?
Solved

XP logs off user right after logging in?

Posted on 2010-01-12
7
Medium Priority
?
742 Views
Last Modified: 2012-05-08
As soon as my nieghbor logs into her XP comuter, it logs her back off.
I'm thinking it's a virus, but I can't log in to safe mode or safe mode with command prompt or nothing.
Any ideas?
PhilW
0
Comment
Question by:philw3995
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
7 Comments
 
LVL 13

Expert Comment

by:Brum07
ID: 26297419
0
 
LVL 3

Expert Comment

by:jakers
ID: 26297438
Could be a faulty driver or hardware. Did she recently install anything new?
0
 
LVL 17

Expert Comment

by:houssam_ballout
ID: 26297456
Try this;


hey try this
1. Boot using your winxp cd.
2. Enter recovery console.
3. at the command prompt go to
            C:/windows/system32
4. next type:
            copy userinit.exe wsaupdater.exe
5. exit and reboot normally. You should now be able to logon. But you're not done yet!
6. run regedit
7. find the Userinit key in:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Winlogon\
8. modify the entry:
C:\WINDOWS\System32\wsaupdater.exe
so that it reads:
C:\WINDOWS\System32\userinit.exe sign on sailor


quoted from:
http://www.computing.net/answers/windows-xp/logged-off-before-fully-logging-on/117147.html
0
Ransomware Attacks Keeping You Up at Night?

Will your organization be ransomware's next victim?  The good news is that these attacks are predicable and therefore preventable. Learn more about how you can  stop a ransomware attacks before encryption takes place with our Ransomware Prevention Kit!

 
LVL 6

Accepted Solution

by:
moodjbow earned 2000 total points
ID: 26298120
I had recently a problem with the same symptoms after an antivirus program quarantined a file (yes it was a virus) that has nested itself "inside" the userinit logon.
Just check the two places:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Winlogon\
there you should have a value REG_SZ named Userinit as C:\Windows\system32\userinit.exe,
yes with the comma at the end.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Image File Execution Options\userinit.exe\
there ít is possible to find a value named Debugger pointing to an exe file - in my case this was the pointer to the quarantined virus.
PS: Since you cannot run regedit even in safe mode I would rather recommend using BartPE instead of winXP install cd' recovery console, and from there load the registry hives for HKLM
0
 
LVL 3

Expert Comment

by:kart4578
ID: 26310294
try this
1. using rescue boot cd
2.u have to try webroot internet security or G-data internet security and repair ur registry files using Advanced System optimizer.surely it will fix it.
                             Thanks kart4578
0
 

Author Closing Comment

by:philw3995
ID: 31676348
This was a little risky, but it worked!

Thanks to all of you!
PhilW.
0
 

Expert Comment

by:michaeltull
ID: 26347536
Thanks for some great answers. Cant use any of them at present because I cant boot from an XP CD. Set up doesnt detect any disks on the machine - so it must use SCSI drivers we dont have. I need to go hunt for XP drivers for Fujitsu lifebook S series first.
0

Featured Post

Free Tool: ZipGrep

ZipGrep is a utility that can list and search zip (.war, .ear, .jar, etc) archives for text patterns, without the need to extract the archive's contents.

One of a set of tools we're offering as a way to say thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

It started not too long ago. It was at first annoying. My keystrokes seemed to be randomly generated, not the ones I typed on the keyboard. For some reason this only happened in certain applications (especially browsers such as IE11, Firefox and Chr…
When you start your Windows 10 PC and got an "Operating system not found" error or just saw  "Auto repair for startup" or a blinking cursor with black screen. A loop for Auto repair will start but fix nothing.  You will be panic as there are no back…
Established in 1997, Technology Architects has become one of the most reputable technology solutions companies in the country. TA have been providing businesses with cost effective state-of-the-art solutions and unparalleled service that is designed…
Email security requires an ever evolving service that stays up to date with counter-evolving threats. The Email Laundry perform Research and Development to ensure their email security service evolves faster than cyber criminals. We apply our Threat…

770 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question