[acidfraud]

Help my computer logs off after logging in... I've tried gerryf's solution but I can't find the userinit.exe and wsaupdater.exefiles. it doesn't show in C:\Windows\system32... I really appreciate any help. Thank You.

Had a chance to read up on this issue and I suspect I know why this is happening, but fixing it is a bit of a problem because we need to know what the bad file it.

The most common cause of this right now, is running a malware detection progam that deletes a file, but the registry still points at it. This, wsaupdater.exe, seems to be the most widely seen culprit, but it could potentially be other things, too.

Let's test it out.

Boot using your winxp cd.
Enter recovery console.
at the command prompt go to

C:/windows/system32

next type:
Dir *.exe

If you find, it, type

copy userinit.exe wsaupdater.exe

Exit and reboot normally. You should now be able to logon.

Run regedit

Navigate to
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\

In the right pane, you should see

C:\WINDOWS\System32\wsaupdater.exe,

Change it so that it reads:

C:\WINDOWS\System32\userinit.exe

That should solve the problem, if the malware was the one that caused the issue.

The scary thing is since more malware programs are inserting themselves into the winlogon key, this is going to be a moving target.

Edited by acidfraud, 05 July 2009 - 07:15 PM.

[Advertisements]

Give this a try. Without knowing a little more about what caused the problem, I can't guarantee it will work...and it requires the machine you make the disk on AND the machine you are fixing are both running XP.

Please download RC.ISO and save it somewhere you can find it.
Also download MagicISO.

Start MagicISO. You should see a window informing you about the full version of MagicISO.
In the bottom right select Try It! and the program will open.
Click on File and then on Open and navigate to the RC.ISO file you downloaded. Select it, and click Open.

First, we'll need to add a clean version of userinit.exe to the current RC.ISO

* In the upper right pane, double click on the i386 folder.
* Right click in the upper right pane and select Add Files...
* Navigate to C:\Windows\System32 and select userinit.exe
* Then click Open to add userinit.exe to the CD image.
* Click File and select Save As...
* Name the file RCplus and save it somewhere you can find it.


Next, we'll need to burn the newly created image to a disk that we can use to fix the problem.

* Put a blank CD-R disk in your CD burner and close the tray. If an AutoPlay window opens, close it.
* Click on Tools and select Burn CD/DVD with ISO.... A window will appear.
* Click on the little folder to the right of CD/DVD Image File then navigate to the newly created RCplus.iso Image file and click Open.
* In the CD/DVD Writing Speed drop-down menu choose the 8X setting.
* Under Format make sure that Mode 1 is selected.
* And finally, click on the Burn it! button to burn RCplus.iso to disk.


Once the disk is burned, put it in the machine you want to fix and restart it.
Boot to the CD just as you would with a Windows XP disk.
At the Welcome to Setup screen, press R to enter the Recovery Console.
Choose the installation to be repaired by number (usually 1) and press Enter.
When you are asked for the Administrator password, enter the password or leave it blank (default) and press Enter.

At the C:\Windows> prompt, type the following commands pressing Enter after each one. Note: Watch the spaces.

D:
cd i386
copy userinit.exe c:\windows\system32
exit


After putting in the third command, you should receive the message 1 file copied which will indicate that the operation succeeded.
Now take out the CD and reboot your computer to normal mode. Try to log in and it should let you back in.

Thanks to wannabe1

[rshaffer61]

Give this a try. Without knowing a little more about what caused the problem, I can't guarantee it will work...and it requires the machine you make the disk on AND the machine you are fixing are both running XP.

Please download RC.ISO and save it somewhere you can find it.
Also download MagicISO.

Start MagicISO. You should see a window informing you about the full version of MagicISO.
In the bottom right select Try It! and the program will open.
Click on File and then on Open and navigate to the RC.ISO file you downloaded. Select it, and click Open.

First, we'll need to add a clean version of userinit.exe to the current RC.ISO

* In the upper right pane, double click on the i386 folder.
* Right click in the upper right pane and select Add Files...
* Navigate to C:\Windows\System32 and select userinit.exe
* Then click Open to add userinit.exe to the CD image.
* Click File and select Save As...
* Name the file RCplus and save it somewhere you can find it.


Next, we'll need to burn the newly created image to a disk that we can use to fix the problem.

* Put a blank CD-R disk in your CD burner and close the tray. If an AutoPlay window opens, close it.
* Click on Tools and select Burn CD/DVD with ISO.... A window will appear.
* Click on the little folder to the right of CD/DVD Image File then navigate to the newly created RCplus.iso Image file and click Open.
* In the CD/DVD Writing Speed drop-down menu choose the 8X setting.
* Under Format make sure that Mode 1 is selected.
* And finally, click on the Burn it! button to burn RCplus.iso to disk.


Once the disk is burned, put it in the machine you want to fix and restart it.
Boot to the CD just as you would with a Windows XP disk.
At the Welcome to Setup screen, press R to enter the Recovery Console.
Choose the installation to be repaired by number (usually 1) and press Enter.
When you are asked for the Administrator password, enter the password or leave it blank (default) and press Enter.

At the C:\Windows> prompt, type the following commands pressing Enter after each one. Note: Watch the spaces.

D:
cd i386
copy userinit.exe c:\windows\system32
exit


After putting in the third command, you should receive the message 1 file copied which will indicate that the operation succeeded.
Now take out the CD and reboot your computer to normal mode. Try to log in and it should let you back in.

Thanks to wannabe1