[Paperweight]

Help... please...

I have a Toshiba Satellite A100 running Windows XP (SP3 I believe).

We rebooted the machine and now every time we try to log into an account
it says "Loading your personal settings", briefly flashes the desktop wallpaper,
and then logs off immediately. It does this is safe mode too.

I ordered this computer through CompUSA and it was not shipped with a
Windows XP disk.

I do have a Toshiba "Recovery and Applications/Drivers DVD" but I don't want
to use it for fear that I would lose all my personal data.

[Advertisements]

Still under warranty?

[Broni]

Still under warranty?

[Paperweight]

Thanks for getting back so quickly, but I just might have fixed it myself.

I used ERD commander and discovered that the HKLM\Software\...\Winlogon\Shell
registry item had "Explorer.exe Svchostw.exe". I modified it and removed the
"Svchostw.exe". That didn't seem to work. I then notived that the userinit.exe file
was missing. In command prompt mode I also noticed the svchostw.exe was created
yesterday. So I decided to do a restore to 2 days ago. Tada !!! I can now log in !!!

Out of curiosity, is zone alarm any good ? I have it on all my computer and
one got "antivirus pro" and another got "spyware protect 2009". I'm not
sure what my wife/daughter are doing on these computers but shouldn't
zone alarm stop this ?

[Broni]

You have to remember one thing, there is no bulletproof security protection. You just have to stay on a top of it. Always being updated, run scans once in a while, and so on.
Personally, I'm not a big fan of ZA, but if it doesn't cause you any problems, fine.
Now....
Are you sure about the spelling:
Svchostw.exe
If so, it's not a legit file, and....

I suggest that you start a new topic in the Malware Removal - HiJackThis™ Logs Go Here area.

Before you post a log click on this link --> You Must Read This Before Posting A Hijackthis Log
this will give you a few preparations to make, as well as instruction for posting your Hijackthis log.

If you are still having problems after being given a clean bill of health from the malware expert, then please return to THIS thread and we will pursue other options to help you solve your current problem(s).

[Paperweight]

I'm sure about the spelling of svchostw.exe. And there was such a file in my
c:\windows\system32 directory. When I did my restore the file was gone
and my userinit.exe file was back. I ran malwarebytes and only came back
with a few adware problems. I think the computer is back to normal.

I have a desktop which we rarely use that has problems but I might just
wait for another day to post that problem.

Thanks for your advice.

Edited by Paperweight, 16 March 2009 - 02:03 AM.

[Broni]

I still strongly recommend, you go through all steps at malware forum. Often, the infection appears to be gone, but some hidden crap my still be present.

[Paperweight]

I went through all the steps, rebooted and everything looks good. Thanks.

[Broni]

You're very welcome