View Full Version : Rootkit plug in problem
crabherring
2008-03-19, 16:39
I have a computer with multiple user logins. I updated spybot today with the anti-rootkit plugins as part of the update. I did this as administrator. When I logged out of administrator and logged in as a user, I got an error from Windows indicating that the user profile could not be read and could not be found and a default profile was loaded. I worked around this by removing the user profile (which was there) and relogging in as the user. This forced a rebuild of the user profile. Of course I had to save user documents, desktop, etc... before doing this. By the way, the user is member of a domain (don't know if this matters).
I installed the same update on an identically configured computer, but this time I unchecked the download boxes next to anti-rootkit. I did not see the user profile problem on this computer.
So, for now, I'm not allowing rootkit to install on future updates.
You just need to restart, and the problem will be gone :)
That's a problem when you run the update while Spybot-S&D is open. To avoid this completely, just run the updater from the start menu while Spybot-S&D is closed. But as I wrote, a restart will allow login again. 1.5.3 will have it fixed as well.
crabherring
2008-03-20, 14:45
Okay, that worked. Guess I should have tried the obvious first :)
grossrider
2008-03-30, 03:35
If possible, I'd like a little more explanation - because at this point I'm running scared.
When the anti-rootkit plugin update first showed up, I did the update and all the logins other than the one from which I did the login were broken. This happened on two machines, one running XP-Home and one with XP-Pro. I honestly can't remember if I did a re-boot or not, but I may have been afraid to for fear of breaking the only working login I still had.
I brought up Regedit, and discovered that under HKEY_USERS there were entries pe_c_<login> ahead of the S-1-5-18 etc. entries, one for each of the no longer working logins. I don't pretend to understand what this means, but it definitely followed Broken Logins verses Working Logins.
I used Recovery to roll back to pre-SBS&D update status, and everything was okay. Now today, I did another update excluding the infamous anti-rootkit plugin, and discovered
the pe_c_<login> entries were back. When I exited SBS&D the went away.
So -- do these entries show up every time I update the program, and go away when I exit? Do you promise that there truly is not a problem with the anti-rootking plugin update, as long as I do it outside of Spybot or I re-boot afterwards?
If updates are going to have this affect of breaking all but one login until a re-boot, don't you think maybe it might be appropriate to make this information a bit more available than having to search the forum for various strings and then interpret the criptic explanation?