[Kaid]

Got home from work 2 nights ago, to be met by kids saying "computer doesn't work again Dad"!

Looking at it, it appears to boot correctly to the log in screen, we have 2 user names, on selecting either of them it reports logging on (after 2-3 secs) it gives the logging off sound followed by the logging off screen. I have tried to get past this in safe mode but it still does the same with the addition of Admin user. I then decided to do a repair on XP, again after the repair it still has the same fault.

I suspect a virus, can anyone confirm this and offer any advice as to how to delete this. I know as a last resort, it is a reformat and fresh install.

Thank you.
David

[Advertisements]

Yes, there is a piece of malware that causes this behavior because it alters the userinit.exe setting
Try this

Start your PC with your windows xp disk in the cd-rom, and start your computer. Your computer should boot from the CD and allow you to choose the Recovery Console.

Choose your windows install and log in as administrator by either typing your password (for xp pro) or hitting enter (no password on XP home)

At the c:\windows prompt, type

copy userinit.exe wsaupdater.exe
restart
Does windows load?

If so, s
start > run, type
regedit

navigate to:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

Locate
Userinit setting in right window

Make sure the value is
C:\WINDOWS\system32\userinit.exe

You can then delete the wsaupdater.exe key and reboot

Edited by gerryf, 25 January 2006 - 09:04 AM.

[gerryf]

Yes, there is a piece of malware that causes this behavior because it alters the userinit.exe setting
Try this

Start your PC with your windows xp disk in the cd-rom, and start your computer. Your computer should boot from the CD and allow you to choose the Recovery Console.

Choose your windows install and log in as administrator by either typing your password (for xp pro) or hitting enter (no password on XP home)

At the c:\windows prompt, type

copy userinit.exe wsaupdater.exe
restart
Does windows load?

If so, s
start > run, type
regedit

navigate to:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

Locate
Userinit setting in right window

Make sure the value is
C:\WINDOWS\system32\userinit.exe

You can then delete the wsaupdater.exe key and reboot

Edited by gerryf, 25 January 2006 - 09:04 AM.

[pilotblas]

I had the same problem. The cause was a failure during the install of COX Communications "free" Anti-virus software; source of the software is Authentium.

AUTHENTIUM adds a file to c:\windows\system32 called AuserInit.exe and make a corresponding modification in the registry to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Winlogon
just before it is planning to reboot the operating system and finish its install.

In my case, the install fails (because of some other issues in the registry) and so AUTHENTIUM backs out the files that were added to your system. Unfortunatly for you, it fails to back out the registry modification and leaves the file AuserInit.exe
AuserInit.exe tries to run during the next logon of ANY USER and because it is missing files, it fails and so does your logon, so you are logged off and can't get in to fix the problem.

I finally used a package from Winternals to diagnose the problem and change the registry, but if I had known then what I know now, I could have just mounted the system disk on another system or booted a CD and COPIED userinit.exe to replace AuserInit.exe