[Becca]

I recently got a virus from MSN. I downloaded a virus removing program from the internet, did a virus sweep and then restarted my computer. Then when I reached the login screen and clicked on my username it started to log me in. My wallpaper flashed briefly and then it logged me out immediately. I did a search for this problem and found some articles that looked helpful but didn't work. I tried this first http://support.micro...1&Product=winxp and it didn't work. I was then told this article would be helpful http://support.micro...kb;en-us;307545 but it didn't work either. After following step one and restarting my computer it started to load as normal showing the blue dell logo and then the windows xp home system screen then instead of showing the welcome screen with my username I just got a plain black screen. I'm not very experienced with fixing computers and I'm really confused. I would really appreciate any kind of help.

Thanks,


Becca

[Advertisements]

when you say log out immediately, what are you looking at?

The logon screen with your name?
the system reboots?

[gerryf]

when you say log out immediately, what are you looking at?

The logon screen with your name?
the system reboots?

[Becca]

the logon screen with my name

[dflo404]

Do you have any other users on your computer? You might want to try logging in as someone else, or maybe guest if you have it activated. If your user name is the only one, or if nothing else works, maybe you should try a system repair from the Windows XP disk?

[gerryf]

reboot tapping f8, choose safe mode...does this recur?

[coepilot]

Hello
I also have this exact same problem, when choosing any user windows flashes to the desktop for an instant then back to the welcome page and it just says "logging off" and leaves you at the welcome page ready to try another "log on". I can not find a fix for this either and it is my nieces computer and she has misplaced her restore disk. I have removed the HD and put it in an enclouser and rescannned to ensure no more viruses. Any suggestions would be greatful.

[Currios_boy]

Hello
I also have this exact same problem, when choosing any user windows flashes to the desktop for an instant then back to the welcome page and it just says "logging off" and leaves you at the welcome page ready to try another "log on". I can not find a fix for this either and it is my nieces computer and she has misplaced her restore disk. I have removed the HD and put it in an enclouser and rescannned to ensure no more viruses. Any suggestions would be greatful.

Hy, I'm new here. Did you look if you activated windows (Can hapen, it happend to me ).

[nerium]

I've run into this problem with a friend's computer.

Comp specs: Dell Diminesion 2400 Series w/ SP 1
Background: I was told the comp was running slow, so I provided Ace Utilities, and AVG Free to assist with clean up and once my friend ran that, zapped the viruses/spyware I assume she found, upon rebooting this login issue appeared.

And here's what I've tried thus far:

Standard Boot: Windows appears to boot as normal, display multiuser login screen w/ 3 main accounts and no admin account. Selecting any account results in "Loading Personal " stuff, half a second of blank background and then "Saving settings" and getting kicked to the login screen once again.

Safe Mode: Successfully booted to safe mode only to get the same brief appearance of login, flash of background and then "Saving Settings" and logging out. This happened with the Admin and all the other accounts. Fun thing that appears to be Dell specific, Safe Boot with Command Prompt wasn't an option. Lovely.

Boot from last good settings: Same- login, background, logout.

Alternate Safe Modes: (Networking support and something else that wasn't Command prompt) Same

Boot from Dell's provided XP Disc: I switched up the device boot order and went through the Boot from CD. Dell disc was a little different than I've run into in the past, but I tried a repair prev install option and got kicked to a DOS prompt in the WINDOWS dir, which was great because I can atleast see the files sitting there. But I got no idea if there was anything out of the ordinary, other than the hiberfil.sys was strangely out of alignment, like to the right of the screen, and I apparently didn't have permission to access directories other than the Windows dir; which was in itself odd.

I've held off on running "rstrui.exe" from the commandline, but that'll be what I try next unless anyone has any ideas. I'm also thinking of booting from a standard XP cd, but I don't want to have to overwrite the installation if at all possible. What's the deal with Dells anyway, can I pull the HD out, burn it and start fresh? I vaguely recall something about Dells not being very cross compatable.

So, yeah, any ideas?

[gerryf]

Had a chance to read up on this issue and I suspect I know why this is happening, but fixing it is a bit of a problem because we need to know what the bad file it.

The most common cause of this right now, is running a malware detection progam that deletes a file, but the registry still points at it. This, wsaupdater.exe, seems to be the most widely seen culprit, but it could potentially be other things, too.

Let's test it out.

Boot using your winxp cd.
Enter recovery console.
at the command prompt go to

C:/windows/system32

next type:
Dir *.exe

If you find, it, type

copy userinit.exe wsaupdater.exe

Exit and reboot normally. You should now be able to logon.

Run regedit

Navigate to
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\

In the right pane, you should see

C:\WINDOWS\System32\wsaupdater.exe,

Change it so that it reads:

C:\WINDOWS\System32\userinit.exe

That should solve the problem, if the malware was the one that caused the issue.

The scary thing is since more malware programs are inserting themselves into the winlogon key, this is going to be a moving target.

[nerium]

Well after doing a bit more research I think I may have found the solution, but we'll see because it will be tonight before I can try this; but from the looks of things, this sounds like the solution I was looking for:

http://www.winxptuto...m/wsaremove.htm

This is a page about the malware Blazefind, I recall a dir in my scan of DOS last night that suggested there was a toolbar ware installed, (sigh) and halfway down it describes the logon/logoff situation exactly:

Unable to logon to Windows after removing BlazeFind using a spyware removal utility?

Logon - Logoff loop, also caused by BlazeFind

Another critical symptom caused by this malware: This malware modifies the Userinit area in the registry (replacing the userinit.exe with wsaupdater.exe) and Ad-Aware (with a particular definition update) removes the wsaupdater.exe file from the system, thus causing the Logon - Logoff loop. That is, when you login to Windows, the 'loading personal settings" verbose will appear, but suddenly it will logoff. This issue was documented clearly by Lavasoftusa in it's Lavahelp Knowledgebase.

Here is the solution to the logon - logoff issue in Windows XP.

Enter the Recovery Console

Boot the system using the Windows XP CD-ROM. In the first screen when the Setup begins, read the instructions press "R" (in the first screen) enter the Recovery Console. Type-in the built-in Administrator password to enter the Console. You'll see the prompt reading C:\Windows (Or any other drive-letter where you've installed XP)

Type the following command and press Enter.

CD SYSTEM32
(If that does not work, try CHDIR SYSTEM32)

COPY USERINIT.EXE WSAUPDATER.EXE

Quit Recovery Console by typing EXIT and restart Windows.

You'll be able to login successfully as you've created the wsaupdater.exe file (now, a copy of userinit.exe)

Now, change the USERINIT value in the registry (see Phase II in this page) and change it accordingly.

Phase two is a little higher on the page and just involves changing the reg key for the userinit location back to userinit.exe once you get logged back in. I'm going to try this tonight and will post results.

[nerium]

Gerry you totally beat me, by 2 minutes!!! Insane!

Edited by nerium, 19 April 2005 - 08:36 AM.

[gerryf]

sorry to steal your thunder....

as noted in my thread....it is possible it could be something else other than that file.

So you need to be a bit lucky for this to work, since if you do not have this malware issue, it could be something else.

A bart PE disk with an external registry editor would be a better solution, since you can SEE the registry entry, but most people are not going to have this around,

[nerium]

I'd come across the suggestion of the Bart PE disk and am going to look into it anyway, simply because it would be darn handy to have in my doctor's kit. It seems like I get more and more requests for help as time goes on. The curse of being vaguely competent with comps is that you get dragged into neverending free tech support.

[sskyler14]

Ok, My brothers computer has the same problem after using Mcafee spyware remover. Now it goes into the log-in, log-out loop. I was trying to do a Windows repair by cd and it asks me my administrator password, the problem is that I have never set one up and don't know what it is? Any suggestions? Does windows automatically create one while installing?

[gerryf]

Windows XP home does not have a password.

Leave it blank and hit enter.

And please, start your own thread in the future...if you want to refer to another thread, post a link

Thanks