Can't log in

[shadowpuk]

When I login with a password and enter, it does the regular stuff
until it gets up to showing the desktop. The wallpaper flashes once
and then my account logs out.

My computer has all my work on it.

Please Reply Soon!

reboot with your XP CD, press "enter" to bypass the "recovery
console", F8... then press "R" to repair your XP.

I've done this and it worked. I had this problem because of a complete
scan with "ad-aware"...

I've been 3 hours on this.. I tried everything from the remote
registry to the Lavasoft's solution about the "recovery console".

Now I'm gonna ride my dog and go zzzzzzzzzz!!!

I give you a second chance Ad-aware!
for those who are interested: i was using Ad-Aware Se , SE1R9
23.09.2004 and XP SP2 (I'm a beta tester :0)

cheers!

 

[Blane]

This sounds like it might be caused by the removal of the wsaupdater.exe.
A piece of spyware replaces the C:\Windows\system32\userinit.exe file with
a file called wsaupdater.exe. It then modifies the registry so that when
you logon the wsaupdater.exe file is executed. After removing the spyware,
(via Adaware, SpyBot S&D, or another spyware detection tool), the
wsaupdater.exe is removed, but the registry still points to it and tries to
execute it during login. This results in not being able to logon.

The best procedure to correct this is:

1. Boot into recovery console. More info can be found at
http://support.microsoft.com/default.aspx?scid=KB;EN-US;307654

2. Navigate to the c:\windows\system32 folder and type (without the
quotes) "copy userinit.exe wsaupdater.exe". This will trick the system
into booting by copying the legitimate XP userinit.exe file to the
wsaupdater.exe file and allow the system to boot.

3. Reboot the system and logon.

4. Open regedit (from start->run type regedit)

5. Navigate to the key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon and modify the value of Userinit to
C:\WINDOWS\system32\userinit.exe

6. Next in Windows Explorer delete the c:\windows\system32\wsaupdater.exe
file.

At this point your system will be stable and allow you to logon
consistently. However, I would recommend following the guidlines in this
article
http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=TROJ_BLAZEFI
ND.A to ensure the system is completely cleaned up.

Best regards,
Blane Clark


This posting is provided "AS IS" with no warranties, and confers no rights.
You assume all risk for your use.
(C) 2003 Microsoft Corporation. All rights reserved

 

[shadowpuk]

This sounds like it might be caused by the removal of the wsaupdater.exe.
A piece of spyware replaces the C:\Windows\system32\userinit.exe file with
a file called wsaupdater.exe. It then modifies the registry so that when
you logon the wsaupdater.exe file is executed. After removing the spyware,
(via Adaware, SpyBot S&D, or another spyware detection tool), the
wsaupdater.exe is removed, but the registry still points to it and tries to
execute it during login. This results in not being able to logon.

The best procedure to correct this is:

1. Boot into recovery console. More info can be found at
http://support.microsoft.com/default.aspx?scid=KB;EN-US;307654

2. Navigate to the c:\windows\system32 folder and type (without the
quotes) "copy userinit.exe wsaupdater.exe". This will trick the system
into booting by copying the legitimate XP userinit.exe file to the
wsaupdater.exe file and allow the system to boot.

3. Reboot the system and logon.

4. Open regedit (from start->run type regedit)

5. Navigate to the key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon and modify the value of Userinit to
C:\WINDOWS\system32\userinit.exe

6. Next in Windows Explorer delete the c:\windows\system32\wsaupdater.exe
file.

At this point your system will be stable and allow you to logon
consistently. However, I would recommend following the guidlines in this
article
http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=TROJ_BLAZEFI
ND.A to ensure the system is completely cleaned up.

Best regards,
Blane Clark


This posting is provided "AS IS" with no warranties, and confers no rights.
You assume all risk for your use.
(C) 2003 Microsoft Corporation. All rights reserved

Thank you,but as I said, I already tried these 6 steps. It did not
work for me. But two weeks earlier, I had I problem with the
wsaupdater.exe (It was opening the application explorer.exe after
starting the Windows process explorer.exe). I fixed it in the
registry. If I remember, the Blazer had something to do with that.

By the way, when I said that "repairing" my Windows XP was My
solution, I did not expect so much problems after!! For sure,
everything need to be re-patched.. but there so much E.T. problems
now: I made a backup and a clean installation.

I still use Ad-Aware, but i heard that MS will release their own
ad-remover soon... I think this will be a good thing...
$$$?