login loop

[Tim Wohlford]

When I try to login to a W2K server (local login) it verifies the
user/password, tells me that it's installing my user settings, the promptly
logs me off.

No, it wasn't updated from an earlier copy of windows.

Yes, this machine was previously infected with spyware. I can't find any
trace of wsaupdater.exe in the registry or on the hard drives. I used BART
PE to look on the hard drives, and in the registry, and can't find anything
obvious.

Booting to this ML310's W2K install CD is a little strange, since it's
running RAID 1 on 2 ATA drives, and none of the Compaq drivers I've tried
have been accepted by the W2K server install (so it doesn't find either hard
drive).


HELP!


Tim Wohlford

 

[Tomasz Onyszko [MVP]]

When I try to login to a W2K server (local login) it verifies the
user/password, tells me that it's installing my user settings, the promptly
logs me off.

No, it wasn't updated from an earlier copy of windows.

(...)

I will bet damaged user's profile or something corrupted with permission
on the profiles directory

 

[Tim Wohlford]

All user logins to that server have the same result.

Thanks!

Tim Wohlford

 

[Guest]

Hi Tim,

Tim I have seen this problem numerous times. This is not a problem with
profiles, but with userinit.exe. The path to userinit.exe is hardcoded with
the drive letter and if drive letters changes, you will get the behavior you
are describing. There is also certain spyware that replaces the userinit.exe.
Try this and see how it goes:

Please see:

http://support.microsoft.com/default.aspx?scid=kb;en-us;892893

This is the cause most of the time. When following the article be shure to
comapre the userinit.exe on the affected system with a userinit.exe on an
unaffected system (same OS / service pack level of course). You may need to
replace the userinit.exe on the machine.

Bart

 

[pscyime]

Hi

above poster hit nail on head , i have too seen this it could well be some spyware called blazefind

replacing the file mentioned sorted it for us

s