PDA

View Full Version : LOGIN then immediate LOGOUT



drcspy
21-09-2005, 08:36 AM
had to repair install the xp version to fix it cause I just couldn't loginto windoze it would get to the login screen then when a user name ws cliked it would start to login then just immediately log you out again......this happened AFTER i'd removed multiple viruses/spyware.......

does anyone have any more info on this subject ? any easier ways to deal with it ?

drcspy
21-09-2005, 08:36 AM
happened in safe mode too tried fixboot/fixmbr no use........

Speedy Gonzales
21-09-2005, 08:49 AM
Was the spyware/adware you removed Blazefind?

The following taken from here

http://www.winxptutor.com/wsaremove.htm

Unable to logon to Windows after removing BlazeFind using a spyware removal utility?

Logon - Logoff loop, also caused by BlazeFind

Another critical symptom caused by this malware:

This malware modifies the Userinit area in the registry (replacing the userinit.exe with wsaupdater.exe) and Ad-Aware (with a particular definition update) removes the wsaupdater.exe file from the system, thus causing the Logon - Logoff loop.

That is, when you login to Windows, the 'loading personal settings" verbose will appear, but suddenly it will logoff. This issue was documented clearly by Lavasoftusa in it's Lavahelp Knowledgebase.

Here is the solution to the logon - logoff issue in Windows XP.

Enter the Recovery Console

Boot the system using the Windows XP CD-ROM. In the first screen when the Setup begins, read the instructions press "R" (in the first screen) enter the Recovery Console. Type-in the built-in Administrator password to enter the Console. You'll see the prompt reading C:\Windows (Or any other drive-letter where you've installed XP)

Type the following command and press Enter.

CD SYSTEM32
(If that does not work, try CHDIR SYSTEM32)

COPY USERINIT.EXE WSAUPDATER.EXE

Quit Recovery Console by typing EXIT and restart Windows.

You'll be able to login successfully as you've created the wsaupdater.exe file (now, a copy of userinit.exe)

Now, change the USERINIT value in the registry (see Phase II in this page) and change it accordingly.

If it is, or was Blazefind you removed, there is a removal tool here

http://securityresponse.symantec.com/avcenter/venc/data/adware.blazefind.html

drcspy
21-09-2005, 06:40 PM
THANK you for that info ........... :-)

vasu
13-03-2006, 02:15 PM
I have same problem. After scan spyware by spybot1.4 and then restart I cannot login anymore .It alway logout immediately. I try to do as your instruction but still cannot login. Can you give me some advice because I PC that I cannot login is DC :waughh:

Speedy Gonzales
13-03-2006, 02:56 PM
I have same problem. After scan spyware by spybot1.4 and then restart I cannot login anymore .It alway logout immediately. I try to do as your instruction but still cannot login. Can you give me some advice because I PC that I cannot login is DC :waughh:

Can you boot into safe mode?

umesh_m47
27-03-2006, 04:38 AM
hello every body


i have same problem xp login then immediate logout
i did following thing
1) tried to change registry using BratPE bootable cd but did not understand how to do that
2) booted with bootable cd win 98 or brate pe backup cmd.exe and
logon.scr in %systemroot%\system32\ then copy cmd.exe logon.scr
then after booting few min wait logon.scr will apear this thime it is cmd(command prompt) now type regedit registry editer opens
3) but it waz of no use registry key was correct does any body have any other solution plz reply
HKLM/SOFTWARE/MICROSOFT/WINDOWSNT/CURRENTVERSION/WINLOGON/
UESRINIT= C:/WINDOWS/SYSTEM32/USERINIT.EXE,

thanks and regards

billythekid45
07-03-2009, 09:44 AM
Hopefully this will help someone...

I didn't have a userinit.exe in my system32 directory at all after removing a virus. I just copied the userinit.exe file from another computer on the network to the disabled computer and now it logs on like it should. You could also add a hard drive to a working computer and do the copy that way if your system isn't on a network.

Hooray for this forum, it's 4:30 on Friday and I'm ready to go home. Now I can :banana:banana:banana

-Brad

beeswax34
07-03-2009, 11:41 AM
You'd think after 2 years+ that the OP would have found a solution.