New Defs and Old version cases logon issue

[icemannd]

The new definition files released the 25th in combination with v1.3 (I know not supported) detects the valid value of HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon\Userinit as "HellzLittleSpy" and deletes the value leaving it blank.

This causes a logging on user to be immediately logged off until the value is properly restored to c:\windows\system32\userinit.exe,

Problem only seems to occur in v1.3/

[Malloc]

Good call on it being 1.3 that causes it. I've seen it randomly and wasn't sure why or how, but every one that I've had to correct this on has 1.3 installed. I'm guessing autoupdate doesn't update the program version but only the definitions. Any chance of that happening?

http://forums.spybot.info/showthread.php?t=30030

[tashi]

Hello,

Any chance of that happening?

Spybot-S&D v1.3 is very old, any reason you have not upgraded to v1.5?

Version 1.6 is due shortly.

Regards.

[macdunn]

When I run 1.5.2.20 with the 25 June 2008 Updates, it only searches for 169160 items. When I run 1.3, it searches for 169175 items and it finds HellzLittleSpy which 1.5 does not find.

Why upgrade to 1.5 when it does not seem to be as good as 1.3?

[tashi]

Hello,

When I run 1.5.2.20 with the 25 June 2008 Updates, it only searches for 169160 items. When I run 1.3, it searches for 169175 items and it finds HellzLittleSpy which 1.5 does not find.

Why upgrade to 1.5 when it does not seem to be as good as 1.3?

1.3 may have given a false positive on HellzLittleSpy. 1.5 has more effective detections and new functions.What is your operating system?

2008-06-25
Total: 663265 fingerprints in 171141 rules for 4049 products.

http://forums.spybot.info/showthread.php?t=30020

Regards.

[walker]

This answer is a classic. Why would I upgrade to the current version when no mention of it occurs??...and the software continually accesses the current available downloads.

Hello,


Spybot-S&D v1.3 is very old, any reason you have not upgraded to v1.5?

Version 1.6 is due shortly.

Regards.

[walker]

Reference AIK...it's supposed to be for the below....but option #3 in your fix doesn't say this. Is AIK plus your other 2 downloads good for Win. 2000 Pro?






System Requirements
Supported Operating Systems: Windows Server 2008; Windows Vista


Windows Vista

Windows Vista Service Pack 1

Windows Server 2008

Windows Server 2003 Service Pack 1 with KB926044

Windows Server 2003 Service Pack 2

Windows XP Service Pack 2 with KB926044

[Yodama]

What do you mean no mention of the new version?
What do you think main update means?
It gets shown in every update.

It seems to have been an error to not force new versions like other software do.

If you want help, we are willing to help but if you just want to let off steam you are at the wrong place.

As to your Norwegian fix number 2.....the link to download that particular boot cd doesn't work. Excellent.

I do not see the link not working, it worked yesterday and it works now, approx 50 min. after your post. Of course there can never be a guarantee that links always work. As of now netcraft does not show any downtime on that server.

[HP_XP_User]

HellzLittleSpy Fix that really, really does work…..

Numerous, recent posts have indicated that the 06/25/08 update with SpyBot V1.3 seems to indicate CoolWWWSearch.hjg and HellzLittleSpy as false positives.

After going through the absolute “nightmare” of restoring my home network after letting SpyBot remove the “Userinit” value from the registry, here is how I managed to get my 3 home network PC set up back when the Userinit reg setting gets wiped out from the reg value settings,

As you know you can’t even really effectively boot into SafeMode, so you can’t even run a DOS prompt to run any batch program to re-write the registry, you get into that endless logon – logoff loop, etc., etc.,

………………..WELL DON’T RUN TO REFORMAT!

Go to the big audio/video chain stores and get a product called “Fix It Utilities Professional version 8. It is made by Avanquest, it sells for about $40, and it’s a 3 user license. Pop the CD into your drive, change any bios/boot up settings to allow the PC to boot from the CD rather than the hard drive and let the CD boot. Once it boots, and the interface comes up, run the program called Recovery Commander. Choose the option to restore from a System Restore Checkpoint. Let it run and assuming you do have a series of system checkpoints to choose from, you should be OK, once you reboot. This is a lifesaver!

By the way, I do not work for this company, I am not trying to submit an ad, I don’t get any kickbacks, I too was beyond enraged after letting Spybot screw my PC. Then I remembered that I had this software. I use this for other stuff, this utility is loaded with other things that you will want to use, I repeat it is a Lifesaver and perhaps the best $40 you will ever spend, since without that reg value your PC is nothing more than a very large and heavy paperweight!!!!!

By the way see my previous post about yet another false positive!

Hope this helps the countless users that seem to be hit by this “false positive”


HP-XP_User

[md usa spybot fan]

Coho_Bruce:

There are other options in the thread referenced by Malloc in post #2 above:

http://forums.spybot.info/showthread.php?t=30030

For example:

I've had this happen on 6 computers so far, but I have them on the network so I can remove registry edit though them.

Here are some other tools that have offline registry edits:

http://home.eunet.no/~pnordahl/ntpasswd/
http://windowsxp.mvps.org/peboot.htm
http://ubcd4win.com/index.htm