Login problem

[Ty]

I am using XP pro on a Dell desktop and I can't login. When I enter my login
name and password it acts like it's loggin in but it then logs off. Why is
this happening and how do I fix it? Thanks for your help.
Ty

 

[Pegasus [MVP]]

I am using XP pro on a Dell desktop and I can't login. When I enter my
login
name and password it acts like it's loggin in but it then logs off. Why
is
this happening and how do I fix it? Thanks for your help.
Ty

Have a look here - it deals with the same issue:
http://www.howtofixcomputers.com/forums/windows-xp/windows-xp-home-edition-unable-logon-117257.html

 

[Guest]

Seems there is a virus going around causing this as it's the 3rd machine in
a few days I know of which has it

On the XP Media Centre I am trying to repair for someone I used a PE disc to
copy userinit.exe into System32 because it was missing but it made no odds.
The machine was logging in for around 10 seconds then logged directly out
again Also, the Winlogon key had been altered. Once I get some time I will
look into things further

The thread that Pegasus linked to has no conclusion & the info in there like
connect it as a slave device is fine but never pointed the user towards
doing anything other than telling them it could get a little messy. If you
do a search in Google for XP Logging in & immediately out you get the same
thing as mentioned in another website plus the userinit.exe

--
SPAMCOP User

 

[David]

I had a similar problem on my Windows 2003 web server. I would login over
RDP, but it would immediately log me out again.

It turns out that my box had been hacked. I was pretty miffed.

I found a few files that shouldn't have been there...

c:\windows\system32\k3.exe
c:\windows\system32\kkudf.dll
c:\windows\system32\lemony.bat (+ .exe + lemonys.exe)
c:\windows\system32\NETSVC.EXE

(and some more files.)

Also in the root of c: I found lookup.exe and found.txt

I also had numerous fake recycle bins that were actually now hooked into
serving stuff over HTTP.


I couldn't get in. However, I did have the foresight to set up a VPN
connection to my box and I used that. I could then remotely view my
filesystem and also remote regedit and remote service manager. I stopped
various services I didn't recognise and this eventually allowed me to login.

Hope this helps.

--
Best regards,
Dave Colliver.
http://www.AshfieldFOCUS.com
~~
http://www.FOCUSPortals.com - Local franchises available

 

[PA Bear [MS MVP]]

Download my new userinit fix from here http://www.ms-mvp.org/ this file
works for SP2 and SP3 only. READ the enclosed instructions. If you have SP1
do not use this file. If you need any other version then email me using the
link at the bottom of my webpage. Your issue is caused by a malware
infestation. Once fixed you will need to use my Remove-it software, it will
remove that malware from your system. Choose yes for all options when
prompted. Download it here http://www.ms-mvp.org/

--
The Real Truth http://pcbutts1-therealtruth.blogspot.com/
*WARNING* Do NOT follow any advice given by the people listed below.
They do NOT have the expertise or knowledge to fix your issue. Do not waste
your time.
David H Lipman, Malke, Beauregard T. Shagnasty, Leythos.

 

[Monitor]

Download my new userinit fix from here http://www.ms-mvp.org/ this file
works for SP2 and SP3 only. READ the enclosed instructions. If you have SP1
do not use this file. If you need any other version then email me using the
link at the bottom of my webpage. Your issue is caused by a malware
infestation. Once fixed you will need to use my Remove-it software, it will
remove that malware from your system. Choose yes for all options when
prompted. Download it here http://www.ms-mvp.org/

This response was posted by pcbutts, a known troll, not by PA Bear [MS MVP].
Have a close look at the real address of his web page, shown at the very top
of your browser frame. It is not the MS MVP site he wants you to believe.
Run his software at your own risk - it is likely to do permanent damage to
your PC.

 

[Leythos]

NNTP-Posting-Host: 76.228.204.207
X-Complaints-To: (e-mail address removed)
X-Trace: nlpi068.nbdc.sbc.com 1238191969 ST000 76.228.204.207 (Fri, 27 Mar 2009 18:12:49 EDT)
NNTP-Posting-Date: Fri, 27 Mar 2009 18:12:49 EDT
Organization: at&t http://my.att.net/
X-UserInfo1: OX[[B_SGABSUS^I]^JKBOW@@YJ_ZTB\MV@BL\QMIWIWTEPIB_NVUAH_[BL[\IRKIANGGJBFNJF_DOLSCENSY^U@FRFUEXR@KFXYDBPWBCDQJA@X_DCBHXR[C@\EOKCJLED_SZ@RMWYXYWE_P@\\GOIW^@SYFFSWHFIXMADO@^[ADPRPETLBJ]RDGENSKQQZN
Date: Fri, 27 Mar 2009 15:12:49 -0700

Just more proof that Butts is acting in an unethical manner.

 

[Leythos]

[snip]

remove that malware from your system. Choose yes for all options when
prompted. Download it here http://www.BUTTSVOID.ms-mvp.BAD/

This response was posted by pcbutts, a known troll, not by PA Bear [MS MVP].
Have a close look at the real address of his web page, shown at the very top
of your browser frame. It is not the MS MVP site he wants you to believe.
Run his software at your own risk - it is likely to do permanent damage to
your PC.

When you do that, expose Butts's unethical actions, munge or break his
links if you're going to include them - like I did above.

It's also best if you include the neaders that show the posting host as
validation.

 

[Barry Schwarz]

Download my new userinit fix from here http://www.ms-mvp.org/ this file
works for SP2 and SP3 only. READ the enclosed instructions. If you have SP1
do not use this file. If you need any other version then email me using the
link at the bottom of my webpage. Your issue is caused by a malware
infestation. Once fixed you will need to use my Remove-it software, it will
remove that malware from your system. Choose yes for all options when
prompted. Download it here http://www.ms-mvp.org/

This not the MVP site despite its fake logos.

The correct MVP site is http://www.mvps.org/

 

[PA Bear [MS MVP]]

This not the MVP site despite its fake logos.

The correct MVP site is http://www.mvps.org/

Nor was that post made by me.

 

[Ty]

This is really scary. I come here seeking help for my problem and it seems
that someone is trying to make things worse? How do I know who to believe?
Obviously, I am not versed enough to know who is real and who is fake. Will
someone please help me with my problem? I truly appreciate it. Thanks.
Ty

 

[David H. Lipman]

You have several choices. You can trust the MVP and follow the only advice
given you on how to fix your issue. Or you can ask the troll Barry Schwarz
if he has tested the fix given you by the MVP, why he thinks it will harm
your system. If he was told by MS that those are fake logo's and why does he
think the website is fake. Then ask him if he knows how to fix your system
or if he has ever fixed a system with that issue. You system is screwed, the
fix provided to you by the MVP takes 5 minute to do.

 

[James Watkins]

This is really scary. I come here seeking help for my problem and it seems
that someone is trying to make things worse? How do I know who to believe?
Obviously, I am not versed enough to know who is real and who is fake. Will
someone please help me with my problem? I truly appreciate it. Thanks.
Ty

Unfortunately this thread is being hijacked by a stalker. He assumes
different names, preferably the ones belonging to respected MVPs, and he
consistently attempts to discredit the replies coming from real MVPs. It's
now gotten to a stage where real MVPs no longer dare to respond - they fear
that the stalker might grab their own identity too.

How can you work out which replies are malicious? It's not easy. Don't
download anything for the time being - it's too dangerous. Click the links
you see and examine them carefully. When you see a discrepancy between the
URL and the real address as seen on the browser's frame at the top, get out
quickly. When you get a broken link, ignore the post that quotes it.

I have a few suggestions towards resolving your problem but at the moment I
just can't figure out a way of getting them to you without the stalkier
discrediting them or stealing my own identity (which wouldn't cause me any
inconvenience - in view of the silliness of the situation I had to assume a
disposable alias).

 

[Leythos]

Path: news.astraweb.com!border5.newsrouter.astraweb.com!news.glorb.com!news2.glorb.com!npeer03.iad.highwinds-media.com!news.highwinds-media.com!feed-me.highwinds-media.com!post01.iad.highwinds-media.com!newsfe17.iad.POSTED!4b08191c!not-for-mail
From: "David H. Lipman" <[email protected]>
Newsgroups: microsoft.public.windowsxp.general
References: <[email protected]> <[email protected]> <#[email protected]> <[email protected]> <[email protected]> <[email protected]>
In-Reply-To: <[email protected]>
Subject: Re: Login problem
Lines: 51
MIME-Version: 1.0
Content-Type: text/plain; format=flowed; charset="utf-8"; reply-type=original
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Newsreader: Microsoft Windows Mail 6.0.6001.18000
X-MimeOLE: Produced By Microsoft MimeOLE V6.0.6001.18049
X-Antivirus: avast! (VPS 090327-0, 03/27/2009), Outbound message
X-Antivirus-Status: Clean
Message-ID: <[email protected]>
X-Complaints-To: (e-mail address removed)
NNTP-Posting-Date: Sat, 28 Mar 2009 22:09:15 UTC
Organization: TeraNews.com
Date: Sat, 28 Mar 2009 15:09:11 -0700

And yet another impersonation by someone pretending to be David.

 

[Ty]

Thanks to all those who've tried to help me. Based on that's going on here,
I will just try find any way to deal with my problem.

 

[Guest]

You can trust the MVP's but not all their advice is correct so you need to
trust other's too who have real qualifications & not just answered a certain
number of questions in the newsgroup as that is the only qualification to
become a MVP. And remember some just paste in the same advice in every post
whereas others just seach Google. for the answer & write it here

BTW: the logon/logoff issue for the Media Centre machine I was repairing was
due to the user downloading Antivirus 360 (C:\Program Files\A360) which also
deleted 'userinit.exe'. Going through the winlogon registry key making the
appropriate changes allowed me to get on to the machine, back up the user's
data, flattened the machine & re-installed the entire OS - simple

 

[James Watkins]

You appear to miss the main problem in this thread: there is a troll
impersonating several different MVPs and dishing out bad advice under their
names. I'm not even sure which side you're on: What you say about
userinit.exe causing the problem is correct but your subsequent advice is
equivalent to fixing a scratch in the door of your car with a sledge hammer.
There is no need at all for the OP to "flatten" his Windows installation.
The userinit-issue can be resolved in far more elegant ways, without
destroying the current installation.

 

[Guest]

James,

The thread is not about the troll actually it seems to diverted as so

I gave the thread what I did to resolve the situation. Depending on the
state of the OS depends what you do. The OS I was doing had a rootkit too &
if you know anything you would understand you cannot trust a machine with a
rootkit. Besides this, the person is paying me to sort out his computer &
this is what I am doing. All his data is backed up now so the best thing I
can do is rebuild it properly so he doesn't get any more trouble or I'd get
it back saying it wasn't repaired properly

FYI: just copying back the userinit.exe is not the final solution. I spent
around 12 hours just to get the machine logging in correctly & I used a
Windows PE disc running from the command prompt to do everything because
when I detached the hard drive, placed it in a SATA caddy to connect to one
of my machines it wouldn't initialise due to the MBR being changed by the
infection. If this would have worked then it would have made life easier.
Also, I found that the NTFS.SYS file was also corrupt causing issues too

Besides the above it seems that more & more machines in the past week are
getting the same infection

So, James. I see that you can repair these corruptions easily without being
able to get into safe mode, system restore, normal login or being able to do
a rdp session. Clever you but I see you haven't provided an absolute
solution. Instead just made pointless comments. Whereas, I have solved this
issue with things I've done

SPAMCOP User


----- Original Message -----
From: "James Watkins" <[email protected]>
Newsgroups: microsoft.public.windowsxp.general
Sent: Sunday, March 29, 2009 12:07 PM
Subject: Re: Login problem

You appear to miss the main problem in this thread: there is a troll
impersonating several different MVPs and dishing out bad advice under
their
names. I'm not even sure which side you're on: What you say about
userinit.exe causing the problem is correct but your subsequent advice is
equivalent to fixing a scratch in the door of your car with a sledge
hammer.
There is no need at all for the OP to "flatten" his Windows installation.
The userinit-issue can be resolved in far more elegant ways, without
destroying the current installation.

 

[James Watkins]

James,

The thread is not about the troll actually it seems to diverted as so.

In your previous response you told the OP "You can trust the MVPs". It
appears to have escaped your attention that there is a troll in this thread
who pretends to be an MVP. The unfortunate OP has no way of knowing which
respondent is an MVP and which one is the troll.

I gave the thread what I did to resolve the situation. Depending on the
state of the OS depends what you do. The OS I was doing had a rootkit too &
if you know anything you would understand you cannot trust a machine with a
rootkit.

While the OP's PC may be infected with a virus, it's a much early to tell
him to re-install Windows. I have dealt with quite a few machines that
suffered from the looping logon problem and I managed to fix all of them
within a few minutes - because they were not infected.

Besides this, the person is paying me to sort out his computer &
this is what I am doing.

Who is paying you? The OP?

FYI: just copying back the userinit.exe is not the final solution. Clever
you but I see you haven't provided an absolute solution. Instead just
made pointless comments. Whereas, I have solved this issue with
things I've done.

No, restoring userinit.exe is often not the final solution. In many cases
some registry editing is involved. If you're not aware of this then a
complete rebuild will, of course, resolve the issue, which appears to be
your favourite solution - as long as your clients are happy to pay the bill.

There is no point in me walking the OP through a step by step process to fix
his machine. He won't know if I'm genuine or not, thanks to the troll in
this thread. Your own response could have helped him a little if you had
qualified your recommendation, e.g. by saying "If your machine is infected
then you will have to back up your data and reload Windows". Instead you
made it appear that reloading Windows is the only option. Trolls tend to say
such things - it gives them pleasure to wreak havoc.

 

[The Real Truth [MS MVP]]

You are the problem here Monitor. I do not give out bad advice and in fact
the only bad advice given out in this thread was yours and schwarz. You guys
are nothing but Trolls. If the advice given out to use my fix was wrong then
prove it was wrong. The fact is you are a troll and you can't. There is
nothing wrong with any of my stuff. You are just a jealous crybaby now get
lost you cannot help the op with his issue.


--
The Real Truth http://pcbutts1-therealtruth.blogspot.com/
*WARNING* Do NOT follow any advice given by the people listed below.
They do NOT have the expertise or knowledge to fix your issue. Do not waste
your time.
David H Lipman, Malke, Beauregard T. Shagnasty, Leythos.