W2K continually reboots (Just before log in) After updates?

[jgrant07]

You can use a Bart's PE disk with a registry editor plugin to change the
autorebootbehaviour.

To uninstall hotfixes from the Recovery Console navigate to the hotfix's
spuninst directory and use the BATCH command to process the uninstall
routine. Example:

cd %systemroot%\$NtUninstallKBnnnnnn$\spuninst

(or simply: cd $NtUninstallKBnnnnnn$\spuninst )

then issue:

batch spuninst.txt

If the batch command fails try:

batch spuninst.bat

John










- Show quoted text -

Hello all,

Just wanted to share my experience with this update that came out on
the 8th of this month that affects the Windows 2000 professional
computers rebooting just before login. After speaking with Microsoft,
it is actually the combination of the kb931768 update, along with a
malicious software removal update for May that came out at the same
time.

If you can boot into the recovery console and do the steps above as
noted by John John to uninstall the 931768 update (mine was named
$ntuninstallkb931768-IE6SP1-2007... (I forgot the rest of the path)),
and reboot after the uninstall, it would still reboot the machine just
before login screen appeared.

However, if you go into recovery console and go to c:\winnt\debug and
look at the log files there, you will see that the malicious software
removal tool actually tagged c:\winnt\system32\sfc.dll as a virus and
deleted the file at the next restart.

To fix this issue, uninstall the update 931768, then type the
following at the recovery console:

expand d:\i386\sfc.dl_ c:\winnt\system32\

After the sfc.dll file is restored, reboot the machine and everything
should come up just fine.

We have 50+ computers that all had automatic updates turned on, so
after we got them back up and running, needless to say we disabled
automatic updates until Microsoft has released a patch to fix this
issue.

I hope this information helps anyone else--it sure would have saved us
numerous hours!

Thanks!

jgrant07

 

[Guest]

I can confirm after several repairs I finally booted to my desktop (all be it
blank) on two or my three machines.

The followed "Dave" instructions (ctrl-alt-del) run explorer.exe, turn off
updates, run manual updates, avoid 0kb updates.

Thanks everyone for help.

Now - I would like to know the true cause of this - was it KB931768?
Have MS acknowledged there is a problem - or are we just drawing conclusions
that problems occured after update?

I am concerned as I have another 10 w2k machines on my network. Why were
these not effected? (The are set to automatically update)

I am concerned they may exhibit symptoms at a later date.

Thanks

 

[Guest]

KB931768 is strongly supect. MS has contacted me asking for any and all
data, logs and DMP files from my affected systems.

 

[Guest]

Thanks to John and jgrant07 - I followed John's steps for removing the update
and the jgrant07's for reinstalling the sfc.dll file and it worked perfectly.
We had spent two days researching this issue and our only fix so far was a OS
Reinstall/repair. We only have about 250 Win2k machines left in our
environment and already 15 of them were affected. This will save us a ton of
time. Thank you both.

Microsoft really failed us on this one.

 

[John John]

Thanks for the follow up. Users with many affected machines should keep
in mind that they can save the necessary commands as .txt files on a
floppy diskette and that they can then use the BATCH command in the
recovery console to process the .txt files on the floppy. It will save
lots of keystrokes and repetitive work! Example:

Save as undokb.txt

==============================================
cd %systemroot%\$NtUninstallkb931768-IE6SP1-2007... \spuninst

=================================================

At the Recovery console you can then issue:

batch a:\undokb.txt

and it will process the command and go to the directory, and save some
keystrokes. In the Recovery Console I don't think that you can run a
batch command inside another batch command so once at the directory you
can issue the uninstall batch command:

batch spuninst.txt


On the floppy you can save another text file:

Save as fixsfc.txt

======================================================
expand d:\i386\sfc.dl_ c:\winnt\system32\

=======================================================

You could then issue:

batch a:\fixsfc.txt

and the command to replace the sfc.dll will be processed.

Users should verify that the proper paths are entered in the commands,
the path in the first example is not complete.

John

 

[jgrant07]

Thanks for the follow up. Users with many affected machines should keep
in mind that they can save the necessary commands as .txt files on a
floppy diskette and that they can then use the BATCH command in the
recovery console to process the .txt files on the floppy. It will save
lots of keystrokes and repetitive work! Example:

Save as undokb.txt

==============================================
cd %systemroot%\$NtUninstallkb931768-IE6SP1-2007... \spuninst

=================================================

At the Recovery console you can then issue:

batch a:\undokb.txt

and it will process the command and go to the directory, and save some
keystrokes. In the Recovery Console I don't think that you can run a
batch command inside another batch command so once at the directory you
can issue the uninstall batch command:

batch spuninst.txt

On the floppy you can save another text file:

Save as fixsfc.txt

======================================================
expand d:\i386\sfc.dl_ c:\winnt\system32\

=======================================================

You could then issue:

batch a:\fixsfc.txt

and the command to replace the sfc.dll will be processed.

Users should verify that the proper paths are entered in the commands,
the path in the first example is not complete.

John






- Show quoted text -

Hey guys,

Here is the email that Microsoft sent me today regarding the problem:

Hi Jared,

I got an update from the security team and I'm forwarding that along
to you.

Problem:
--------------
May 2007 Security Updates are installed and we are in a reboot loop
with the following bugcheck:

STOP: 0xc000021a (Fatal System Error)
The Windows Logon Process System process terminated unexpectedly
with a status of 0xC0000080 (0x0000000 0x00000000).

This only applies to Windows 2000.

Cause:
-----------
Contrary to what I said on Friday, the Malicious Software Removal Tool
(MSRT) actually finds (and not mistakenly thinks) that SFC.dll is
infected but MSRT instead of repairing the SFC.dll file, deletes it.


Resolution:
=================
1. Boot to Recovery Console using a Windows 2000 CD.

229716 Description of the Windows 2000 Recovery Console
http://support.microsoft.com/default.aspx?scid=kb;EN-US;229716

3. Copy the file SFC.DLL from the Windows 2000 CDROM or another
computer running Windows 2000 to %systemroot%\SYSTEM32. Here is an
example of copying the file from a Windows 2000 CD in recovery
console:

COPY d:\i386\sfc.dl_ c:\winnt\system32\sfc.dll
However since we copied the sfc.dll from the CD, we probably have an
older version so I'm sending you hot fix 836726 which you will need to
install to update the version currently installed.

According to the security team, not everyone that deployed this patch
MS07-27 ran into this issue with sfc.dll being deleted. If you ran
into this issue, it means that there is most likely a virus on your
system and they recommend that you run an AV scan before re-installing
the hotfix.

The hotfix has since been modified to repair the sfc.dll file if it
find corruption there rather than delete it.

3. Once you've completed the above steps you can reinstall MS07-027
and it should install successfully with no problems.


I'll send you the hotfix in a different email. Let me know if you have
any other questions.

836726 Windows component files are not removed in Microsoft
Windows 2000 Server
http://support.microsoft.com/default.aspx?scid=kb;EN-US;836726


Regards,
Funmi.


They also sent me another email with a link to the hotfix, although
apparantly they are monitoring the downloads because it is password
protected and will expire after 7 days. Microsoft said this is because
"WARNING: This fix is not publicly available through the Microsoft
website as it has not gone through full Microsoft regression testing",
otherwise I would post it here. However, the update is numbered
178695.

Of course, my question is if you can install the update if your
machine has already been affected?

We just restored the sfc file and disabled automatic updates for the
time being.

Good luck to all...

Jared

 

[paw71]

I think John is missing one point: you need to get to recovery console
in order to follow you fix. it is so rarely to get working recovery
console that i do not even know how it is looks like.



you need to use BartPE cd and just put sfc.dll file back to the
windows system32 folder. it can be any sfc file from working computer.
after all computer works fine and removing kb931768 is not necessary.
so far our computers working with this update. maybe after couple
restarts they stop.

you can also use windows98 startup disc and replace sfc.dlll file. of
course, your system file must be fat32 in order to load win98 disc. i
was successful to do it in one of my older computers with fat32 file
system. it is working fine .


PAw

 

[John John]

I think John is missing one point: you need to get to recovery console
in order to follow you fix.

??? The complete thread and all the posts from start to end revolve
around doing the work in the Recovery Console. Where did you get the
idea that any suggestions did not entail using the RC?

John