Rootkit plug in problem

[crabherring]

I have a computer with multiple user logins. I updated spybot today with the anti-rootkit plugins as part of the update. I did this as administrator. When I logged out of administrator and logged in as a user, I got an error from Windows indicating that the user profile could not be read and could not be found and a default profile was loaded. I worked around this by removing the user profile (which was there) and relogging in as the user. This forced a rebuild of the user profile. Of course I had to save user documents, desktop, etc... before doing this. By the way, the user is member of a domain (don't know if this matters).

I installed the same update on an identically configured computer, but this time I unchecked the download boxes next to anti-rootkit. I did not see the user profile problem on this computer.

So, for now, I'm not allowing rootkit to install on future updates.

[PepiMK]

You just need to restart, and the problem will be gone :)

That's a problem when you run the update while Spybot-S&D is open. To avoid this completely, just run the updater from the start menu while Spybot-S&D is closed. But as I wrote, a restart will allow login again. 1.5.3 will have it fixed as well.

[crabherring]

Okay, that worked. Guess I should have tried the obvious first :)

[grossrider]

If possible, I'd like a little more explanation - because at this point I'm running scared.

When the anti-rootkit plugin update first showed up, I did the update and all the logins other than the one from which I did the login were broken. This happened on two machines, one running XP-Home and one with XP-Pro. I honestly can't remember if I did a re-boot or not, but I may have been afraid to for fear of breaking the only working login I still had.

I brought up Regedit, and discovered that under HKEY_USERS there were entries pe_c_<login> ahead of the S-1-5-18 etc. entries, one for each of the no longer working logins. I don't pretend to understand what this means, but it definitely followed Broken Logins verses Working Logins.

I used Recovery to roll back to pre-SBS&D update status, and everything was okay. Now today, I did another update excluding the infamous anti-rootkit plugin, and discovered
the pe_c_<login> entries were back. When I exited SBS&D the went away.

So -- do these entries show up every time I update the program, and go away when I exit? Do you promise that there truly is not a problem with the anti-rootking plugin update, as long as I do it outside of Spybot or I re-boot afterwards?

If updates are going to have this affect of breaking all but one login until a re-boot, don't you think maybe it might be appropriate to make this information a bit more available than having to search the forum for various strings and then interpret the criptic explanation?