The new definition files released the 25th in combination with v1.3 (I know not supported) detects the valid value of HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon\Userinit as "HellzLittleSpy" and deletes the value leaving it blank.

This causes a logging on user to be immediately logged off until the value is properly restored to c:\windows\system32\userinit.exe,

Problem only seems to occur in v1.3/