Logon fails, immediately logs off

[Zunkination]

McAfee detected a virus on my machine (backdoor_BAM) which
was removed (the file SVCINIT.EXE).

Ever since then, when I select a user account to login to
Windows XP, I see the background flash, and then it
returns me back to the logon screen.

I have tried entering as administrator through safe-mode
to no avail. The same problem happens.

I also did "Last known good configuration" through the
boot menu with no success.

I have also tried restoring SVCINIT.EXE with a fake "place-
holder" version to see if that fixed the problem, but it
doesn't.

I believe it modifies the registry value:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows
NT\CurrentVersion\Winlogon "Userinit" to
call "SVCINIT.EXE".

I am clueless here, everything I've tried fails, and I
just want to get back in to copy some files off my system.

Any help would be appreciated.

 

[Steve Nielsen]

Svcinit.exe is the trojan, don't replace it.

See here for how to remove the registry changes the trojan made:

http://securityresponse.symantec.com/avcenter/venc/data/backdoor.sinit.html

Steve

 

[Guest]

Unfortunetely, that method won't work because I cannot get
into Windows to modify the registry.

If you know of a way to modify the registry without
logging into Windows, that'd be great.

 

[Steve Nielsen]

Can you get in using Safe Mode?

Steve

Unfortunetely, that method won't work because I cannot get
into Windows to modify the registry.

If you know of a way to modify the registry without
logging into Windows, that'd be great.




trojan made:


fake "place-

 

[zunkination]

No, Safe mode fails the same way that a normal logon does.

 

[Zunkination]

I fixed it, and for anyone else who experiences this
problem, follow the steps outlined here. It may help your
situation.

http://support.microsoft.com/default.aspx?scid=kb;en-
us;Q307545

 

[Steve Nielsen]

Bummer...

I think your only otion then is to boot the XP cd and try to do a repair
install and keep your fingers mentally crossed.

I ran into a very similar situation recently and I know you don't want
to hear this, but I ended having to blow it all away and completely
reinstall Windows fresh.

Good luck!
Steve

 

[Steve Nielsen]

In my situation I could not do that because I was also unable to login
to Windows from the Recovery Console - it would not accept the
Administrator password.

Glad you got it fixed, though!

Steve