[jmadden85]

I suppose the subject explains the issue rather well but I can elaborate slightly. I am using a compag nx 7400 laptop with windows xp professional installed. In either safe mode or regular boot when I get to the login then put in the password hit enter the desktop flashes momentarily and it logs me right out.

Now that is the issue I shall explain how I have gotten here. A friend brought me this laptop with a virus on it that looks like it was one of the numerous fake antivirus programs that have been all over the place lately. After attempts to do anything while the OS is running failed miserably I made some boot disks and have done the following; ran check disk and diagnostics (just to be sure nothing is wrong there save myself some time) everything is ok. kaspersky scan, panda maximum scan, mcafee scan, trend micro scan, webroot analyzer scan, spyware doctor, and finally A-squared. A number of malware's were discovered and removed, in an effort to be thorough as suggested I shall list them. RogueAntiSpyware.InternetSecurity2010, Adware.WeatherStudio, Generic FakeAlert!htm trojan, FakeAlert-KS!Ink trojan, trojan program Rootkit.win32.tdss.y. All were supposedly cleaned, as I can't boot xp i'm not really certain but it was all done prior to boot so there is hope. I should also point out that prior to this I was unable to boot into safe mode it would get down to mup.sys I believe then hang for a moment and restart, after the virus removals I can boot safe mode but the same log in log out frustration occurs.

I have read up on this somewhat and it seems the windows disc repair option has been suggested a number of times, sadly when I try to use the windows disc it tells me it finds no hard drives on the computer. I think I have read somewhere that this is a lack of proper drivers issue and I can make a new xp boot disc with the drivers slipstreamed so I guess I may try that while waiting for a response from anyone willing to help. It should also be noted that using a PE boot I have tried the suggestion of deleting system, SAV, security, default and ahh one other file I can't remember from c:\windows\system32\config and replacing them with the same files from c:\windows\repair I believe it was. Upon doing so the computer wouldn't boot do to some corrupt files so I put the old ones back in and that is all I have tried as of this moment. Hopefully this was thorough enough of an explanation that you guys can come up with some helpful ideas for me, much appreciated in advance.

[Advertisements]

first a little general info...
MFT... Describes all files on the volume, including file names, timestamps, stream names, and lists of cluster numbers where data streams reside, indexes, security identifiers, and file attributes like "read only", "compressed", "encrypted", etc.
MFTMirr is a Duplicate of the first vital entries of $MFT, usually 4 entries (4 KiB).
TestDisk will use the MFTMirr to rewrite the MFT...
The first sector of NTFS partitions is reserved for the partition boot sector. This contains the information that allows the OS to read the partition. Without it, the partition cannot be accessed.

NTFS keeps a backup copy of the boot sector on the last sector of the partition which can allow recovery programs to restore it. The FAT equivalent of this is also called the boot sector, and resides on the first sector of the partition. The difference is that FAT does not keep a backup copy of this information, making recovery much more difficult...
this is in addition to the other advantage of using NTFS..so you can see you really should use the NTFS instead of FAT

The first file stored on an NTFS partition is the Master File Table(MFT) which is essentially a listing of the names, properties and locations of all the other files in the partition. This is referenced by the operating system to access individual files.

NTFS stores a backup copy of this file. Data restoration software will attempt to access or restore a copy of the MFT in order to access files on the partition.

If the MBR or partition table are damaged, the drive will become unbootable, and may appear to be blank if the partition information has been erased.

TESTDISK will attempt to access and restore a copy of the MFT in order to access files on the partition.

• Please download the Ultimate Boot CD here.
• Please burn the file to a CD using a ISO burner. (If you do not have a ISO burner you can get one Here)
• Please boot to the CD using the disk you just burned.
• Press enter to boot to the disk when prompted.
• Using the up and down arrow keys select File System Tools.
• Select Partition Tools.
• Select TestDisk
• Let it load do not press anything until you get to the screen that says at the top:
  TestDisk 6.6 Data Recovery Utility
• Unless you have more then one hard drive installed take the default option and press enter to proceed.
• Due to you are on a PC select Intel and press enter.
• Select analyze
• The next screen will display the current partition structure. If your System shows anything but No partition is bootable please post back with what it says.
• Click Enter to Proceed.
• The next screen is where TestDisk will analyze your disk.
• After that it will come back with the results. It should show. Under Partition NTFS. With a Star Indicating Primary Bootable.
• Press enter to continue.
• Use the Left and Right arrow keys to select write.
• Type Y and press enter to confirm.
• Remove the disk.
• Restart your computer.

[happyrock]

first a little general info...
MFT... Describes all files on the volume, including file names, timestamps, stream names, and lists of cluster numbers where data streams reside, indexes, security identifiers, and file attributes like "read only", "compressed", "encrypted", etc.
MFTMirr is a Duplicate of the first vital entries of $MFT, usually 4 entries (4 KiB).
TestDisk will use the MFTMirr to rewrite the MFT...
The first sector of NTFS partitions is reserved for the partition boot sector. This contains the information that allows the OS to read the partition. Without it, the partition cannot be accessed.

NTFS keeps a backup copy of the boot sector on the last sector of the partition which can allow recovery programs to restore it. The FAT equivalent of this is also called the boot sector, and resides on the first sector of the partition. The difference is that FAT does not keep a backup copy of this information, making recovery much more difficult...
this is in addition to the other advantage of using NTFS..so you can see you really should use the NTFS instead of FAT

The first file stored on an NTFS partition is the Master File Table(MFT) which is essentially a listing of the names, properties and locations of all the other files in the partition. This is referenced by the operating system to access individual files.

NTFS stores a backup copy of this file. Data restoration software will attempt to access or restore a copy of the MFT in order to access files on the partition.

If the MBR or partition table are damaged, the drive will become unbootable, and may appear to be blank if the partition information has been erased.

TESTDISK will attempt to access and restore a copy of the MFT in order to access files on the partition.

• Please download the Ultimate Boot CD here.
• Please burn the file to a CD using a ISO burner. (If you do not have a ISO burner you can get one Here)
• Please boot to the CD using the disk you just burned.
• Press enter to boot to the disk when prompted.
• Using the up and down arrow keys select File System Tools.
• Select Partition Tools.
• Select TestDisk
• Let it load do not press anything until you get to the screen that says at the top:
  TestDisk 6.6 Data Recovery Utility
• Unless you have more then one hard drive installed take the default option and press enter to proceed.
• Due to you are on a PC select Intel and press enter.
• Select analyze
• The next screen will display the current partition structure. If your System shows anything but No partition is bootable please post back with what it says.
• Click Enter to Proceed.
• The next screen is where TestDisk will analyze your disk.
• After that it will come back with the results. It should show. Under Partition NTFS. With a Star Indicating Primary Bootable.
• Press enter to continue.
• Use the Left and Right arrow keys to select write.
• Type Y and press enter to confirm.
• Remove the disk.
• Restart your computer.

[jmadden85]

Alright, going to work on this suggestion now. In the meantime I would like to let you know I have slipstreamed the drivers needed to get my xp disc to recognize I have hard drives so I can run recovery console and what not, not sure if that really matters or not at this point, just an fyi.

[jmadden85]

Alright after selecting analyze it comes back with this.

Start End Size in sectors
1* HPFS - NTFS 0 1 1 9450 239 63 1428899057
2 P FAT32 LBA 9451 0 1 10336 239 63 13396320 [HP_RECOVERY]

[jmadden85]

After completing that I am still getting the same log in log out issue.

[happyrock]

Alright, going to work on this suggestion now. In the meantime I would like to let you know I have slipstreamed the drivers needed to get my xp disc to recognize I have hard drives so I can run recovery console and what not, not sure if that really matters or not at this point, just an fyi.

the canned speech if for people that don't have a xp cd...just use your cd instead of the rc.iso to do the steps...

if you don't have a burning program that will burn .ISO files go here and get burncdcc ..a small FAST no frills iso burning program...

NOTE...do not put a blank cd in until burncdcc opens the tray for you
1. Start by clicking on BurnCDCC.exe
2. Browse to the ISO file you want to burn on cd/dvd ....in this case its rc.iso
3. Select the ISO file
4. click on Start

make sure in the bios the cd drive is the first boot device....put the cd in the cd drive..boot your computer....

boot from the rc.iso cd....
type in chkdsk /r press enter
note the single space before the /

Chkdsk will display the specific stage it is checking as well as the percentage of completion of the stage. You cannot do anything else on your computer while chkdsk is running. When chkdsk is finished, it will automatically reboot your computer.
NOTE this can take a long time to complete..it may even appear to hang or get stuck at a certain % for a couple of hours...then complete
it may even back up and go over the same area...this is normal...let it run...there are 5 stages
DO NOT TURN OFF YOUR COMPUTER WHILE RUNNING CHKDSK or you can have severe problems...
if the above does not allow you to boot normally then try the steps below one at a time and only try the next step if you still can't boot normally...there is no need to do all the steps...just do them until you can boot up
nojoy...
boot from the cd again...
then type fixmbr press enter...reboot
no joy ....boot from the cd again...
type in fixboot press enter...reboot
nojoy...boot from the cd again...

Type in bootcfg /scan and press Enter

if it says total identified window installs: 1

Type in bootcfg /rebuild and press Enter...

It will identify your XP installation...type Y once you see this prompt.

You will be prompted to enter the load identifier...type in Microsoft XP Home Edition or Microsoft XP Professional depending on whichever version you have...press enter

You will be prompted to enter the load options...type in /fastdetect and press Enter

Type in exit and press Enter

remove the cd and Reboot

[jmadden85]

Whilst waiting for a reply from you i've been scanning the internet and I have found a solution allowing me to logon finally. I am booted in safe mode at the moment running some more scans, spybot, spyware blaster, superantispyware, malwarebytes, avast, and bazooka. I have noticed quite a few posts of the log on log off issue on this site so here is the link I found to be amazingly helpful http://thinkinginpix...-onlog-off-loop. Very simple step by step guide that worked for me. After these scans are done I will attempt a boot in normal mode and may post a hijackthis log or something see if you have any further suggestions.

[happyrock]

Please go to Malware and Spyware Cleaning Guide...
HERE....

That will help you clean up 80 percent of all problems by yourself. If at the end of the process you are still having difficulty (and you may not be) follow the instructions and start a new topic
here
post the OTListIt2 and Rooter logs ...
The "Topic Title" should contain the name of the infection that you are having a problem with...Use the "Topic Description" to include more details. This will help you get faster responses as some people are more familiar with certain infections....

if you are unable to download or run ANY of the tools...try downloading them on another computer and put them on a flash drive or cd and try installing them that way..
no joy...
start a new topic and let them know you can't run any of the tools..