Log in Logs straight back Out 1

[SamHale]

Hello everyone.

I've just got home from work and my brother tells me theres a problem with the main computer on our network. The computer boots up perfectly fine, but it gets to the windows login screen (this is XP home, so where you have the picture and then username, and you have to click your name), then when you select which user to login as, it starts loading, and then immediately logs back out playing the windows shut down tune, but doesn't shut up, just takes you back to the login screen. The exact same thing happens in safe mode.
Any ideas?

Thanks,
Sam.

 

[bcastner]

You have malware:

http://www.winxptutor.com/wsaremove.htm

See: faq608-4650

 

[SamHale]

I can't get into windows to do any of that.
The System restore copying the userinit.exe recommended on wsaremove.htm didn't work.

Anyone else ?

Thanks anyway bcastner.

 

[bcastner]

COPY USERINIT.EXE WSAUPDATER.EXE

 

[bcastner]

There has been some morphing of the BlazeFind malware. Here is a second approach to making the computer bootable:
(from the LavaSoft forum)

First things first get to recovery console.

At recovery console, we need to replace the software hive with a previous good backup. It should look something like this:
C:\windows>cd system32\config
C:\windows\system32\config>ren software software.old
This renames the current software hive to software.old
C:\windows\system32\config>copy C:\windows\repair\software
It should say "1 file(s) copied"
NOTE: After the next step you will want to remove the cd, then boot into safe mode. If you do not boot into safe mode in Windows XP it may prompt you to reactivate and you may not be able to get into Windows.

C:\windows\system32\config>exit

Now hit the F8 key and boot into safe mode. Logon to the administrator account when you reach the welcome screen. Hopefully you will be able to logon.

Now we need to edit your old registry to change the path to the userinit.exe file:
open regedit.exe
Highlight HKEY_LOCAL_MACHINE (note: this is important, if you do not highlight this the next step will not work)
goto file - load hive...
Now select your old registry file which should be in C:\windows\system32\config\software.old
It will ask you what to name it, if you don't understand, just type "test".
Now navigate to the following:
HKEY_LOCAL_MACHINE\<what your named this in the previous step>\microsoft\windows nt\currentversion\winlogon.
Look at what the userinit value is. On my customer's machine it was %system32%\userinit.exe which is invalid.

NOTE: If you can, post what your value is when you look at this.

Next change the value to read C:\windows\system32\userinit.exe

Now close the registry editor, and we need to go back to recovery console to put your original registry back which should look like this:
C:\windows>cd system32\config
C:\windows\system32\config>del software
C:\windows\system32\config>ren software.old software
C:\windows\system32\config>exit

This (in theory) should get you back into Windows.

 

[SamHale]

Fantastic
Worked a treat.
Cannot thank you enough.

 

[Antelope]

Same problem and I know the administrator password is blank, but it won't let me in. Any ideas.

 

[Antelope]

I found the answer - I had to use XP home edition bootup disks.

 

[tedbowden]

Thanks Bcastner worked for me too.

 

[linney]

HKEY_LOCAL_MACHINE\<what your named this in the previous step>\microsoft\windows nt\currentversion\winlogon"

In the data for the value "Userinit" don't forget to place a comma after userinit.exe -

C:\WINDOWS\system32\userinit.exe,