Page 3 of 9 FirstFirst 1234567 ... LastLast
Results 21 to 30 of 84

Thread: Spybot 1.6 locking user registry hives

  1. #21
    Member
    Join Date
    Oct 2007
    Posts
    55

    Default

    Hi jjjdavidson,

    The PE_C_ keys should be removed when Spybot terminates normally. However when my clients called me and their accounts were locked I ran some tests on my system. I found that for six program starts, the PE_C_ keys were not removed. Then on the seventh time the keys were deleted. I have yet to reproduce this problem again. It seems now my system is removing the keys everytime.

    As for the PE_C keys still existing after a reboot, the answer is yes. This is what happened with two of my clients. When this happens a temporary profile is created when the user logs in. The first thing I had them try was a reboot. We had to manually unload the PE_C keys from the Administrator account using regedit. I have tried to reproduce this on my system but have been unsuccessful.

  2. #22
    129260
    Guest

    Lightbulb i as well....

    now experience this issue....it just happened. Weird thing is...the spybot scan was completely finished and the program closed. I logged off, and i let my sister log on. She as well as soon as she logged on, it said temporary user as well. i held in the power button and restarted and everything, her account was rebuilt from scratch. However, i could find all her files in c/documents and settings/(user) and they were in there. However, when she logs on, it looks like the account was just created. I am going to try a system restore to fix this, as i have no idea how to mess with reg hives.

  3. #23
    129260
    Guest

    Angry just great....

    now not only has my sister lost her account, my other limited user account is gone as well. i mean they are there, but now they wont even load the accounts now ether. My sister her account loaded the temp account fine at first. I tried a system restore and now none of the limited accounts work. At least my admin account still loads and works fine. (the one i scanned on) Luckily i was able to recover there data, but i am going to delete the accounts and remake them as i don't know what to do in the registry. Then i will put the data back on...ugh this stinks. I hope deleting the accounts and remaking them fixes this...
    Last edited by 129260; 2008-09-22 at 04:20.

  4. #24
    Member
    Join Date
    Oct 2007
    Posts
    55

    Default

    Hi 129260,

    Sorry I did not read about your problem sooner. All you had to do was login to your account which had administrator priv's. Once in your account just run regedit from the Run box. Navigate to the HKEY_USERS section of the registry. Expand the HKEY_USERS section by clicking on the + sign. Find the PE_C_ keys for the accounts that have been locked and remove the keys. You can remove the keys by highlighting them and selecting Unload Hive from the File Menu. That will unlock the accounts and then the user can login again. There should be no side effects to their accounts. All settings and files should be as they were before the problem occurred. FYI I do not recommend using System Restore as it can corrupt your system and make matters worse. You should look into a proven backup software. I use and recommend Retrospect Professional from EMC Dantz. Here is the link...

    http://www.emcinsignia.com/products/smb/retroforwin/#

  5. #25
    129260
    Guest

    Lightbulb haha well to late for that...

    i had already tried system restore before you replied. its ok though, thanks. Well if this happens again i now know what to do. Thanks for the info. In any rate, deleting the accounts and making them again seemed to have solved the problem. The only thing that happened was avast got corrupted and i had to reinstall it. Not all the shield providers were able to run. Anyway, avast is now working fine, and i am glad this mess it over with. Now I'm just hoping it did not corrupt anything else...

    Thanks alot for the info, i appreciate it.

  6. #26
    Member
    Join Date
    Oct 2007
    Posts
    55

    Default

    Hi 129260,

    Glad you are back in business. I really wish the developers would have a look at this thread. This is definately a serious problem and needs to be investigated. Lets hope the problem is corrected before other have the same issue.

  7. #27
    129260
    Guest

    Thumbs up ur telling me

    Quote Originally Posted by MrGreg View Post
    Hi 129260,

    Glad you are back in business. I really wish the developers would have a look at this thread. This is definitely a serious problem and needs to be investigated. Lets hope the problem is corrected before other have the same issue.
    it is, i thought it was mild at first, but now i am seeing how much of a problem this is. I am hoping the spybot team can come up with a solution.

  8. #28
    Junior Member
    Join Date
    Sep 2008
    Posts
    6

    Default

    I'm sorry to hear that you ran into this problem. I'm still waiting on a fix before I install it on systems with more than one account.

  9. #29
    Member of Team Spybot PepiMK's Avatar
    Join Date
    Oct 2005
    Location
    Planet Earth
    Posts
    3,601

    Default

    @MrGreg: haven't seen this thread before, sorry!
    There's a simple command line parameter to suppress the loading of user hives: /nouserhives.
    On machines with Terminal Services, this is even the default.

    As for the reboot, I have to agree with jjdavidson that loaded hives do not persist over reboots.

    @Tivon: if you schedule scans you don't want te interrupt login processes, simply use /nouserhives.

    Personally, I would also prefer hives that are properly loaded and fully managed by Windows itself and not forced into memory the hard way, but the regular way needs users to be logged on to scan their profiles, but that can be done only with their credentials (which from the security standpoint is ok, even an admin shouldnt be able to imersonate users).

    If the hives persist after closing Spybot: does Spybot (or Windows) show any error messages on closing?
    Just remember, love is life, and hate is living death.
    Treat your life for what it's worth, and live for every breath
    (Black Sabbath: A National Acrobat)

  10. #30
    129260
    Guest

    Lightbulb @ PepiMK

    I experienced no error messages when closing spybot or anything from windows after my scan completed. It created a temp account without any notice at all! I logged off after my spybot scan completed, and the program was closed. My sister logged on and it said temp account is being used. I restarted and it still did not fix the problem. I had to delete all limited user accounts and recreate them; because at the time i did not understand how to mess with the registry to get them back.
    Last edited by 129260; 2008-09-22 at 16:03.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •