logon problems

[lmwtech]

After removing several virus's and spyware Windows xp pro attemps to logon but then logs right back off. I've tried copying userinit.exe to the system32 dir as directed by several forums I've read but this does not work. I ran chkdsk /r to see if that would help but it does not. Does anyone have an answer? I even did a repair install from the windows cd and that didn't work. I really can't afford to do a complete install.
lmwtech

 

[erikhertzel]

I would try an in-place upgrade which will save all your settings and reinstall XP. You will just have to reapply patches, etc...but won't lose your data.

Reference this KB:

support.microsoft.com/?kbid=315341

Regards.

Erik

 

[lmwtech]

I have done that from the original disk if I understand what your saying.
The pc still will start to logon but then for only a second will show my desktop then it logs back off.
lmwtech

 

[tfg13]

You have gone into safe mode correct? I only say that because you stated you copied the userinit.exe file into the system32 directory. From safe mode, have you looked at "msconfig" for anything suspicious? Have you looked in the All Users folder under Start Menu->Programs->Startup for anything suspicious? Or, how about your user profile in the same folder?

 

[lmwtech]

Cannot get it to logon in safe mode either. I copied it while in the recovery console. lmwtech

 

[pechenegs]

Download hijack this from the link below.Please do this. Click here:

http://www.thespykiller.co.uk/files/hijackthis_sfx.exe

to download HijackThis. Click scan and save a logfile, then post it here so
we can take a look at it for you. Don't click fix on anything in hijack this
as most of the files are legitimate.



Member of ASAP Alliance of Security Analysis Professionals

under the name khazars

 

[pechenegs]

Try this:

Please verify that the following file is present in the System32 folder
and get back to us:

C:\WINDOWS\system32\userinit.exe

If the file is indeed in the system32 folder then copy the code below to notepad and then click save as, choose all files and call it fix.reg.

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"

Then reboot your machine and see if that fixes it?



Member of ASAP Alliance of Security Analysis Professionals

under the name khazars

 

[lmwtech]

AmI not making myself clear I cannot get logged on to do anything. I can use the recovery consloe and that is about it. I have no gui to work with. Does highjackthis work from a command prompt cause thats all i got. lmwtech

 

[pechenegs]

yes it does!


Go to Start > Run and type Hijackthis. Press enter to start HijackThis.
DO NOT OPEN ANYTHING ELSE!



Maybe you would be better doiung a clean install as it sounds like your buggered!

Member of ASAP Alliance of Security Analysis Professionals

under the name khazars

 

[lmwtech]

I can't get to start or run cause I can't get logged on to windows! lmwtech

 

[pechenegs]

well, looks your buggered then! Unless someone else has any suggestions!

Member of ASAP Alliance of Security Analysis Professionals

under the name khazars

 

[aquias]

lmwtech,

Lets try this. Log onto windows, immediately bring up your taskmanager and monitor what processes are starting. If you can do this, maybe we can try and pinpoint the process that is causing the problem.

I've seen this before, but it was flukey and I couldn't get it to reliably replicate itself.

 

[lmwtech]

It won't let me log onto windows. I already thought about this option but it goes to logging off to quickly to try to get the task manager to come up. I've tried to catch probably 20 times or so. I'm looking for something I can edit from the recovery console beings that is the only way I can interact with the hard drive or its contents.
lmwtech

 

[pechenegs]

can you boot into safe mode?

keep hitting the F8 key and choose safe mode?

Member of ASAP Alliance of Security Analysis Professionals

under the name khazars

 

[lmwtech]

nope same thing in safe mode. my only interaction comes from the recovery console ran from the cd. lmwtech

 

[aquias]

Lets try this.

Boot to the recovery console.

Run a listsvc command. This will give you a list of all services that you can disable.

Then using the disable command, disable every service you can. Reboot and see if you can log on.

 

[lmwtech]

I have ran out of time the customer says to reload cause they need the pc back. but i really would have liked to finish this one. thanks to all who have helped it is appreciated. lmwtech

 

[spizotfl]

another thing you may want to try:
look up knoppix live cd and look for info and using it to repair windows problems.
if nothing else, you may be able to salvage the data from your hd.
this site has some useful stuff:

http://www.extremetech.com/article2/0,1697,1918391,00.asp

"Maturity is a bitter disappointment for which no remedy exists, unless laughter can be said to remedy anything."
-Vonnegut