Just to add to this, I had a customer yesterday with the exact same problem.
In the end I had to extract the hard drive and install it as a slave drive, then load up the Registry hive using this guide. Interestingly when navigating to the
The Userinit entry was there, but the value was completely blank! It clearly creates the same problem as removal of the spyware itself.
I then entered the value:
and then unloaded the hive which solved the problem. Interesingly Microsoft themselves don't seem to document this technique.