After Logging on - Immediate Logoff

[Alan Kauf-Stern]

Something very strange has happened. I did a power off
shutdown of Windows XP. After rebooting, when I try to
logon to any of the 5 accounts that I had defined to my
PC, the account screensaver appears but then I get a
message that the settings are being saved and the the
account does an immediate logoff. I can't logon. This
happens with all 5 accounts. I don't know what I did and
how to get into the account. Any advice, anyone. Thanks
in advance. Alan

 

[Pegasus \(MVP\)]

Something very strange has happened. I did a power off
shutdown of Windows XP. After rebooting, when I try to
logon to any of the 5 accounts that I had defined to my
PC, the account screensaver appears but then I get a
message that the settings are being saved and the the
account does an immediate logoff. I can't logon. This
happens with all 5 accounts. I don't know what I did and
how to get into the account. Any advice, anyone. Thanks
in advance. Alan

Is the machine accessible via a network?

 

[Darren Curtis]

I understand your pain, I have seen a lot of this in the last two weeks.

The problem originates with malware or spyware altering critical registry settings which allow windows to process a logon.

1. Boot to recovery Console

Description of the Windows XP Recovery Console (314058)
http://support.microsoft.com/default.aspx?scid=kb;EN-US;314058

2. Change Directory to System32 (CD system32)

3. In C:\Windows\system32 Folder Type "Copy userinit.exe wsaupdater.exe" (without the quotation marks) and press enter

4. Restart the Computer

5. Log in to in Windows

6. Open the Registry Editor and browse to KEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Winlogon

7. Modify the Value Userinit to C:\WINDOWS\system32\userinit.exe

8. Close registry Editor

9. Delete wsaupdater.exe File in C:\Windows\System32 Folder


Best Regards,
Darren Curtis, MCSE
Microsoft Enterprise Support Engineer
Get Secure! - www.microsoft.com/security

=====================================================
When responding to posts, please "Reply to Group" via
your newsreader so that others may learn and benefit
from your issue.
=====================================================

This posting is provided "AS IS" with no warranties, and confers no rights.

 

[Alan Kauf-Stern]

Hi Darren,

Thanks for your response - to a non-experienced person
such as myself, it sounds a bit complicated, but I'll
give it a try as soon as I can. I do have another
question though - sort of a bypass as it were. In the
present situation where there is the immediate logoff, it
is possible to stop using accounts - that is, everyone
just gets onto the PC and does what they want to do? The
accounts are just my kids and wife so it's not as if
there is critical information and such. Can we disable
the accounts, and if so, how? Again, thanks in advance.

-----Original Message-----
I understand your pain, I have seen a lot of this in the last two weeks.

The problem originates with malware or spyware altering

critical registry settings which allow windows to process
a logon.

1. Boot to recovery Console

Description of the Windows XP Recovery Console (314058)
http://support.microsoft.com/default.aspx?scid=kb;EN- US;314058

2. Change Directory to System32 (CD system32)

3. In C:\Windows\system32 Folder Type "Copy

userinit.exe wsaupdater.exe" (without the quotation
marks) and press enter

 

[Pegasus \(MVP\)]

To start a session under WindowsXP, you must invoke
a file called "userinit.exe". This file is currently unavailable
on your machine, probably due to the action of some
spyware, and perhaps AdAware. The method that
Darren gave you is probably the simplest and safest
way of restoring the functionality of your logon process.

 

[Alan Kauf-Stern]

Di Darren,

Ok, I am having trouble understanding on how to get to
the Recovery Console. I've tried the following.
1. I tried to reboot for the 1st of the System Recovery
CDs and did not get a Recovery Console. Maybe I did not
allow the process to get far enough. I was nervous that I
would start formatting the C drive. I received the System
Utility screen which allowed me options to perform
various types of recoveries, but did not see anything
about getting to a Recovery Console. I was nervous to go
too far. So I stop with this.
2. I went into SAFE mode but did not see anything about a
Recovery Console.
3. I went to the website you indicated below. It said to
use the Windows Setup floppy disks or use the CR-ROM to
reboot. Well, when I bought the Sony desktop (Windows XP
Home Edition), I didn't get a "Setup" floppy, only
recovery CDs and I don't understand what exactly is meant
by the Windows CD-ROM. So where do I go from here?
Remember, I am not an experienced user. Plz advise me.
Hope to hear from you soon. Thanks in advance. Alan

-----Original Message-----
I understand your pain, I have seen a lot of this in the last two weeks.

The problem originates with malware or spyware altering

critical registry settings which allow windows to process
a logon.

1. Boot to recovery Console

Description of the Windows XP Recovery Console (314058)
http://support.microsoft.com/default.aspx?scid=kb;EN- US;314058

2. Change Directory to System32 (CD system32)

3. In C:\Windows\system32 Folder Type "Copy

userinit.exe wsaupdater.exe" (without the quotation
marks) and press enter

 

[Pegasus \(MVP\)]

See below.

Di Darren,

Ok, I am having trouble understanding on how to get to
the Recovery Console. I've tried the following.
1. I tried to reboot for the 1st of the System Recovery
CDs and did not get a Recovery Console. Maybe I did not
allow the process to get far enough. I was nervous that I
would start formatting the C drive. I received the System
Utility screen which allowed me options to perform
various types of recoveries, but did not see anything
about getting to a Recovery Console. I was nervous to go
too far. So I stop with this.

*** Your concerns are justified. Your Recovery CD would
*** most likely erase your current installation.

2. I went into SAFE mode but did not see anything about a
Recovery Console.

*** There isn't one.

3. I went to the website you indicated below. It said to
use the Windows Setup floppy disks or use the CR-ROM to
reboot. Well, when I bought the Sony desktop (Windows XP
Home Edition), I didn't get a "Setup" floppy, only
recovery CDs and I don't understand what exactly is meant
by the Windows CD-ROM. So where do I go from here?
Remember, I am not an experienced user. Plz advise me.
Hope to hear from you soon. Thanks in advance. Alan

*** To get into the Recovery Console, do this:
*** - Set your BIOS to boot from the CD drive.
*** - Pop in your Windows XP installation CD.
*** - Reboot.
*** - When prompted, select "Boot from CD".
*** - When prompted, select "Repair".
*** - When prompted, select "Recovery Console".

 

[Alan Kauf-Stern]

Unfortunately I don't have a Windows XP installation CD.
All that came with the desktop when I bought it were 3
system recovery CDs, 2 application recovery CDs and 1 DVD
recovery CD - whatever that is. So am I out of luck? Is
my only option at this point to do a restore from the CDs?
Thanks.

 

[Pegasus \(MVP\)]

- Do you have a friend with a WinXP or Win2000 PC?
- Do you have a friend whose WinXP or Win2000 CD
you could borrow? You won't need his licence number.