View Full Version : Major problems with 9-26-2012 update file
Yesterday, September 26, 2012, I updated my Spybot 1.6.2 as I do every Wednesday. I usually choose the Giganet mirror from the list of update sites, but it was not on the list yesterday so I chose SecurityWonks.net#1 (USA). There was only 1 file listed which was a 2MB file, which I downloaded and was installed. I rebooted into Safe Mode and ran my scan. It came back clean, so I rebooted. At this point, when the computer restarted it could not boot into Windows. It just goes into an endless loop of restarts once it gets to the point where Windows would normally load and take you to the desktop screen.
I cannot get into Safe Mode either as it does the same thing of the endless reboot. The first computer this happened on was a family member's which I had updated. I did not know there was a problem at that point because after I did the scan and rebooted, I left. It was a short time later when I was told that their computer was doing this continuous reboot thing and at that time I didn't know that the Spybot update was the cause.
When I got home I had to update my Spybot and do my weekly scan, so I did, and the exact same thing has happened to my computer. I updated from the same SecurityWonks.net#1 (USA) mirror and after the scan was complete and I rebooted, my computer is doing the same endless reboot that my family member's computer is doing. The operating systems for the 2 computers are XP Home and XP Pro, both with SP3.
It appears that the 2MB Spybot update file on the SecurityWonks.net#1 mirror for September 26, 2012 is infected with a virus or malware or is corrupted in some way and now I have 2 computers that I cannot use at the moment. Can you look into this immediately and let me know how to proceed to correct this as I have two computers that I cannot use at this time as a result of this issue.
This is the blue screen error message I get:
Stop c000021a {Fatal System Error}
The Windows Logon Process system process terminated unexpectedly with a status of
0xc0000135 (0x00000000 0x00000000) The system has shut down.
quirky1 on the Anandtech security forum is also having this issue "I have the same problem after downloading and scanning with Spybot. In my case the update file was downloaded from Safer-Networking mirror #2 and the resulting status code is 0x00000080. There is yet no mention of this problem in the Safer-Networking Forums. It appears Spybot has corrupted something. I don't understand how a simple scan with no problems found can cause this..."
Hello buck8,
Your topic has been flagged for attention.
Different time zones so a detective will respond when on-line. :)
Best regards.
spybotsandra
2012-09-28, 11:39
Hello,
We are very sorry that this has happened.
Our detection team has researched this issue and it seems that there was one detection rule and especially one file in our Wednesday's detection update that seems to have triggered the problem. This one file did delete a Windows system file. When you do a scan in normal mode everything should be fine and the file is being replaced by Windows.
But if you do a scan in safe mode it isn't, hence the booting problems.
As this only happens in safe mode, with Windows XP and SP3 we did not notice this problem immediately. So as soon as we did we created a new update that should fix this issue. Due to the booting problems you can not download it easily like our other users. So we would like to offer you our Spybot-S&D Boot CD for free. With this CD which is available as ISO download (if you have the possibility to download it on another pc and create a CD) you should be able to boot your PC again and download the updates. As we have your contact data we will send you an e-mail with this fix. We again deeply apologize for this issue.
Best regards
Sandra
Team Spybot
matthew.brett
2012-09-28, 13:10
Hi,
I appear to have the same as buck8
I ran a Spybot s+d scan yesterday (27th September) around 6pm UK time in normal mode. I am running a fully updated XP.
After the scan (which appeared clean) I got a windows dialog box about a dll having been deleted ; I seem to remember it had 'help' in the filename. I got a dialog box asking me to put the XP CD into the drive to restore the deleted files. Of course I did not have the windows XP CD to hand, and had to close the dialog box.
I rebooted and got the blue screen of death with the error : "windows logon process terminated unexpectedly" . This is so in safe mode and debugging mode. The disk looks clean to a windows chkdsk triggered from linux and as reported by the SMART metrics on the disk and memtest86 passes the machine, so I think this was the Spybot update.
Have you any suggestions?
Thanks,
Matthew Brett
andighan
2012-09-28, 13:16
Yesterday, September 26, 2012, I updated my Spybot 1.6.2 as I do every Wednesday. I usually choose the Giganet mirror from the list of update sites, but it was not on the list yesterday so I chose SecurityWonks.net#1 (USA). There was only 1 file listed which was a 2MB file, which I downloaded and was installed. I rebooted into Safe Mode and ran my scan. It came back clean, so I rebooted. At this point, when the computer restarted it could not boot into Windows. It just goes into an endless loop of restarts once it gets to the point where Windows would normally load and take you to the desktop screen.
I cannot get into Safe Mode either as it does the same thing of the endless reboot. The first computer this happened on was a family member's which I had updated. I did not know there was a problem at that point because after I did the scan and rebooted, I left. It was a short time later when I was told that their computer was doing this continuous reboot thing and at that time I didn't know that the Spybot update was the cause.
When I got home I had to update my Spybot and do my weekly scan, so I did, and the exact same thing has happened to my computer. I updated from the same SecurityWonks.net#1 (USA) mirror and after the scan was complete and I rebooted, my computer is doing the same endless reboot that my family member's computer is doing. The operating systems for the 2 computers are XP Home and XP Pro, both with SP3.
It appears that the 2MB Spybot update file on the SecurityWonks.net#1 mirror for September 26, 2012 is infected with a virus or malware or is corrupted in some way and now I have 2 computers that I cannot use at the moment. Can you look into this immediately and let me know how to proceed to correct this as I have two computers that I cannot use at this time as a result of this issue.
This is the blue screen error message I get:
Stop c000021a {Fatal System Error}
The Windows Logon Process system process terminated unexpectedly with a status of
0xc0000135 (0x00000000 0x00000000) The system has shut down.
quirky1 on the Anandtech security forum is also having this issue "I have the same problem after downloading and scanning with Spybot. In my case the update file was downloaded from Safer-Networking mirror #2 and the resulting status code is 0x00000080. There is yet no mention of this problem in the Safer-Networking Forums. It appears Spybot has corrupted something. I don't understand how a simple scan with no problems found can cause this..."
I've got the same problem with Windows XP SP2 with the last Spybot update, (excuse me for my poor english, I'm french)
All details are on my forum (with print screen) here (http://www.pandorabox.tk/showthread.php?tid=291) . The problem is detected with two differents computers (one of these was safe) after this update.
The scan is in normal mode, the result is the same, taskbar don't work and windows Logon KO. Blue screen.
When I erase windows partition (secure erase) and install a new version, it's ok (antivirus etc) and when I install Spybot with the last Update. I scan the computer and spybot find "fake.Adobe.zusy". After computer not responding with Hotkeys ctrl+alt+del (windows dialog box say: ws2help.dll is not found) The end is the same result of buck8, Boot is full corrupt and we can't use Windows Safe Boot.
Thanks to help us, I use Spybot since 2004.
spybotsandra
2012-09-28, 13:28
Hello Andi & Matthew,
You should receive your ISO within the next hour. :)
Best regards
Sandra
Team Spybot
matthew.brett
2012-09-28, 15:13
Thanks - the iso resolved the issue for me.
Matthew
matthew.brett- I have not been successful in getting the issue resolved yet, even with the use of the iso. Could you tell me the steps you took in getting the iso/boot cd to resolve the problem for you?
Thanks in advance for any help with this.
Also, Thank You!! to Sandra and the Spybot team for addressing this so quickly.
I am also unable to boot up my PC after scanning with Spybot, not even in Safe Mode. The machine in question is running Windows 2000 SP4 with all updates applied. The scan was done on Sep 27th in normal mode but the deleted system file was not restored since Windows 2000 does not have the 'copy back' feature that XP has. The stop and status codes are c000021a and 0x00000080.
Which system file was deleted? Was it ws2help.dll?
Do I need to manually copy the file from somewhere back into the system32 directory?
Will the ISO solution work for me? (I can guess but I'm not sure what that involves.)
Please provide detailed instructions for recovery, including procedures, file names and locations that are involved. I'm not as technically proficient as others in this forum. Thanks in advance.
andighan
2012-09-30, 22:31
It's nice, the problem is resolved with your Iso Thanks! After a boot with this disk, Spybot scan my hard-drive (without malicious detection) and finally Windows Boot OK ! It's now ok for me.
John72830
2012-09-30, 22:45
Alas, it appears that it got me too. I had three XP Pro sp3 machines set up to automatically update and scan for problems. On two of the machines, I was able to roll them back a week with system restore, then update the file, then shut down and reboot. On the third one, for some reason someone shut it off; now xp refuses to boot, I get the fatal error, I can't start in safe mode, and I can't even run recovery console. Worse yet, the 1.6.2 bootable cd iso does not appear to ba available. I installed 2.0 rc2 on the other two machines, but the option to create a bootable cd doesn't work. I think I'm gonna need some help.
Thanks,
John
I have the same problem with my XP machine after updating last Thursday (September 27th). I would be very happy if you can send me the ISO image of the boot CD.
Regards,
Peter
spybotsandra
2012-10-01, 15:01
We'll also create one for you too: Bot, John and Pieter. :)
Please i would like to receive the link to download de LIVE CD to fix this problem. I have run the update and cannot acces Windows anymore.
Thanks in advance.
spybotsandra
2012-10-01, 17:05
You've got mail. ;)
An update:
I managed to fix my Windows 2000 machine using the Recovery Console found on the Windows CD. Once in the console, copy ws2help.dll from system32\dllcache to system32, then exit to reboot. A couple of questions:
During the recovery process I found a file named ws2helpxp.dll in system32. It is identical to ws2help.dll byte for byte. Did Spybot rename rather than delete ws2help?
I've downloaded the latest Spybot detection rules but have not done a scan. Is it now safe to do so?
By the way, I was wrong about Windows 2000 not having a 'copy back' feature. The event log shows that it tried to restore the file but failed because it couldn't verify the version of the file that had been deleted. (i.e. Event ID 64004, error code 0x800b0003)
Sandra, I received your email. I hope I'll still receive the ISO for my trouble. It may come in handy in the future.
spybotsandra
2012-10-02, 10:48
Hello,
As far as I know the file was deleted.
Perhaps it is some kind of backup file or it is there due to the recovery process.
The additional update that we did release is fixed and does not have this issue.
So you can safely update.
I will write you an e-mail regarding the ISO. ;)
Best regards
Sandra
Team Spybot
update:
bot604- Thanks for the tip on ws2help.dll. The iso file that SpybotSandra provided me with was successful for 1 of the 2 computers that I have that were impacted by this issue. The second computer was not fixed by the iso, but I was able to manually replace the ws2help.dll, as per your post, and that restored it's ability to boot once again.
One difference for me was that I did not have a copy of the ws2help.dll in my
system32\dllcache folder. I had to get it from my XP disc.
Thanks to all!
buck8, Did you find ws2helpxp.dll in system32? If so, you may want to compare that version with the one you restored from CD to see which is more current.
I also have the fatal error blue screen and looping reboot of Win xp pro/sp3 after updating Spybot and running scan. What do I need to do? thanks!
I also have the fatal error blue screen and looping reboot of Win xp pro/sp3 after updating Spybot and running scan. What do I need to do? thanks!
If you can access the file system on your computer look for ws2helpxp.dll in system32 and rename it to ws2help.dll.
If you cannot access the file system on your computer please send an email with a link to this thread to software@spybot.info.