Technology Forum

Hello all, I'm not very knowledgable with registry editing, etc. but my SpyBot S&D recently found a virus called "HellzLittleSpy" that changed my registry in my windows xp SP2. Worried, I "fixed" it but when I attempted to type in the password to log on on my next startup, my computer immediately logged me off (without even loading the entire desktop).I have seen evidence of this problem by other people that tried to "Fix" HellzLittleSpy...Currently, I am using the old copy of Win 2k Pro that came with my computer, as the XP is inoperable. I can still access all (or most) of my data because it is on my second HDD, the one without the OS's installed, but still I cannot use XP and of course the desktop is different and I have to look for all of the programs since they are not in the Start Menu of 2k. Plus, some programs don't work anymore since the OS is different, I need to get back on XP! UGH!I need to fix this registry change but I have no registry experience and cannot even log on the OS with the change in order to fix it...Please help! I need my beloved XP SP2 back...

I encountered the same problem here in Beijing, China last week. No matter how many Spybot detection and deletions I run, both HellzLittleSpy and Cool return after each run. I have run other programs, such as Ad-ware and ThreatFire, but they do not detect this malware. I ran Spysweeper free download detection but not cure, it finds HellzLittleSpy but not Cool.
Aside from reformating my drive and reloading, any alternatives?

I had the exact same problem this week. Very frustrating. I tried three different utility programs that I could boot from the CD drive. Norton System Works, System Mechanic, and Fix It Utilities 8. Fix It Utilities 8 was the only one that solved the problem. Use it to boot from the CD. Run the "Recovery Commander" then restore a "system restore checkpoint"
Everything is fine now. Works good.

Assuming this is the same thing we're suffering from in our office, and assuming you have rights to remotely edit the registry on your afflicted PC, this is a fix:

1. Run Regedit.
2. Connect to the PC with the logon/logoff loop problem
3. Browse down to "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"
4. The key 'Userinit' will be blank (or possibly set to a value other than it should be)
5. Repopulate it with the following (assuming Windows is installed to 'C:\Windows'): "C:\Windows\system32\userinit.exe,"

Leave out the quote marks, but make sure to include the comma at the end of the string.

This will at least keep the user of the PC going until the next reboot or logoff and logon (i.e. unlocking the PC won't produce the same symptom because the user account is already logged on to the console).

Jeff
London, England
Constants aren't. Variables won't.
Apostrophes do NOT belong in plurals of acronyms like PCs, HDDs, CPUs and so on