Endless reboots on Windows XP after Spybot Search and Destroy update and scan

[Hardball]

Yesterday, September 26, 2012, I updated my Spybot 1.6.2 as I do every Wednesday. I usually choose the Giganet mirror from the list of update sites, but it was not on the list yesterday so I chose SecurityWonks.net#1 (USA). There was only 1 file listed which was a 2MB file, which I downloaded and was installed. I rebooted into Safe Mode and ran my scan. It came back clean, so I rebooted. At this point, when the computer restarted it could not boot into Windows. It just goes into an endless loop of restarts once it gets to the point where Windows would normally load and take you to the desktop screen.

I cannot get into Safe Mode either as it does the same thing of the endless reboot. The first computer this happened on was a family member's which I had updated. I did not know there was a problem at that point because after I did the scan and rebooted, I left. It was a short time later when I was told that their computer was doing this continuous reboot thing and at that time I didn't know that the Spybot update was the cause.

When I got home I had to update my Spybot and do my weekly scan, so I did, and the exact same thing has happened to my computer. I updated from the same SecurityWonks.net#1 (USA) mirror and after the scan was complete and I rebooted, my computer is doing the same endless reboot that my family member's computer is doing. It appears that the 2MB Spybot update file on the SecurityWonks.net#1 mirror for September 26, 2012 is infected with a virus or malware or is corrupted in some way and now I have 2 computers that I cannot use at the moment. What do you suggest I do?

 

[Hardball]

I was able to get the following blue screen error message:
Stop c000021a {Fatal System Error}
The Windows Logon Process system process terminated unexpectedly with a status of
0xc0000135 (0x00000000 0x00000000) The system has shut down.

Is this any help to getting to a solution?

 

[KillerBee]

edit: deleted

 

[Hardball]

vtx1300- I'm on XP Pro sp3. As far as a system repair boot disk, I have my copy of XP Pro to get to the Recovery Console as well as a copy of Ultimate Boot CD for windows. Are these what you mean? What is the first step with these tools?

 

[KillerBee]

lol - yea I deleted it after seeing you were talking about XP and not Win7

Need to google XP repair options - it's been so long since used it

 

[Chiefcrowe]

I assume there is no way of getting to system restore right now right?

Try following this, it may help you:
http://michaelstevenstech.com/XPrepairinstall.htm

 

[Hardball]

Chiefcrowe- can't get to the system restore. I am running chkdsk /r from the recovery console right now. The first pass completed an chkdsk said that it found and fixed one or more errors on the volume. I am running a second pass now. I tried the Fixmbr command last night, but to no avail.

In researching this today, a file name keeps coming up as a possible problem. Winlogon.exe may have been corrupted by the Spybot scan and could be the source of my problem. Maybe the updated definition file from Spybot was corrupted and it damaged or corrupted the Winlogon.exe file when the scan was run, even though no problems were detected during the scan itself?

 

[Chiefcrowe]

possibly. but now i'm thinking it may be a hard drive problem. See what happens when you run a HD diagnostic utility.

 

[Hardball]

I might have thought hard drive also, but not when I do the same update on Spybot S&D from the same mirror site on 2 seperate computers, within a couple of hours of one another. Both computers doing the same reboot loop after doing a scan in Safe Mode and then rebooting to the desktop as usual, having never displayed any sort of problems before with Spybot S&D after years of use and now both are doing the same weirdness??

 

[quirky1]

I have the same problem after downloading and scanning with Spybot. In my case the update file was downloaded from Safer-Networking mirror #2 and the resulting status code is 0x00000080. There is yet no mention of this problem in the Safer-Networking Forums. It appears Spybot has corrupted something. I don't understand how a simple scan with no problems found can cause this.

 

[Hardball]

quirky1- have you had any success sorting this out as far as getting your computer working again?

 

[KillerBee]

Spybot will create log files under here :
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Logs

If you can boot with a Linux Live CD and mount your drive
maybe one of them will tell you what it changed?

 

[Hardball]

quirky1- What OS are you using on the computer that has been impacted by the Spybot update yesterday? Did you do the scan in Safe Mode?

 

[quirky1]

Sorry for the delay in answering but I have very limited access to the net without my computer. I can't do anything with it at the moment because I can't even boot into safe mode. My Spybot scan was done in normal mode in Windows 2000 with all the updates.

I see you have filed a report in the Safer-Networking forums. I'm hoping there'll be some sort of simple resolution. I hesitate to mess around as it may make things worse.

Our detection team has researched this issue and it seems that there was one detection rule and especially one file in our Wednesday's detection update that seems to have triggered the problem. This one file did delete a Windows system file. When you do a scan in normal mode everything should be fine and the file is being replaced by Windows.

I encountered the problem even in normal mode. Is she referring to the file ws2help.dll? If I can boot into the recovery console with my Windows CD, could I then simply copy a copy of that file into the system32 directory? (I've never used the recovery console before and don't know exactly what I'll encounter.)

 

[Hardball]

quirky1-- Sandra from Spybot never specified which system file got messed up. I was leaning towards winlogon.exe based on what the blue screen error message says, but I'm not sure. Earlier today the Spybot rep posted in their forum about a link to an iso file that they will email to you if you contact them about the issue. The iso needs to be burned to a cd and then you can boot into Spybot program, run a scan, and then do an update to get the revised update file and fix the issue. After that you should be able to reboot and start Windows normally again So far it has not worked for me, but it has for other posters in their forum.

 

[quirky1]

Well I managed to boot up my machine with the Windows CD but didn't see the recovery console option. It turns out it has to be installed from the CD in order for it to show up as an option; it can also be run from the CD but I'll need to do some research in order to go that route. At this point it may be safer for me to follow the prescribed solution. I'll post a query to the Safer-Networking forum.

 

[quirky1]

I managed to fix the problem. I'll post details in the Safer-Networking forum.

 

[Chiefcrowe]

Please post a link to your forum post, i am curious.

 

[quirky1]

Here is the post.