Solved

Windows XP logs on, then immediately logs off (even in Safe Mode)

Posted on 2009-04-14
8
2,845 Views
Last Modified: 2012-06-27
Good morning.

I have a laptop here with Windows XP installed. It has been working fine for the past 2 years and a frequent virus scans / updates are run using Avast Home. I am also regularly running and updating SpyBot Search and Destroy.

A few days the laptop started to automatically log off as soon as I would log on. At that time I was able to boot in safe mode with networking which was when I updated my Avast program and definitions. I scheduled a boot scan which found 3 Trojans, then shut down.

Now I am not even able to boot in safe mode. I have removed the drive and attached it to a PC and am running a second full virus scan. The first full virus scan did not find anything, but when the drive was placed back into the laptop I am still unable to log on...even in safe mode.

Is there a permissions issue or file corruption that can en corrected? I'd prefer not to resort to a reformat.

Thanks in advance for any advice.
0
Comment
Question by:trahan
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
8 Comments
 
LVL 8

Accepted Solution

by:
dmarinenko earned 500 total points
ID: 24138994
HERE IS THE FIX

1. Navigate to
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"

2. If there is a key named "OldUserinit", delete the "Userinit" key and rename the "OldUserinit" key to "Userinit".

3. The "Userinit" key should now say
"WINDOWS_PATH\system32\userinit.exe,"

"WINDOWS_PATH" is relative to where you have your windows installed.
Mine would be "C:\WINDOWS\system32\userinit.exe,"

Now you can log in again



Who changed my Userinit key?

Spyware. The program is called "Search Assistant" and is located at "\Program Files\WindowsSA". It also has some "omni*.*" files in "\WINDOWS\system32\" dir that are linked to "Userinit" key. If you remove this spyware (using Ad-aware, etc.) the "omni*.*" files are deleted and you can't log in.



How to edit registry when I can't log in?

- Use recovery console - read the manual or browse the web on how to edit registry in recovery console.

OR

- Use another machine on your network: Open regedit and select "File->Connect Remote Registry..." and in the dialog box select computer that has log in problems to view its registry.
0
 

Expert Comment

by:zebex
ID: 24139458
But if you're no longer cant access safe mode, its a corruption issue. To avoid reformatting your drive, your best option is to use a windows xp live cd. It's a copy of windows xp that runs entirely on cd, it doesnt install anything to your HD. It has the essentials tools you need to restore your windows back to its normal state. Try  google and look for it, or you can make one..here is one link see below :
http://pcsplace.com/windows-xp/how-to-create-windows-xp-live-cd-in-15-mins/

Open in new window

0
 

Author Comment

by:trahan
ID: 24140241
I am in the registry and do not see "OLDUserinit", but I do have "Useinit" that only has the value of "userinit.exe". I changed the value to "WINDOWS_PATH\system32\userinit.exe" but the system still just logs on and off immediately.

Is there anything else I can change?
0
Back Up Your Microsoft Windows Server®

Back up all your Microsoft Windows Server – on-premises, in remote locations, in private and hybrid clouds. Your entire Windows Server will be backed up in one easy step with patented, block-level disk imaging. We achieve RTOs (recovery time objectives) as low as 15 seconds.

 

Author Comment

by:trahan
ID: 24140632
I have compared my entry with another win xp station. Here's what I hav for the volume of Userinit:

C:\WINDOWS\system32\userinit.exe,

I still am unable to log on though.
0
 
LVL 8

Expert Comment

by:dmarinenko
ID: 24140787
windows path refers to the system path, did you try changing the key to "c:\windows\syystem32\userinit.exe"?  That is the default path
0
 
LVL 8

Expert Comment

by:dmarinenko
ID: 24140795
If you used "WINDOWS_PATH\system32\userinit.exe" that wouldn't work.
0
 

Author Closing Comment

by:trahan
ID: 31569943
THANK YOU!

Turns out the userinit.exe file was missing. I replaced it and it worked. Thanks again!
0
 
LVL 7

Expert Comment

by:ManicD
ID: 25504146
personally, my userinit.exe file was missing entirly and i copied and pasted from another windows and all was well.
0

Featured Post

Resolve Critical IT Incidents Fast

If your data, services or processes become compromised, your organization can suffer damage in just minutes and how fast you communicate during a major IT incident is everything. Learn how to immediately identify incidents & best practices to resolve them quickly and effectively.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Windows Server 2012 Data Center Edition 11 130
Error login w2012 domain 6 105
Windows XP and a 3TB drive that Windows cannot see 19 88
Evaluating Enterprise Antivirus solutions 2 42
There are many reasons malware will stay around and continue to grow as a business.  The biggest reason is the expanding customer base.  More than 40% of people who are infected with ransomware, pay the ransom.  That makes ransomware a multi-million…
Today, still in the boom of Apple, PC's and products, nearly 50% of the computer users use Windows as graphical operating systems. If you are among those users who love windows, but are grappling to keep the system's hard drive optimized, then you s…
With the advent of Windows 10, Microsoft is pushing a Get Windows 10 icon into the notification area (system tray) of qualifying computers. There are many reasons for wanting to remove this icon. This two-part Experts Exchange video Micro Tutorial s…
With the advent of Windows 10, Microsoft is pushing a Get Windows 10 icon into the notification area (system tray) of qualifying computers. There are many reasons for wanting to remove this icon. This two-part Experts Exchange video Micro Tutorial s…

730 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question