Blue Screen after running Spybot

[ken545]

http://forums.whatthetech.com/Used_Spybot_and_now_i_have_a_blue_screen_HELP_t93928.html&gopid=476204#entry476204

Hello,

I work logs in the Malware Removal forum both here at Safer and WhattheTech, just wanted to give you a heads up on this one, I have never seen this happen before. I don't know what else the poster has done to cause this issue.

Ken (AKA Ken545 )

[spybotsandra]

Hello,

Was it an old Spybot version?
http://forums.spybot.info/showthread.php?t=30030

What did he fix?

Best regards
Sandra
Team Spybot

[ken545]

Morning Sandra,

He posted no information as to the version or what else he did, just that he ran spybot and after it was done he got a blue screen. Not ever sure he ran SSD.

[DougCuk]

I just checked the forum post - and as you say not enough info to identify the problem.

However I have seen this before when the Winlogon\Userinit registry entry has been "infected" and points to a spyware exe file. The example below is an infected registry entry:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit= C:\WINDOWS\system32\userinit.exe, C:\WINDOWS\system32\ntos.exe

The ntos.exe entry should not be present - the userinit.exe entry alone is correct. In some cases Spybot deletes both the file and the whole registry entry - if this happens XP will no longer boot and just gives a BSOD error.

Restoring an earlier version of the registry should recover the bootup - you may then have to edit out the call to the missing spyware exe file.

[ken545]

Hi,

I doubt that he made a reg backup but I will ask when he posts back.