Windows just keeps going back to the Welcome Screen

Can you get in using Administrator maybe in safe mode?
I assume its XP and that the Administrator account was not used (still hidden etc)

Also check out http://www.pcreview.co.uk/forums/thread-424416.php

The following page describes how this problem occurs after you have attempted to clean up adware/spyware with a certain version of the data, and also what to do about it:

http://www.winxptutor.com/wsaremove.htm
Unable to logon to Windows after removing BlazeFind using a spyware removal utility?

Logon - Logoff loop, also caused by BlazeFind

Another critical symptom caused by this malware: This malware modifies the Userinit area in the registry (replacing the userinit.exe with wsaupdater.exe) and Ad-Aware (with a particular definition update) removes the wsaupdater.exe file from the system, thus causing the Logon - Logoff loop. That is, when you login to Windows, the 'loading personal settings" verbose will appear, but suddenly it will logoff. This issue was documented clearly by Lavasoftusa in it's Lavahelp Knowledgebase.

Here is the solution to the logon - logoff issue in Windows XP.

Enter the Recovery Console

Boot the system using the Windows XP CD-ROM. In the first screen when the Setup begins, read the instructions press "R" (in the first screen) enter the Recovery Console. Type-in the built-in Administrator password to enter the Console. You'll see the prompt reading C:\Windows (Or any other drive-letter where you've installed XP)

Type the following command and press Enter.

CD SYSTEM32
(If that does not work, try CHDIR SYSTEM32)

COPY USERINIT.EXE WSAUPDATER.EXE

Quit Recovery Console by typing EXIT and restart Windows.

You'll be able to login successfully as you've created the wsaupdater.exe file (now, a copy of userinit.exe)

Now, change the USERINIT value in the registry (see Phase II in this page) and change it accordingly.


NOTE    If you don't have a Windows XP CD-ROM, you need to use Windows XP Setup floppy disks to enter the Recovery Console.

 Phase II  -  Fixing a registry entry which causes the Quick Launch issue (not retaining the settings)

Click Start, Run and type REGEDIT. Navigate to:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Winlogon]

In the right-pane, change the value of Userinit to "C:\WINDOWS\system32\userinit.exe,"

Type the above value exactly as given, including the comma - exclude the quotes. Also, change the path to userinit.exe appropriately, if Windows is installed in a different drive.

Close Registry Editor and restart Windows.

No all users including admin just seem to start for a few sec, then it says saving settings and goes back to the user startup screen.  Regular and safe mode it happens to all users...  For grins I'm doing a chkdsk /r to see if it helps anything but I know it probably won't since that has more to do with windows booting at all rather than booting and then having a user problem.  I can get to DOS prompt via booting off the sys disk and going into the recover console so I can do stuff in DOS (and since I'm an old guy I can edit or delete or make files in dos if I needed to).

Lee, regarding your solution, I'm in the recovery console in windows/system32 and there is no userinit.exe file.  No wsaupdater.exe either... is there a way I can do a copy con and create the file or can I get the userinit.exe somewhere or might it be located somewhere else on the HD?

You can use the EXPAND command to "unzip" the compressed file USERINIT.EX_ which should be present in the I386 folder of the CD so that it will form USERINIT.EXE in C:\Windows\System32

CD i386
EXPAND USERINIT.EX_  C:\WINDOWS\SYSTEM32

Ok, I copied the file from the xp source cd, when I exited and rebooted the problem still exists, I get a wallpaper with no icons and then it takes me back out the welcome screen where I can log in again and the same loop persists.  I'm coming back up into the recovery console now to see if each file still exists and it does.

I have sp2 and the disk is sp2 xp pro disk so that userinit.exe should be fine.

So no luck yet...  Anything else to try?  I read Orangutang's post and checked out the link and that is a 10 or so page thing with TONS of editing and such.  Maybe I have to follow that, I hope not, it is long!

Any other suggestings?

After you expanded the file as explained by Lee, did you then follow the sequence of steps in his earlier post? You need to do so in order to make sure that the userinit entry is correct in the registry also.

Yes Flub, but the subsequent directions presupposed that windows would start normally after copying userinit.exe to wsaupdater.exe and it did not.  The problem remains.  I'm going to go through Orangutangs directions that are extremely extensive and see if I have any better luck.  I'll report back...

I used the link Orangutang provided and followed the document as close as possible.  This machine was an XP pro machine and even though the link had XP in the title it was more geared towards vista.  I downloaded the registry editor recommended in the link and burned the iso to a cd.  Having a reg edit that I could use in this situation was one of the keys here.  As the document suggested I created backups of userinit.exe explorer.exe and rundll32.exe appropriate to my sp version (2 in my case here).  When I tried to copy these files from my key drive I was unable "access denied"...  So, realizing I needed these files and that Lee was kind enough to provide the path x:\i386 and the expand command I expanded each of these files not only into \windows\system32 but also into \windows\system32\dllcache.  Expanding worked.  Then I used the registry editor recommended by the document which provided exhaustive details on how to use it.  (note, just follow the directions exactly)  It has you run the regedit on a bootable cd you make.  I checked for some reg bugs and rebuilt some keys per the directions and savd my work.  I then rebooted into safe mode and now I'm running a scan.  For me this was the last remnant of many nasty bugs, I probably caused the bug by deleting sdra64.exe and some supporting keys.  But regardless, the essense of the fix was represented by Lee and the link to the awesome document was provided by Orangutang.  This fix will help anyone with XP looping in the welcome screen for any number of issues that might mess up the userinit.exe including bugs of course.  One more thing, the document has many switches in the dos / restore panel mode commands that do not work with XP.  Don't worry about the switches just copy the files, remove the directories, etc without the switches ( switches are /s /w /i /t /c /h /e /s like that after dos commands).
Thanks for the help guys, I hope this helps other people - maybe the other post in the knowledge base with the solution of wiping the drive from 2004 should be removed, eh?