Can't boot after v1.5.2 installation

walker said:
I appreciate the quick answer.....but I believe a boot into safe mode is impossible with the missing file (removed by hellzlittlespy error).

If I could get into safe mode I could fix the problem.
Click to expand...

in this case it is not about logging in to Windows safe mode, it is sufficient to get the login screen, then shut down properly (this has to be done twice).

This is about the file system, if you restart Windows by means like the reset switch or ctrl+alt+del the file system will be flagged as "dirty" and cannot be written with the bootcd from method 2.
 
Yodama said:
in this case it is not about logging in to Windows safe mode, it is sufficient to get the login screen, then shut down properly (this has to be done twice).

This is about the file system, if you restart Windows by means like the reset switch or ctrl+alt+del the file system will be flagged as "dirty" and cannot be written with the bootcd from method 2.
Click to expand...

Yes, but getting into Safe Mode is part of the loop...so what is considered a proper shut down?....just shutting off the power??....there is no box to check to say....Shut Down........it is going to be a hard shut down no matter what.

(I'm trying to say...you don't get a login screen because that is in the loop)

...by the way...anything here that could help?
http://www.ntfs.com/boot-disk-dos.htm

I tried this...but I can't figure out what to do. I also purchased $40 worth of a recovery program.....but the recovery points were removed by Norton....so ng.
 
Last edited:
walker said:
Yes, but getting into Safe Mode is part of the loop...so what is considered a proper shut down?....just shutting off the power??....there is no box to check to say....Shut Down........it is going to be a hard shut down no matter what.

(I'm trying to say...you don't get a login screen because that is in the loop)

...by the way...anything here that could help?
http://www.ntfs.com/boot-disk-dos.htm

I tried this...but I can't figure out what to do. I also purchased $40 worth of a recovery program.....but the recovery points were removed by Norton....so ng.
Click to expand...

ok, it seems I falsely assumed an explicit login which requires. An auto login makes this issue more complicated. I will see if I can find a way around this and also check the boot disk from the link you provided.
 
Thank you yodama!!

I chose "Method #2, Offline registry tools and password resetter" posted by Yodama

Thanks again Yodama for your help and quick response.

What a relief. (so that's what my desktop looks like) What an ordeal.
You were right, I should have kept going. I couldn't read the next screen shot until you pointed it out.

It's been a long week, but I learned a lot--even learned to almost like my notebook--saved me this time.

Oh well, time to start backing up the old desktop--HO!
where have I heard that before?

Steve_C
 
Yodama said:
ok, it seems I falsely assumed an explicit login which requires. An auto login makes this issue more complicated. I will see if I can find a way around this and also check the boot disk from the link you provided.
Click to expand...

...yes, it has no password....autologon........in regular boot the logon box and the desktop wallpaper keep flashing in sync....in safe mode the box "loading settings".....just stays there and never goes into safe mode.

If I could get the "dirty disk" thing cleared out.....I could get this sorted.....the success of Steve_C.....would repeat.....I got to the end of the edit....but the screen warns that it cannot write until 2 safe mode shutdowns are made. The software is fairly easy to use.....except for this issue.

I read all of the material from the writer of the disk....it seems this "dirty disk" thing is an issue and he doesn't actively support the software.
 
ATTN Yodama
as you seem to be reading the forum now
Please correct the mistakes in your blog.
http://forums.spybot.info/blog.php?b=14
All your paths for Windows2000 are incorrect and will not work for those users.
eg
"for Windows 2000
c:\windowsnt\......."
Should be
"for Windows 2000
c:\winnt\......."

Terminator,
I didn't intend to 'slander' anyone.
'Team Members' posting 'ideas' without having first replicated the problem and then fixed it, are wasting people's time.
The blog has errors that I pointed out yesterday and that remain uncorrected today and which if followed will just waste more people's time.
Also some posters are promoting commercial $oftware here as a fix. Circling sharks? No slander. There's blood in the water.

Editing the registry from another NT(w2k,xp - vista(?)OS installation would be the quickest way for people who have a network setup or who are prepared to physically remove the affected drive and slave it to a working box.
I tried the latter after reading this page:

http://smallvoid.com/article/winnt-offline-registry-edit.html

(Note: the paths to the files/registry-hives in step 4 in the above page relate to Windows2000 eg:
winnt/system32/config/software
For XP just substitute windows for winnt).

However, I didn't read step 4 properly on that page and loaded the wrong hive. Being smart I assumed (wrongly) that I should load the file/hive 'ntuser.dat' from my admin profile which I did and the key was there but the entry wasn't so I added it, put the drive back in it's own box and of course still had the logon loop so I just used my backup disk image I'd made a few hours before and moved on - problem fixed, time wasted and work lost.
In hindsight I should have loaded the hive: \system32\config\SOFTWARE (I think) and fixed the registry entry in there.
That's the extensionless file C:\Windows\system32\config\SOFTWARE <-XP
and C:\WINNT\system32\config\SOFTWARE <-Windows2000

Read the above page link and the following extra notes might help.

Start>Run and type regedt32
(Regedt32.exe is here: C:\WINDOWS\system32\regedt32.exe <-XP
and here: C:\WINNT\system32\regedt32.exe <-Windows 2000)

In Regedt32 make sure 'View' is set to 'Tree and Data' and 'Security>Permissions' has 'Read' & 'Full Control' checked.

When you have the hive loaded and named it something obvious (like STUFFUP) navigate to & highlight the key:
Software\Microsoft\Windows NT\CurrentVersion\Winlogon in the left pane
(If there's another key named WINDOWSNT, it's NOT that one, it's as above: Windows NT).
Then go to 'Edit>create new value'.
Type Userinit in the 'Name' field and make sure REG_SZ is in the 'Type' field.
Click OK and the String Editor box will open. Type or paste the path to userinit.exe in the field:
C:\Windows\system32\userinit.exe, <-XP AND don't forget the comma at the end!
C:\WINNT\system32\userinit.exe, <-Win2000 AND don't forget the comma at the end!

Unload the hive and close regedt32.
If you've jumper slaved the drive don't forget to move the drive jumper back to master before you put it back in its box.

Now, I did this in the wrong hive as I said so I haven't verified that it works. But if the value gets written then it should be good to go.

Maybe someone from Safer Networking can check these steps, make sure it works and post it as a sticky (and somehow GET it to ALL your users along with other working methods).
Those who are capable can do it themselves and those who are not could print it out and take it to their local computer mr.fixit or competent friend. Shouldn't take a few minutes to fix with the RIGHT instructions.
 
ATTN Yodama (Again)
I see you've made the w2k corrections to your blog.
But. Right down the bottom of Method 4.....one(at least) correction too many:

" Windows XP:
Code:
cd c:\Winnt\system32\config
rename software software.oldbackup
rename software.bak software "

Cheers.
Oh, Terminator.
Cheers. I just popped the top off one myself.

Oh all right.
That code up there for XP should be
cd c:\Windows\system32\config
Winnt is the Windows 2000 toilet as we all now know.

For the record I was running Spybot 1.3 when I downloaded all the latest definitions only, ran it and ended up in the basket. I didn't download the program update nor anything to do with TeaTimer or Immunising both of which I never use.
Why was I using old 1.3? Because I'd tried 1.4 and it was very slowwwww.

Malloc, way back on page1 of this thread first suggested the offline registry editing AFAIK.

I'm not scared to try Spyboot again.
But I might wait out a few rounds and see what happens.
 
i have not studied all written here, but this link worked for me:

http://www.tek-tips.com/viewthread.cfm?qid=924408

I suspected HellzLittle what ever caused it and when I just ran spybot it's there again, so i googled it and found all you folks trying to get a fix. I don't know if it'll work for you, but it did for me. I did not have a bootable CD either. I just renamed the software hive per below, added userinit value (mine was blank) and then put original registry back. Pls don't bust my chops - I'm an old guy that has little experience - and may have taken a bad risk - but i had no important info on this home xp computer. happy 4th.

Here's paste from above link.

" Here is a second approach to making the computer bootable:
(from the LavaSoft forum)

First things first get to recovery console.

At recovery console, we need to replace the software hive with a previous good backup. It should look something like this:
C:\windows>cd system32\config
C:\windows\system32\config>ren software software.old
This renames the current software hive to software.old
C:\windows\system32\config>copy C:\windows\repair\software
It should say "1 file(s) copied"
NOTE: After the next step you will want to remove the cd, then boot into safe mode. If you do not boot into safe mode in Windows XP it may prompt you to reactivate and you may not be able to get into Windows.

C:\windows\system32\config>exit

Now hit the F8 key and boot into safe mode. Logon to the administrator account when you reach the welcome screen. Hopefully you will be able to logon.

Now we need to edit your old registry to change the path to the userinit.exe file:
open regedit.exe
Highlight HKEY_LOCAL_MACHINE (note: this is important, if you do not highlight this the next step will not work)
goto file - load hive...
Now select your old registry file which should be in C:\windows\system32\config\software.old
It will ask you what to name it, if you don't understand, just type "test".
Now navigate to the following:
HKEY_LOCAL_MACHINE\<what your named this in the previous step>\microsoft\windows nt\currentversion\winlogon.
Look at what the userinit value is. On my customer's machine it was %system32%\userinit.exe which is invalid.

NOTE: If you can, post what your value is when you look at this.

Next change the value to read C:\windows\system32\userinit.exe

Now close the registry editor, and we need to go back to recovery console to put your original registry back which should look like this:
C:\windows>cd system32\config
C:\windows\system32\config>del software
C:\windows\system32\config>ren software.old software
C:\windows\system32\config>exit

This (in theory) should get you back into Windows.
 
Still trying to fix log on/log off issue

Help. I have been trying to fix the log on/log off problem for several days. I am working on a romote computer with XP Home edition.

Using Yadama's instructions I followed the procedures in Method 2. I was able to do everything successfully, but when I tried to log on the problem was still there. I repeated the procedure several times. Each time the register entry has remained the corrected form:

c:\windows\system32\userinit.exe,


Then method 4 was posted and I followed it. I created a NTFS4Dos cd. Booting it in my computer I get to

A:\>

Here I type in:

cd c:\Windows\system32\config

and I get the message:

CHDIR failed for 'c:\Windows\system32\config'

if i simply type:

cd c:

then the following appears

C:\
A:\

Any suggestions?
 
VaDave said:
Help. I have been trying to fix the log on/log off problem for several days. I am working on a romote computer with XP Home edition.

Using Yadama's instructions I followed the procedures in Method 2. I was able to do everything successfully, but when I tried to log on the problem was still there. I repeated the procedure several times. Each time the register entry has remained the corrected form:

c:\windows\system32\userinit.exe,


Then method 4 was posted and I followed it. I created a NTFS4Dos cd. Booting it in my computer I get to

A:\>

Here I type in:

cd c:\Windows\system32\config

and I get the message:

CHDIR failed for 'c:\Windows\system32\config'

if i simply type:

cd c:

then the following appears

C:\
A:\

Any suggestions?
Click to expand...


Any help out there i'm in this exact boat..........
 
A:\>

type c:

A:\>c:

press 'Enter'

C:\>

type cd c:\Windows\system32\config

C:\>cd c:\Windows\system32\config

press 'Enter'

C:\Windows\system32\config>
 
shame2 said:
A:\>

type c:

A:\>c:

press 'Enter'

C:\>

type cd c:\Windows\system32\config

C:\>cd c:\Windows\system32\config

press 'Enter'

C:\Windows\system32\config>
Click to expand...


If only i can get there:

C:\Windows\system32\config>

I did everything you did above and continue to get

CHDIR failed for c:\Windows\system32\config


So i've got other problems apparently. I also can no longer get to the sign in window that has the dreaded sign in log off problem. DRAMA DRAMA DRAMA
 
A:\>

type c:

A:\>c:

press 'Enter'

C:\> <- Can you get this far? The C: prompt. You must get to this stage first.

If you didn't get this then do it and try entering your 'cd ....' command again. If that fails try this at the C:\> prompt:

type dir c:

C:\>dir c:

Press 'Enter'

a list of dir's (directories aka folders) on the root of C: will be displayed

See what your windows folder is called. Eg 'Windows' for XP, 'Winnt' for windows2000
To access other drives from the command prompt the first command you have to enter is simply the drive letter followed by a colon eg:
a: or b: or c: ........ x: y: z: etc etc to get the correct drive letter prompt.
The command " cd " means 'Change Directory' (directory also known as folder)
The error message you're getting 'CHDIR failed.....' means at least one of the directories/sub-directories in that path cannot be found.

Make sure you are typing the path correctly, no extra spaces etc.

Have a poke around with the drive letters and the dir command if you have more than one drive.
"I also can no longer get to the sign in window......"
You're not leaving the boot cd or floppy in it's drive are you?
 
shame2 said:
A:\>

type c:

A:\>c:

press 'Enter'

C:\> <- Can you get this far? The C: prompt. You must get to this stage first.

If you didn't get this then do it and try entering your 'cd ....' command again. If that fails try this at the C:\> prompt:

type dir c:

C:\>dir c:

Press 'Enter'

a list of dir's (directories aka folders) on the root of C: will be displayed

See what your windows folder is called. Eg 'Windows' for XP, 'Winnt' for windows2000
To access other drives from the command prompt the first command you have to enter is simply the drive letter followed by a colon eg:
a: or b: or c: ........ x: y: z: etc etc to get the correct drive letter prompt.
The command " cd " means 'Change Directory' (directory also known as folder)
The error message you're getting 'CHDIR failed.....' means at least one of the directories/sub-directories in that path cannot be found.

Make sure you are typing the path correctly, no extra spaces etc.

Have a poke around with the drive letters and the dir command if you have more than one drive.
"I also can no longer get to the sign in window......"
You're not leaving the boot cd or floppy in it's drive are you?
Click to expand...

I can get here

C:\>

and then here

C:\>dir c:

I'm at work and can't make use of the laptop right now but the info i got after going to the dir c: was minimal at best...

Actually what showed i put in another thread Saturday/sunday which appears to be lost now. CHI-VA was assisting at the time.....I'll have to get back to this once i get home......

THANKS
 
Hi rvnmaniac!

My posts are lost too. Something seems to wrong with your system. If I remember it correctly you have a Windows XP CD available. In this case I would recommend to build a BartPE CD. It is just a small download. You will need about 30 minutes to build the CD. The advantage is that you have an user interface similar to Windows XP which makes it easier to find and repair your system. No need to use stupid, confusing command lines.:lip:

Homepage from BartPE:
http://www.nu2.nu/pebuilder/

Here is a little video for building the CD:
http://www.youtube.com/watch?v=78gKzcuq-dw

You can find a guide for repairing your system here(post 27):
http://forums.spybot.info/showthread.php?p=210078#post210078

Before you can use the above fix you have to find your Windows system first. I would recommend to use "Total commander" (a file manager) which you can find on your BartPE CD.

Find this folder:

c:\windows\system32\config

Probably it is c: but it could be a different one. Don't mix it up with the folder for BartPE. It is easily to distinguish if you just take a look if the drive contains your data.

If you have found your system drive please rename(right mouse on the specific file and choose rename):

'default.bak' to 'default'
'sam.bak' to 'sam'
'system.bak' to 'system'
'software.bak' to 'software'
'security.bak' to 'security'

This is necessary because we have to undo the changes from the recovery console. After that you can proceed like described in this post:
http://forums.spybot.info/showthread.php?p=210078#post210078

I have to ask it again because this is necessary to understand what has happen to your system. Do you only have used the recovery console to rename the file names? You haven't formated the drive nor created new partitions? The same with the ultimate boot CD?

Formatting and creating new partitions would definitely delete your data. So don't do it.
 
I too have a question about this, please help!!

Unlike these unfortunate guys, I didn't shut down my computer after version 1.3 found hellzlittlespy. Out of curiosity, I googled hellzlittlespy and came to this. needless to say I freaked after reading all this.
So, I made the entry in the regedit userinit value box as told (it was missing!)
Will this keep my computer from this nightmare?
Should I do anything else?
oh yeah, I installed ver 1.52 and have NOT rebooted, to be safe I restored the hellzlittlespy and www.coolsearch back into the system
What do I do next?

thanks,
John
 
chi-va said:
Hi rvnmaniac!

My posts are lost too. Something seems to wrong with your system. If I remember it correctly you have a Windows XP CD available. In this case I would recommend to build a BartPE CD. It is just a small download. You will need about 30 minutes to build the CD. The advantage is that you have an user interface similar to Windows XP which makes it easier to find and repair your system. No need to use stupid, confusing command lines.:lip:

Homepage from BartPE:
http://www.nu2.nu/pebuilder/

Here is a little video for building the CD:
http://www.youtube.com/watch?v=78gKzcuq-dw

You can find a guide for repairing your system here(post 27):
http://forums.spybot.info/showthread.php?p=210078#post210078

Before you can use the above fix you have to find your Windows system first. I would recommend to use "Total commander" (a file manager) which you can find on your BartPE CD.

Find this folder:

c:\windows\system32\config

Probably it is c: but it could be a different one. Don't mix it up with the folder for BartPE. It is easily to distinguish if you just take a look if the drive contains your data.

If you have found your system drive please rename(right mouse on the specific file and choose rename):

'default.bak' to 'default'
'sam.bak' to 'sam'
'system.bak' to 'system'
'software.bak' to 'software'
'security.bak' to 'security'

This is necessary because we have to undo the changes from the recovery console. After that you can proceed like described in this post:
http://forums.spybot.info/showthread.php?p=210078#post210078

I have to ask it again because this is necessary to understand what has happen to your system. Do you only have used the recovery console to rename the file names? You haven't formated the drive nor created new partitions? The same with the ultimate boot CD?

Formatting and creating new partitions would definitely delete your data. So don't do it.
Click to expand...

having problems downloading the BartPE CD. Watching the you tube display my folder was missing the ISO file pebuilder3110a. So i will try downloading it again.........I've only used the recovery console and have not formatted the drive nor created new partitions.......
 
rvnmaniac said:
having problems downloading the BartPE CD. Watching the you tube display my folder was missing the ISO file pebuilder3110a. So i will try downloading it again.........I've only used the recovery console and have not formatted the drive nor created new partitions.......
Click to expand...

Downloaded again and got 4 Errors and 9 Warnings.......this is almost like work............
 
Ok, you can stop trying to build the BootCD. It seems that you don't have much luck. I guess that you are using an OEM version of Windows XP. Probably one from Dell. I'm almost out of ideas. :buried:

Do you have already tried all drive letters from a: to z: with NTFSDos? Wasn't there any folders if you used the 'dir' command? Please also try the command 'CHKDSK'. This will show you the data state of the drive.

Apart from that, do you have a second desktop computer where you can plug your hard disk?

Good Night!
 
You must log in or register to reply here.
Back
Top