XP starts to login user then logs out

[lancea]

My wife was booting her laptop with XP, and has attempted to login as either admin or her normal user account. Before the system completely logs in, it starts to save her settings, and logs back out. Any ideas?

Thanks,
Lance

[Percy]

If you've got a full version XP CD, you might want to try repairing XP using the chkdsk /r option.

[davelar3212]

Can I take a guess that the last thing you had done before the last successful login was remove either viruses or spyware? You may be able to do a system restore in dos mode, but I'm not sure how to do that. I had the same problem a few weeks ago and it resulted in rebuilding the PC.

[lancea]

Yes, she had just done a virus check, and they indicated a trojan that neither Norton or AVG would remove. I can not remember the specific virus. What I was trying to recall was the DOS command to restore to a previous config, other than what is available when starting up in safe mode.

Lance

[Tstreeter]

I've seen this scenario in my Shop about 3 times in the last month. This condition is usually caused by the Baegle Virus or some other variant of Baegle.

The first thing i would try is to log into the recovery console by booting from your XP cd.

Typically when you try to log into the recovery console when you can't log into the User accounts, The system will reboot when it try's to log into the recovery console as Administrator.

However if you're succesfull and you can log into the Recovery Console.
Run CHKDSK/F
RUN CHKNTFS/d
RUN FIXBOOT
RUN FIXMBR - not neccesary though if the system finds the Disk and boots to Menu Selection

If all else fails, you have 2 options

1. Remove the drive and scan the drive in another system and clean it of virus's and re-insert in to the laptop and try to login

2. Boot of the XP cd and run the repair process when asked to do so.

If still no success take the drive back out of the system, back up the data on another system and re-install XP using the cd....then contemplate why you didn't keep you're virus protection and security patches up to date.

[garthg]

I've seen this scenario in my Shop about 3 times in the last month. This condition is usually caused by the Baegle Virus or some other variant of Baegle.

The first thing i would try is to log into the recovery console by booting from your XP cd.

Typically when you try to log into the recovery console when you can't log into the User accounts, The system will reboot when it try's to log into the recovery console as Administrator.

However if you're succesfull and you can log into the Recovery Console.
Run CHKDSK/F
RUN CHKNTFS/d
RUN FIXBOOT
RUN FIXMBR - not neccesary though if the system finds the Disk and boots to Menu Selection

If all else fails, you have 2 options

1. Remove the drive and scan the drive in another system and clean it of virus's and re-insert in to the laptop and try to login

2. Boot of the XP cd and run the repair process when asked to do so.

If still no success take the drive back out of the system, back up the data on another system and re-install XP using the cd....then contemplate why you didn't keep you're virus protection and security patches up to date.

I have had 3 systems come in the with the same problem. I have pulled out the drives and run virus scans on all of them. They may have had some downloader viurs that shouldnt cause the same problem. I had to reinstall the harddrives and run a full repair to get them working correctly. I also boot the systems up with ERD Commander and Checked the registry for thing in the run section.

If anyone finds out what is causing this I would like to know. I have run 3 differnet antivirus software programs on them and have not found beagle on them Unless it removes itself.

I have also seen a virus that non of the antivirs software seems to find. it starts up the winrpc.exe file and causes the systems to flood the network. I know I looked up the file and its supposed to be the lovegate virus but Mcafee enterprise edition wont find anything, AVG 6.0 and Norton 2004 all will not find any virus.

Any Ideas??

[DefencerX]

hi i think I have the same problem as you. But I didnt recieve any virus alerts from norton and my PC was working fine. It was just tat my defragging took forever.. So i thought restarting the pc would help. I close my defrag, restart pc and tried to log in to enter windows. I type in the usual pass. And when it says loading personal settings.. i get to see a glimpse of my normal desktop wallpaper before it automatically shut itself off and i see saving settings instead.. And my windows loading before I have tat problem was normally 6 to 7 blue trail passes (you know the windows XP loading thing have this bar).. After I have tat problem I calculated up to 13 passes and my Starting up windows took 8 seconds longer...

Safemode didnt work for me.. I tried all sorts of safe mode.. Either administrator or the normal user results in the same problem.. So is it really a virus? I have a lot of important stuff in my desktop.. I do not wish to reformat it unless I have no choice.. Any ideas? Please help.. I didnt do any backup so now im using my laptop to post this post...

[MasterZ]

I have encountered several instances where a damamged installation of Symantec (AKA:Norton) AntiVirus caused this behavior. If the system can be booted in safe mode, try disabling the startup entries for Norton via the msconfig tool. If the system starts up normally after removing the entries, you can then uninstall and reinstall Norton.

[DefencerX]

I have encountered several instances where a damamged installation of Symantec (AKA:Norton) AntiVirus caused this behavior. If the system can be booted in safe mode, try disabling the startup entries for Norton via the msconfig tool. If the system starts up normally after removing the entries, you can then uninstall and reinstall Norton.

thanks for trying to help out.. but before tat i think i actually used msconfig to remove norton antivirus.. so tat it wont load up during my next reboot.. cos i thought norton is slowing down my defrag process.. but nope.. i could never load in windows again after that.. lol... not even in safe mode.. in safemode i get the same problem.. even if i load in as an administrator

[lancea]

O.K. I have failed miserably at determining her administrator password in an attempt to use the recovery console. I have removed the drive, jumpered it for a slave drive, and have it installed in my desktop. My BIOS recognizes it, but when I run powerdesk in order to copy her critical files to my system, the drive doesn't show up. Is there some way to change the drive label? Can I run one of the password recovery tools on it in my system? Am I completely dead? I have called e-machines and they said they are aware of this virus, and it has been around since about Monday, but, nobody has any idea how to repair it yet. Any help would be greatly appreciated.

Lance

[confus-ed]

You need to try & 'take ownership' of the disk -How to take ownership of a file or folder in Windows XP

Or you can go search for one of the many Linux utils that will reset an NTFS admin password if you have physical access

[predator]

My wife was booting her laptop with XP, and has attempted to login as either admin or her normal user account. Before the system completely logs in, it starts to save her settings, and logs back out. Any ideas?

Thanks,
Lance

I have seen this problem on two other computers. There has been a change to the registry entry for the user logon process.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] Normally in Windows XP it is
"Userinit"="C:\\WINDOWS\\system32\\userinit.ex e," but on a corrupted machine it is has been set to "waupdater.exe"

To fix this, you must slave the drive into a working system, and load the registry hive "Software" and make the change. The file is located in your Windows\system32\config directory on the slave drive.

Good Luck!

[lancea]

So, here comes the stupid question, if my desktop is running ME, and my wifes is XP, ntfs, will I be able to read her drive in my computer?

Lance

It seems I have answered my own question, no I can not read NTFS on FAT32 unless I use an app called readNTFS.