J
Jose
Boot back into RC so you are back in the C:\WINDOWS folder.
There is a malware that deletes, corrupts or replaces the c:\windows
\system32\userinit.exe file.
The userinit.exe is the file that processes your login in regular mode
or any kind of Safe Mode,
so if it the mechanism is somehow broken it creates an endless cycle
of unsuccessful logon attempts in any mode for
any user.
When you type in your user name and password the system will report
that it is Loading your personal
settings, logging off and then unloading your personal settings. This
is the malware trying to prevent you from
finding and removing it.
It may also change your registry so instead of the registry pointing
to userinit.exe, it points
to another file called wsaupdater.exe. Sometimes scanning programs
can find and replace the wsaupdater.exe
file but will not fix the registry so you need to somehow get the
system to boot and fix the rest of the
problem by hand.
It is popular enough for Microsoft to create a KB that describes the
wsaupdater problem (read it later).
http://support.microsoft.com/kb/892893
The following directions will cover more situations than the article,
but you should read it to understand.
After booting on the Recovery Console successfully, you are in the C:
\WINDOWS folder, and the userinit.exe
file is in the SYSTEM32 folder so change to the system32 folder by
entering:
cd system32
The prompt should now be:
c:\windows\system32
Check for the presence of both userinit.exe and wsaupdater.exe. They
may be there or they may not,
but we need to know to completely fix the problem.
dir userinit.exe (post results - the file exists or it does not)
dir wsaupdater.exe (post results - the file exists or it does not)
No matter what you find, replace the userinit.exe from a copy
elsewhere on your system.
There is another copy of userinit.exe in the c:\windows
\system32\dllcache folder so copy it into
the c:\windows\system32 folder.
From the c:\windows\system32 folder enter:
copy c:\windows\system32\dllcache\userinit.exe
You will get a message that says 1 file(s) copied or to overwrite the
existing?, (choose (Y)es to
overwrite) and post back what happened - it either copied or it
replaced userinit.exe.
If the copy fails for some reason, we can get a userinit.exe from your
installation CD (if you made a
Recovery Console CD, userinit.exe is not on it).
The malware may have changed your registry to point to wsaupdater.exe,
but a malware scan may
remove only the wsaupdater.exe file but the registry is still wrong
and your system will still not boot
until you copy userinit.exe to wsaupdater.exe. We will check for and
fix this later.
In case the registry was also changed, in the c:\windows\system32
folder, copy userinit.exe to wsaupdater.exe. Do not delete the
wsaupdater.exe file if it exists - just copy the userinit.exe file
over the top of it.
From the c:\windows\system32 folder enter:
copy userinit.exe wsaupdater.exe
Answer (Y)es if there is an overwrite prompt. Post the results - it
either copied it or replaced it.
Make sure userinit.exe exists be entering:
dir userinit.exe (post results - it should exist)
Type exit to leave the Recovery Console, remove the CD and reboot.
If the wsaupdater.exe file existed, we need to check the registry to
make sure it is okay,
but scan for malware first, and check/fix the registry later.
...