THANK YOU! This worked perfectly on my Dell, I'm really glad I didn't have to reinstall.
So was it determined that the log on/off loop was caused by the removal of HellzLittleSpy? Because my spybot did in fact detect it right after I ran the update. I removed it and that's when I started having problems, I'm kinda curious on how it got on my system or how long it's been there.
I just ran another scan and it detected it again, does anyone have an idea on how to safely remove it?
This isn't the only forum discussing this. Here's one:
http://forums.majorgeeks.com/showthread.php?p=11765
I can confirm that this issue occurs with the dated Spybot S&D 1.3 and current signature updates on Windows 2000 or newer. The general option to avoid this issue is to use the current Spybot S&D 1.5.2 with the signature updates made for it.
So anyone still using a Spybot S&D 1.3 should upgrade , for instance activate the mainupdate within the internal updater.
If the issue already occured you can use the methods Malloc described to restore login. The first and easiest way Malloc names is to edit the registry with a remote computer through the network. Also see page 1 of this thread.
At least 2 users appear to have this issue with Spybot S&D 1.5.2 which should not be possible. In these cases please send your latest fixes logs (located in c:\documents and settings\all users\appdata\spybot - search & destroy\logs\ ) and an export of the registry key
to detections@spybot.info with a reference to this threadCode:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Your problem is not spybot, It never was. Your problem is two things, CoolWWWsearch.hjg and HellzLittleSpy. Once you remove HellzLittleSpy you won't be able to get back on your desktop, ever! I've been trying in vain to find a solution to get those two out without having problems. I still can't. I downloaded CWS shredder and it got rid of coolwwwsearch.hjg but without finding a way to get rid of HellzLittleSpy as well, it just comes right back. And like I said, if you let ANY VERSION of spybot, spyroot spywhatever delete it, you arent coming back to your desktop! This is so incredibly AGGRAVATING!! I can't believe after all this time there's STILL no solution. I'm sorry if I sounded nasty in all this, I honest to god didnt mean to and I apologize to you all. I'm just so exhausted with this thing. I cant get rid of it!!! job1866@aol.com
I still can't log in! Last night I created the BartPE, edited the registry back to what it should be, and I'm still looping. My company's IT department has had my machine all morning with no success!
This is NOT a MINOR inconvenience Spybot people. Your program has destroyed (at least so far) many PCs and wasted substantial time for probably 1000's of people. Remember, most people can't get here to complain... because their PC doesn't work!
I talked to a Geek Squad buddy of mine who says he has given up trying to fix this and is just reinstalling XP! What are the downsides to doing that?
Im having the same problem right now. I do have a network at home and i have tried accesing the registry but it wont work. i can get to the command prompt using my recovery disk but i dont know where to go from here. can anyone help?
Sorry for the above post but it wouldnt let me edit. I am running xp on a gateway. I ran the scan yesterday and spybot deteceted a couple of items but the only ones i remeber where hellzlittlespy and a better internet auroura. then after i removed those i went on system internals to clean the registry, then i tried restarting the computer and the whole looping nightmare started. I cant access the registry through my network ive tried that, I was going to try the bart thing but im running vista from this computer and am not sure if it will work. I can get to the command prompt by using my recovery cd but all it says is A:\> and i have no idea where to go from there. Can anyone help?
ToastedPC:
The normal entry is looks like this from a registry export (Windows XP):
Or like this in Registry Editor (regedit.exe):Code:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon "Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"
Where by columns:Code:Userinit REG_SZ C:\WINDOWS\system32\userinit.exe,
- Name = Userinit
- Type = REG_SZ
- Data = C:\WINDOWS\system32\userinit.exe,
Is that what you edited the entry to?
If so, is there a "userinit.exe" in the path "C:\WINDOWS\system32"?
Getting an answer is one thing, learning is another.
Microsoft Windows XP Home Edition running on a 2.40GHz IntelŪ PentiumŪ 4 Processor with 512 MB of RAM and a 533 MHz System Bus.
I was able to remove my hard drive and connect it to my work laptop using an adater, I see it as a storage drive.
I went into the windows/system32 and copied the userinit.exe from my laptop.
Still does the same thing, logs then off. I had it for setup to auto login, no password needed. Could this be causing a problem?
Any ideas guys?
Thanks for your help