216

My conclusion: Firefox 3.5.2 being up or down does not affect this problem on this machine.

< SNIP >
Click to expand...
SPuserID,

I'd come to a slightly different conclusion.

Based on your test results, especially Test 3 where Firefox came up during the scan entirely on its own, I'd say you simply have a worse version of the same problem we do. For some reason your Firefox appears to be even more coupled into Spybot S&D than ours, so it's as if you are always running Firefox even when you apparently aren't. This may be a result of your first test and no reboot, but I'd suspect it's probably deeper than that myself so that a portion of Firefox is always in memory.

In any case, you've already done the best thing possible by sending your logs to Sandra and your more extreme issues may actually give better clues to determine the cause.

Bitman
 
I'm running IE 8.0 and XP Pro 2002 SP3 and I've been getting this same error since downloading 1.6.2. I've sent a copy of the error report as a MS Word Doc in an email to Spybot.

I deleted and reloaded Spybot several times and ran it with Advanced mode via the menu bar item "Mode" and select "Settings" --> "File Sets" in the left bar. and unchecked "trojansc" and "malwarec.sbi".

It still abends after running when trying to close Spybot.

I hope this can be resolved quickly. I've become concerned about the integrity of Spybot and thinking of (if any) alternatives.

Please help.
Ron
 
Last edited:
spybotsandra said:
@all

...there seems to be one thing in common:

When you have Firefox opened during the scan you will get the error message with the "runtime error 216".
If you close your Firefox during the scan the error won't come up.

So please test this.

Best regards
Sandra
Team Spybot
Click to expand...

For me, it didn't matter if (a) Firefox was open during a scan, (b) open then closed during a scan, or (c) not opened at all during the current logon session. Between each test, I shut down the PC. When I ran SpyBot in each test, I "Checked for Problems" (No problems reported), then used the screen to "Immunize". I have Global Hosts UN-checked on the immunize screen. The 216 error appeared after all 3 tests.

I removed SpyBot entirely after I did the test above. I then shut down my PC, and re-downloaded SpyBot using IE7. When I started SpyBot, I did NOT accept the updates. The update screen showed the following were available (but I did not download them):

- - - - -
1) Advanced detection library 1.6.3 ( 784KB - 2009-07-29 )
2) Immunization database ( 546 KB - 2008-11-05 )
3) Tea Timer update 1.6.6 ( 1011 KB - 2009-03-11 )
4) English descriptions ( 281 KB - 2008-09-10 )
- - - - -

I then ran the 3 tests above( a, b, and c), re-booting the PC between each test. The 216 error did NOT appear after each test.

I then re-booted, ran SpyBot and checked for up-dates (Firefox not started). The 4 updates listed above were available. I accepted all 4 of them. I then ran SpyBot and only "Checked for Problems". SpyBot reported no problems. I then closed SpyBot.... and the 216 error appeared !!
 
I run WinXP SP3 as an Admin account, use Firefox 3.0.12, and get the error messages regardless of whether FF is open or closed throughout the complete scan, or closed while the scan is in progress.

I do not get any error messages when I do the following:

1. In a C prompt, ENTER

at hh:mm /interactive cmd.exe

(where hh:mm is the current time in 24-hour format >PLUS 2 MINUTES<)

to get

C:\>at hh:mm /interactive cmd.exe
Added a new job ID = 1

2. Wait 2 minutes for the new command prompt

C:\Windows\system32>

to appear.

3. RClick on your Spybot S&D icon and select "Properties", COPY the "Target:" address within quotes, for example

"C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe"

Then in the new command prompt RClick and select PASTE to get:

C:\Windows\system32>"C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe"

4. Press ENTER to run the program.

This simulates an interactive window of the system account with its privileges, and allows any spyware removal tool to reveal and remove things that otherwise would not be seen.

I learned this several years ago from one of the very knowledgeable people at CastleCops, and is probably the geekiest thing I know — remember, I am nottageek.

Anyway, since I don't get any error messages running a scan this way, I have a very non-geeky hunch that it's significant and can lead to a solution to this problem.
 
My test scenario:

1. Booted up the p.c..
2. Started SpybotSD and ran a complete scan.
3. Closed the program and the 2 error pop-ups appeared.

Firefox was not started at all prior to or during the scan so i guess this is not a Firefox related issue.
 
I think we ought to put Firefox to bed on this issue. I get the 216 error every time I quit spybot after a successful scan. I don't have and have never had Firefox on this machine. Running XP Sp2 and IE7.
 
Buster said:
Hello @ all,

first of all, thanks for keeping an eye on this thread. :bigthumb:

Yes, we are still trying to track this error down. Unfortunately we have not been able to reproduce this issue on various test machines, which makes it even harder to find the origin of this bug.
So we are still collecting information about this. Although a few users reported that disabling some sbi files could fix the error, as I already suggested in one of my prior posts, this has not been a solution for everyone.
Regarding the distribution of this error, we are currently receiving a few emails each day, indicating, that a special setup seems to be relevant. Therefore I ask everyone who is still experiencing this bug to please send a complete bug report to detections@spybot.info with a reference to this thread. :thanks:
Click to expand...

Hi all, I have the same problem since early this month, I have try many ways in the past, such as re-reg all dll files, delete all prefetch files, as suggest by others on the web. I just found this thread today, via google search, and try to test to disable different sbi files in the setting, I found that the problem gone if I disable "MalwareC.sbi".

Will it cause insecure if I disable this sbi? what's the different between "MalwareC.sbi" & "Malware.sbi"?

Thanks!

p.s. I have not installed Firefox, I am using IE7
 
Last edited:
You must log in or register to reply here.
Back
Top