XP logs off user right after logging in?

As soon as my nieghbor logs into her XP comuter, it logs her back off.
I'm thinking it's a virus, but I can't log in to safe mode or safe mode with command prompt or nothing.
Any ideas?
PhilW
philw3995Asked:
Who is Participating?
 
moodjbowConnect With a Mentor Commented:
I had recently a problem with the same symptoms after an antivirus program quarantined a file (yes it was a virus) that has nested itself "inside" the userinit logon.
Just check the two places:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Winlogon\
there you should have a value REG_SZ named Userinit as C:\Windows\system32\userinit.exe,
yes with the comma at the end.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Image File Execution Options\userinit.exe\
there ít is possible to find a value named Debugger pointing to an exe file - in my case this was the pointer to the quarantined virus.
PS: Since you cannot run regedit even in safe mode I would rather recommend using BartPE instead of winXP install cd' recovery console, and from there load the registry hives for HKLM
0
 
jakersCommented:
Could be a faulty driver or hardware. Did she recently install anything new?
0
Evaluating UTMs? Here's what you need to know!

Evaluating a UTM appliance and vendor can prove to be an overwhelming exercise.  How can you make sure that you're getting the security that your organization needs without breaking the bank? Check out our UTM Buyer's Guide for more information on what you should be looking for!

 
houssam_balloutCommented:
Try this;


hey try this
1. Boot using your winxp cd.
2. Enter recovery console.
3. at the command prompt go to
            C:/windows/system32
4. next type:
            copy userinit.exe wsaupdater.exe
5. exit and reboot normally. You should now be able to logon. But you're not done yet!
6. run regedit
7. find the Userinit key in:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Winlogon\
8. modify the entry:
C:\WINDOWS\System32\wsaupdater.exe
so that it reads:
C:\WINDOWS\System32\userinit.exe sign on sailor


quoted from:
http://www.computing.net/answers/windows-xp/logged-off-before-fully-logging-on/117147.html
0
 
kart4578Commented:
try this
1. using rescue boot cd
2.u have to try webroot internet security or G-data internet security and repair ur registry files using Advanced System optimizer.surely it will fix it.
                             Thanks kart4578
0
 
philw3995Author Commented:
This was a little risky, but it worked!

Thanks to all of you!
PhilW.
0
 
michaeltullCommented:
Thanks for some great answers. Cant use any of them at present because I cant boot from an XP CD. Set up doesnt detect any disks on the machine - so it must use SCSI drivers we dont have. I need to go hunt for XP drivers for Fujitsu lifebook S series first.
0
All Courses

From novice to tech pro — start learning today.