Can't boot after v1.5.2 installation

I was able to create a BartPE disk, works great but the fix is not working, I changed the registry and rebooted, still logs in then logs out...

simon

Had the same problem...made a BartPE disk, and at first I didn't think it was working either....because I was still being emediately logged out. However, the problem is that I was trying to enter the original PW to logon. This isn't necessary after you use the BartPE disk. The PW is no longer there. So you need make sure when you go back to login to your computer that you DONT enter a password after running BartPE...just hit enter and you should be able to log right on to your computer!

Making the BartPE turned out to be the most frustrating part of this whole nightmare process, but I'm just thankful I was able to get back into my computer without having to completely reinstall everything and wipe my computer!
 
Last edited:
Chalk up 3 more hosed PCs

I downloaded the latest update last night, and today I am in the login/logout loop! My machine is a Dell. I came to work and asked our IT guy about it and he said 2 other people at work had had the exact same problem after running Spybot over the weekend!

I really think you should be devoting time to figuring out what your last update is doing to people's PCs... PRONTO!
 
Are you running XP? Are you running a non-OEM version (i.e. Dell, Emachine, etc)? All our problems are on these systems.
 
stuck too

same issues on my desktop. I believe that one is running an older version of spybot but i cannot get in to see which one it is

I ran the upgates on both desktop and laptop yesterday 6/29. Laptop which has a more current version is ok, desktop is stuck in a login/log off loop

both are running XP
Laptops a toshiba/desktops a HP
 
Last edited:
For what it's worth, I am not experiencing any problems regarding those updates...and, like someone else on this thread said, the developers need to get right on this and find out what happened to all these PC's. I am rather nervous about this software right now, truth to tell.

I have 2 computers. One is an HP Desktop with Windows XP Media Center Edition. I'm using AVG 7.5 with that. I disabled AVG before running Spybot's installation. I do not have the IE helper or the teatimer turned on, only the immunizer. Spybot is not finding any problems on this machine, although I presently have a case presented to Castlecops re a suspicious file which I have since deleted, but that's not relevant. No behavior problems on this computer. Scans by BitDefender, ESET, and AVG say the computer is clean. In my inexpert opinion, I cannot see anything untoward in the HiJackthis logs.

The other is a Lenovo laptop running Windows XP Pro. I am not using any of the resident features. Spybot scans do not identify any problems. I am also using AVG 7.5 and have consulted Castlecops because this laptop is networked to the PC and I may have opened the file on it as well. I can't see an obvious problem on the Hijackthis log here either.

Neither system is displaying any aberrant behavior. Ewido scans on both cleared out 150 tracking cookies missed by Spybot.

I downloaded the update from the Canadian mirror.

Maybe this helps, maybe not...But I would want to know what the problem computers all have in common and the setups of machines that have not had any problems.

Good luck to all, hope you solve it soon!

P.S. OS's on both computers are SP2. Spybot version 1.5.2 on both as well. I use Firefox on the desktop and Opera on the laptop.
 
Last edited:
Just for the record, I am running a Windows XP Pro on a Dell Inspiron 5150 computer. Today I used my Spybot (version 1.3) to download the latest malware definitions. I started the program and after a short time I noticed the “HELLZLITTLESPY” definition as one of the being found. I was not familiar with this spyware and before I did anything else I did a Google search and luckily found this web forum. When I went back and looked I discovered that this supposed malware was actually defining a part of the registry. So I was glad that I did not remove it.

I also noticed that one of the posts suggested that the problem might be that I was using the 1.3 version with the newer definitions causing the disastrous false positive. I was going to download the newest 1.5.2 version,as suggested when I noticed the other posts indicating that this very act seeming also produced the same boot up problem.

So at this time I am not going to do anything until this situation is cleared up. But I do appreciate this forums existence and will be following it for further information.

Best Regards,
Bill
 
Just for the record, I am running a Windows XP Pro on a Dell Inspiron 5150 computer. Today I used my Spybot (version 1.3) to download the latest malware definitions. I started the program and after a short time I noticed the “HELLZLITTLESPY” definition as one of the being found. I was not familiar with this spyware and before I did anything else I did a Google search and luckily found this web forum. When I went back and looked I discovered that this supposed malware was actually defining a part of the registry. So I was glad that I did not remove it.

I also noticed that one of the posts suggested that the problem might be that I was using the 1.3 version with the newer definitions causing the disastrous false positive. I was going to download the newest 1.5.2 version,as suggested when I noticed the other posts indicating that this very act seeming also produced the same boot up problem.

So at this time I am not going to do anything until this situation is cleared up. But I do appreciate this forums existence and will be following it for further information.

Best Regards,
Bill

I think it's always a good idea to confirm that anything any security program flags as 'malware' truly *is* malware. Any security program can come up with a false positive, and sometimes those can be devastating. I used to use ZoneAlarm Internet Security Suite and it was constantly trying to nuke my graphics card software!

I learned to appreciate virustotal.com and just recently discovered http://virusscan.jotti.org/ for getting a second opinion on individual files . When I want a second opinion with a full system scan, I use Bitdefender online for a full scan (set it to 'report only' first!) and I recently tried ESET for the first time a few days ago. Disable your resident antivirus before running these scanners. ESET provides the option to automatically clean. I did not let it do so. When I ran ESET, if it had found a problem, I would have made a note of it, researched it, and then decided if I wanted to redo the scan and let ESET clean it. Ewido is a good free online scanner as well. You can check there first to see if your resident AV is compatible before you run the scanner. It gives you the option of deciding what to do with any malware it finds as well. I used Panda a few years ago and it was good and thorough, as was Housecall. However, both these require constant back and forth between their server and your PC throughout the scan, and that takes too much bandwidth for that to be workable with my internet connection.

P.S. I'm not an expert, I'm just a person who used to own a Windows 98SE computer that required a LOT of pampering and 'fixing' to keep it running, and being in a rural area, I had to learn to do a lot by myself and ask a lot of questions at forums and e-mail lists because I simply had no other option. I now own a wonderfully stable XP Media Center Edition machine and it is very important to me that it STAY that way. :) The laptop is a little over a week old and running beautifully, as only a new computer can, and I also want to keep it that way.
 
SimonSays:


Booting into Safe Mode, did you try?
  1. Last Known Good Configuration (only can be tried once).
  2. Safe Mode with Command Prompt.
    • If you able to get the Command Prompt, type:
      • %systemroot%\system32\restore\rstrui.exe

I updated spybot on Friday 27 Jun and did not not start the laptop until this morning and i have the exact problem. As soon as i log on XP logs me off i tried the safe modeoptions with no luck........Never had this problem before this update....
 
I have had this on many computers so far and have successfully repaired it! Follow the instructions here to build a Bart PE CD:
http://thinkinginpixels.com/quick-fixes/fix-windows-xp-log-onlog-off-loop

I noticed that you must use a non-OEM Windows XP CD to build the Bart PE CD.

THANK YOU! This worked perfectly on my Dell, I'm really glad I didn't have to reinstall.

So was it determined that the log on/off loop was caused by the removal of HellzLittleSpy? Because my spybot did in fact detect it right after I ran the update. I removed it and that's when I started having problems, I'm kinda curious on how it got on my system or how long it's been there.

I just ran another scan and it detected it again, does anyone have an idea on how to safely remove it?
 
I can confirm that this issue occurs with the dated Spybot S&D 1.3 and current signature updates on Windows 2000 or newer. The general option to avoid this issue is to use the current Spybot S&D 1.5.2 with the signature updates made for it.

So anyone still using a Spybot S&D 1.3 should upgrade , for instance activate the mainupdate within the internal updater.

If the issue already occured you can use the methods Malloc described to restore login. The first and easiest way Malloc names is to edit the registry with a remote computer through the network. Also see page 1 of this thread.


At least 2 users appear to have this issue with Spybot S&D 1.5.2 which should not be possible. In these cases please send your latest fixes logs (located in c:\documents and settings\all users\appdata\spybot - search & destroy\logs\ ) and an export of the registry key
Code:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

to detections@spybot.info with a reference to this thread
 
You guys arent getting it

Your problem is not spybot, It never was. Your problem is two things, CoolWWWsearch.hjg and HellzLittleSpy. Once you remove HellzLittleSpy you won't be able to get back on your desktop, ever! I've been trying in vain to find a solution to get those two out without having problems. I still can't. I downloaded CWS shredder and it got rid of coolwwwsearch.hjg but without finding a way to get rid of HellzLittleSpy as well, it just comes right back. And like I said, if you let ANY VERSION of spybot, spyroot spywhatever delete it, you arent coming back to your desktop! This is so incredibly AGGRAVATING!! I can't believe after all this time there's STILL no solution. I'm sorry if I sounded nasty in all this, I honest to god didnt mean to and I apologize to you all. I'm just so exhausted with this thing. I cant get rid of it!!! job1866@aol.com
 
I've done everything suggested here - no luck!

I still can't log in! Last night I created the BartPE, edited the registry back to what it should be, and I'm still looping. My company's IT department has had my machine all morning with no success!

This is NOT a MINOR inconvenience Spybot people. Your program has destroyed (at least so far) many PCs and wasted substantial time for probably 1000's of people. Remember, most people can't get here to complain... because their PC doesn't work!

I talked to a Geek Squad buddy of mine who says he has given up trying to fix this and is just reinstalling XP! What are the downsides to doing that?
 
Im having the same problem right now. I do have a network at home and i have tried accesing the registry but it wont work. i can get to the command prompt using my recovery disk but i dont know where to go from here. can anyone help?
 
Sorry for the above post but it wouldnt let me edit. I am running xp on a gateway. I ran the scan yesterday and spybot deteceted a couple of items but the only ones i remeber where hellzlittlespy and a better internet auroura. then after i removed those i went on system internals to clean the registry, then i tried restarting the computer and the whole looping nightmare started. I cant access the registry through my network ive tried that, I was going to try the bart thing but im running vista from this computer and am not sure if it will work. I can get to the command prompt by using my recovery cd but all it says is A:\> and i have no idea where to go from there. Can anyone help?
 
ToastedPC:

I ... edited the registry back to what it should be, and I'm still looping. ...

The normal entry is looks like this from a registry export (Windows XP):

Code:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
"Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"
Or like this in Registry Editor (regedit.exe):

Code:
Userinit REG_SZ C:\WINDOWS\system32\userinit.exe,
Where by columns:
  • Name = Userinit
  • Type = REG_SZ
  • Data = C:\WINDOWS\system32\userinit.exe,
Is that what you edited the entry to?

If so, is there a "userinit.exe" in the path "C:\WINDOWS\system32"?
 
I was able to remove my hard drive and connect it to my work laptop using an adater, I see it as a storage drive.
I went into the windows/system32 and copied the userinit.exe from my laptop.
Still does the same thing, logs then off. I had it for setup to auto login, no password needed. Could this be causing a problem?
Any ideas guys?

Thanks for your help
 
Back
Top