Win XP Log On / Log off problem

[prprandall51]

Can anyone please help?

My PC won't let me log on anymore; it logs you straight back off again - including the Administrator log-in and also in Safe Mode. A web search indicates this is a not-unknown problem and this has pointed me to a partial solution whereby I can log in if I swap the "software" file in C:\Windows\System32\Config with the version located in C:\windows\repair (I did this via the Recovery console). The trouble is, this results in a "version" of Windows that is as it was when the OS was first installed.

The advice on the Internet then guides you to replace the file "Userinit.exe" and to check / repair the registry entry
HKLM\Software\Microsoft\WindowNT\Currentversion\Winlogon

Various people have indicated that it has worked for them - but it doesn't work for me.

I have seen there are a lot of very knowledgable people on this forum who are kind enough to offer PC support advice. Does anyone have any ideas about this problem?

Thanks very much
Philip
PS: I am out of the office till Monday, so if anyone replies, please don't think I am ignoring you.

 

[Sp!ke]

I had a very similar sounding thing on a PC the other day.

Sorry to say that I spent 3 hours trying all the usual tricks before just splating a new image on it again. Even a full repair install of windows didnt sort it.

It was almost like someone had written something in the registry for the 'all users' group to run a logoff command at startup. A virus maybe but whatever it was it was a PITA.

 

[nickcc101]

Have you tried system restore to a date before the fault started ?

 

[prprandall51]

Have you tried system restore to a date before the fault started ?

Spike, Nick,
Thanks for the replies. Nick, I tried that but it made no difference.

The best information that I have found so far is this:

There has been some morphing of the BlazeFind malware. Here is a second approach to making the computer bootable:
(from the LavaSoft forum)

First things first get to recovery console.

At recovery console, we need to replace the software hive with a previous good backup. It should look something like this:
C:\windows>cd system32\config
C:\windows\system32\config>ren software software.old
This renames the current software hive to software.old
C:\windows\system32\config>copy C:\windows\repair\software
It should say "1 file(s) copied"
NOTE: After the next step you will want to remove the cd, then boot into safe mode. If you do not boot into safe mode in Windows XP it may prompt you to reactivate and you may not be able to get into Windows.

C:\windows\system32\config>exit

Now hit the F8 key and boot into safe mode. Logon to the administrator account when you reach the welcome screen. Hopefully you will be able to logon.

Now we need to edit your old registry to change the path to the userinit.exe file:
open regedit.exe
Highlight HKEY_LOCAL_MACHINE (note: this is important, if you do not highlight this the next step will not work)
goto file - load hive...
Now select your old registry file which should be in C:\windows\system32\config\software.old
It will ask you what to name it, if you don't understand, just type "test".
Now navigate to the following:
HKEY_LOCAL_MACHINE\<what your named this in the previous step>\microsoft\windows nt\currentversion\winlogon.
Look at what the userinit value is. On my customer's machine it was %system32%\userinit.exe which is invalid.

NOTE: If you can, post what your value is when you look at this.

Next change the value to read C:\windows\system32\userinit.exe

Now close the registry editor, and we need to go back to recovery console to put your original registry back which should look like this:
C:\windows>cd system32\config
C:\windows\system32\config>del software
C:\windows\system32\config>ren software.old software
C:\windows\system32\config>exit

This (in theory) should get you back into Windows.

Following this approach got me back into Windows, but the computer behaved as if I had restored it to the very first day of its life - no installed apps, that irritating pseudo-login screen with silly pictures, etc. From there, I couldn't get back to my configured profile.

 

[verytalldave]

For anybody who wants to keep their PC clean of Malware ( means Malicious Software).......
Go to Google and type in MALWAREBYTES.ORG
or get it here............ http://www.malwarebytes.org/
The free trial version is as good as the registered version. The only difference is that the paid for version is resident on your machine and constantly monitors for malware.

Go to their website and download the software.

Follow the on-screen instructions and then perform a full scan (takes about 90 minutes). After that, quarantine the objects found and all should be fine.
Every week or so, update the definitions and rescan to keep your machine clear of malware.
Dont be duped into thinking antivirus and antispyware programs will protect you from malware, because most dont.
Malware requires a specialised application like MALWAREBYTES to get it off your PC.
I would recommend everybody does it before they are attacked and its too late.