Login logoff

[sunrise]

I just cleaned up a computer with a ton of malware now when I get to the login screen I can't login to any profile. It starts to login then logs off right away, even in safe mode. I know there are a number of options to fix this, like repair install or "SFC" but this is a Dell computer and so it didn't come with an OEM windows disk and the "Dell System Recovery tool" doesn't have a repair option just a nuke and reinstall option. And to run SFC I need to login somehow It's running Windows XP Media Edition. Is there an easy fix for this that I don't know about?

[CCT]

You should be able to use an install disk of the same version as what is on the Dell for a Repair' - http://michaelstevenstech.com/XPrepairinstall.htm

[sunrise]

Thanks CCT Correct me if I'm wrong but it's my understanding that Windows XP Media Edition came out in 3 different releases and you have to have the correct version for a repair install to work.

[MobilePCPhysician]

Take the hard drive out and slave it in another machine. Run an antivirus, and malwarebytes on the drive. Then run chkdsk -r. Re-install the drive and see if it boots up.

[sunrise]

Thank you MobilePCPhysician but I've already tried that. in fact it was after I removed all the malware that the problem started.

[Ferrit]

I would agree with MobilePCPhysician.
Physically remove the drive from the machine.
I dont think its completely clean.
I would look for rootkits
Exactly what did you use to clean it?
Did you shut off system restore before cleaning it?

[CCT]

sunrise : while there are variances in the versions, the way to find out which you have involves being able to stay logged on.

The issue you have can be caused by userinit corruption - this article describes that; http://support.microsoft.com/kb/555648

A 'fix' may be available per; http://www.tomshardware.com/forum/28...covery-console

Worth a try anyway.


some additional info; http://forums.techarena.in/windows-x...ort/864402.htm

[sunrise]

Thanks for your help CCT those links where really helpful. For anyone who's interested here's what happened. This computer was so loaded with malware that it would freeze right after it finnished loading Windows. So I cleaned it up (using another computer) after which it wouldn't let me log on. I then discovered that a piece malware had deleted the userinit.exe file and replaced it with wsaupdater.exe. and modified the registry. So I replaced the userinit.exe file but named it wsaupdater.exe, this allowed me to log on, I then renamed the file back to it's proper name, edited the registry, made a few other tweaks and now the computer is working fine. My thanks to everyone for your help.

[MobilePCPhysician]

Here is the Microsoft article explaining the fix: http://support.microsoft.com/kb/892893

[-Vampyre-]

Had a client with the same problem. It is usually a virus that replaces the userinit value with its own file. Then your AV removes the bad file, but doesn't change back the userinit setting or put back the correct file. I always had to remotely edit the registry or use Bartpe get the machine up then connect to its registry to make the changes. You will also need to get a good version of the file.

[CCT]

sunrise, since you didn't have a Windows CD, only Dell Recovery (disk or partition?), what procedure did you use to actually be able to replace the BAD .exe file with the renamed userinit.exe ?

I know how to do this from a regular installl CD, but haven't run into the other.