XP Pro logon loop at welcome screen

http://65.24.134.81/KipSolutions/TroubleshootingXPBoot/LogonLoop.htm

http://www.winxptutor.com/wsaremove.htm

Unable to logon to Windows after removing BlazeFind using a spyware removal utility?

Logon - Logoff loop, also caused by BlazeFind

Another critical symptom caused by this malware: This malware modifies the Userinit area in the registry (replacing the userinit.exe with wsaupdater.exe) and Ad-Aware (with a particular definition update) removes the wsaupdater.exe file from the system, thus causing the Logon - Logoff loop. That is, when you login to Windows, the 'loading personal settings" verbose will appear, but suddenly it will logoff. This issue was documented clearly by Lavasoftusa in it's Lavahelp Knowledgebase.

Here is the solution to the logon - logoff issue in Windows XP.

Enter the Recovery Console

Boot the system using the Windows XP CD-ROM. In the first screen when the Setup begins, read the instructions press "R" (in the first screen) enter the Recovery Console. Type-in the built-in Administrator password to enter the Console. You'll see the prompt reading C:\Windows (Or any other drive-letter where you've installed XP)

Type the following command and press Enter.

CD SYSTEM32
(If that does not work, try CHDIR SYSTEM32)

COPY USERINIT.EXE WSAUPDATER.EXE

Quit Recovery Console by typing EXIT and restart Windows.

You'll be able to login successfully as you've created the wsaupdater.exe file (now, a copy of userinit.exe)

Now, change the USERINIT value in the registry (see Phase II in this page) and change it accordingly.

Disregard my last post. SheharyaarSaahil  already gavethat link. Sorry SheharyaarSaahil

I had to go all the way down to step 4 in the recovery console and manually copy reg files.  I think there was large portion of the userinit regfile keys missing.  Thanks.  I'm up and runny.  Now to virus/spyware scan it all.

Great..... ^_^

Hello,

I had the same problem, but all the answers did  not work for me. When finaly logged on to windows bij changing the cmd.exe to logon.scr (http://65.24.134.81/KipSolutions/LostPassword/LostTheAdministratorPassword.htm) i could start regedit.  i could also see the virus log files. In the virus log files was no notice of BlazeFind and so a copy of userinit.exe to wsaupdater did not help. All the tricks i found on the web did not help.

Finaly i replaced userinit.exe with a copy of userinit.exe from a clean computer (XP Pro computer) and that solved the problem for me.
So the problem was easer as thought. But thangs for all the help from you fooks.
Maybe my problem solving can help out other people who have the same problem.

Anne (Ratnest)
Sysadmin www.gimd.nl