Pc logs on then off again [Solved/Closed]

Hello, I'm posting the solution here for you again.

SOLUTION: This solution might or might not work for everyone but it did for me. (I am assuming that your Windows installation is in C:\Windows) Enter to your Windows emergency recovery console via ur boot menu. If you dont have it, then you need to boot with your Windows CD. To do that, some bioses let you press [F8] when u see the post screen to pick boot media or just go into Bios and change boot order so you boot from the CD first. Once you get to the first menu, press R for recovery console. Pick the OS you want to boot in (usually C:\windows), and enter your administrator password. If you don't have one or can't remember if you do, just hit [enter]. Then, once you get the C:\Windows> prompt, (I am assuming that your CD drive is letter E, but change to your CD drive letter accordingly) type:"EXPAND E:\i386\userinit.ex_ C:\WINDOWS\SYSTEM32" without the quotes and it doesn't have to be in caps. This should put a fresh copy of userinit.exe into your windows installation. After this just type EXIT and hit [enter] and you will reboot automatically and hopefully you will be on your way back to your precious desktop >;)

I hope this info helps some people. Thanks for your attention. PRBatman

HELLO ALL, PART# 2 MESSAGE

Hello again Colasus:

I would like to point out that it is not .EXE it is .EX_ otherwise you will get a "file not found" message.

If you are able to switch to E: but you can't switch to cd i386 or get a "can't read from disk" error, then your drive lens could be dirty or your Windows CD could be damaged.

A second option for people who can't read from their CD drives or their Windows disk is damaged or they have a computer like an HP or Compaq that has the Windows pre-installed, is to get userinit.exe from within the same C:\Windows> folder, since Windows keeps its own backup copies when installing and upgrading Service Packs, etc. The only problem with this method is that those copies might be also be infected if you have or had a virus infection in your computer, as some trojans affect only .EXE files. Do this at your own risk and as a last resort to get into windows. The best way is to get a fresh copy of userinit.exe from a Windows CD-ROM; it can be from a borrowed one from a friend or neighbor even. YOU HAVE BEEN WARNED.

Once inside the Recovery Console from C:\Windows>_ prompt type:

COPY C:\Windows\ServicePackFiles\i386\userinit.exe C:\Windows\System32

if that doesn't work (meaning that the file was not found) try:

COPY C:\Windows\System32\DLLcache\userinit.exe C:\Windows\System32

and if that still doesn't work (still not found), try:

COPY C:\Windows\$NtServicePackUninstall$\userinit.exe C:\Windows\System32

Always leave a space between .EXE and C: And this time it IS .EXE not .EX_

Hope that helps more people having trouble to find this file. PRBatman

If that happens then your CD drive is not E:, try using D: or F:. But you really don't need to navigate to the CD in order to put a copy of userinit in your hard drive. Just type: "EXPAND E:\i386\userinit.ex_ C:\windows\system32" without the quotes and just change the letter to D: or F: if it doesn't work with E:, then type EXIT and the computer will reboot immediately.

Hope that helps. PRBatman

Hello Colasus,

I have several questions: Can you get into the Windows recovery console? Did you try the last resort method to copy the file from the hard disk itself using one of the 3 different locations I gave you? Here are the instructions again:

Once inside the Recovery Console from C:\Windows>_ prompt type:

COPY C:\Windows\ServicePackFiles\i386\userinit.exe C:\Windows\System32

if that doesn't work (meaning that the file was not found) try:

COPY C:\Windows\System32\DLLcache\userinit.exe C:\Windows\System32

and if that still doesn't work (still not found), try:

COPY C:\Windows\$NtServicePackUninstall$\userinit.exe C:\Windows\System32

Always leave a space between .EXE and C: And this time it IS .EXE not .EX_

Hello Melling,

That means that you DO have an administrator password. It needs the same administrator password that you use to get into Windows when you log in as administrator. Try using that password. If you don't remember it or you still can't get in, then you are going to have to search for a method or program in the internet to reset that password so you can get in without it into the Recovery Console.

Also when you are booting up the computer keep hitting F8 to go to the Windows Boot Menu to see if you have the Recovery Console already installed in the hard disk so you dont need to use the Windows CD. Usually when you use the Recovery Console from the hard drive, you don't need a password.

Good luck!

PRBatman

Hello Citizenx,

Type:

EXPAND E:\i386\userinit.ex_ C:\windows\system32

Please notice that it is .ex_ NOT .exe and there is a space between _ and C.

If you get an access denied message enter the following command on C:\Windows>_ prompt:

SET AllowAllPaths = True (leave a space before and after the equal sign)

Then try the EXPAND command above again.

Good luck !


PRBatman

Hello Bry,

If you get a "can't read from disk" error, then your drive lens could be dirty or your Windows CD could be damaged.

Depending on your computer brand, the boot menu is accessed differently. Usually, all brand-name computers will boot up from the CD/DVD-ROM when they detect that is inside the drive. Computers like HP and Compaq can be forced to be booted from any drive when you press [ESC] really quick when you get the boot up screen for about 2 seconds where you also get the choice to press F10 for the BIOS setup. Other computers may use F1, F11, F8, etc. It all depends on the brand or if they are home-made clone PC's.

Anyhow if you can't still get to boot from the Windows CD, then your other choice is to enter your Motherboard BIOS when turning on the computer, by usually pressing, F10, F1, [DEL], [CTRL-DEL], etc. Look into your computer's manual to see how to get into the BIOS. Once in there, look for the option to change the booting order of your Hard and CD drives. Make the CD/DVD the first, second your hard drive or another CD/DVD drive and third your hard drive if you had 2 CD/DVD's drives. That will force the computer to boot from the CD/DVD drive first.

I have to also bring to your attention that when you boot from the Windows CD, you get a message on top of the screen saying: "Please press any key to boot from the Windows Setup CD....." If you don't press anything in about 5 seconds, Windows will not load the setup and will skip to the normal boot-up sequence from the hard disk. That might be why you always go back to the normal boot-up process and log-in screen.

I assume that you were able to log into the Recovery Console. Anyhow, first of all try to do it from C:\windows>_ (i will be assuming that your CD drive letter is E:, switch accordingly to D: or F: and make sure that you have your windows CD inside the drive already).

Type:

EXPAND E:\i386\userinit.ex_ C:\windows\system32

Please notice that it is .ex_ NOT .exe and there is a space between _ and C. If you get an "access denied" message enter the following command on C:\Windows>_ prompt:

SET AllowAllPaths = True (leave a space before and after the equal sign), then try the EXPAND command once again.

A second option for people who can't read from their CD drives or their Windows disk is damaged or they have a computer like an HP or Compaq that has the Windows pre-installed and came with no Windows CD, is to get userinit.exe from the from within the same hard disk. It can be from the pre-installed recovery partition which is usually D: or it can be from within the C:\Windows> folder, since Windows keeps its own backup copies when installing and upgrading Service Packs, etc. The only problem with this method is that those copies might be also be infected if you have or had a virus infection in your computer, as some trojans affect only .EXE files. Do this at your own risk and as a last resort to get into windows. The best way is to get a fresh copy of userinit.exe from a Windows CD-ROM; it can even be a borrowed one from a friend or neighbor. YOU HAVE BEEN WARNED.

Once you are inside the Recovery Console at C:\Windows>_ , type this to give you access to all drives and folders:

SET AllowAllPaths = True (leave a space before and after the equal sign)

Then type:

COPY D:\i386\userinit.exe C:\Windows\System32

If that doesn't work (meaning that the file was not found) try:

EXPAND D:\i386\userinit.ex_ C:\Windows\System32

If that doesn't work (meaning that the file was not found) try:

COPY D:\i386\System32\userinit.exe C:\Windows\System32

If that doesn't work (meaning that the file was not found) try:

EXPAND D:\i386\System32\userinit.ex_ C:\Windows\System32

If that doesn't work (meaning that the file was not found) try:

COPY C:\Windows\ServicePackFiles\i386\userinit.exe C:\Windows\System32

if that doesn't work (meaning that the file was not found) try:

COPY C:\Windows\System32\DLLcache\userinit.exe C:\Windows\System32

and if that still doesn't work (still not found), try:

COPY C:\Windows\$NtServicePackUninstall$\userinit.exe C:\Windows\System32

Always leave a space between .EXE and C: And notice that sometimes is .EXE and sometimes .EX_

Hope that helps you and other people having trouble to find this file. By the way, the same method can be used to replace other important files for booting up Windows XP like explorer.exe, winlogon.exe, svchost.exe, spoolsv.exe, etc.

PRBatman

Stummped:

A trojan like the non-destructive but infamous W32.Virut.## (the ## is for the version or mutation) is estimated to have infected up to 30% of the PC's in the world and half of the people don't even know it. My Grisoft AVG antivirus didn't even see it when I got infected with it last February. This trojan will infect all of the .exe and .scr files in your computer faster than a common cold in a day care center. So even if you place a fresh copy of any .exe from a CD back into your hard disk, IT WILL GET INFECTED AGAIN. When the .exe's get infected they place a rootkit inside NTDLL.DLL to modify its coding to take control of all the network section of your computer and make it dial some bogus servers owned by the creator of the virus somewhere in China. That way the hacker will zombify your computer and take control over it and theoretically have access to all the information stored inside.

I recommend you download and install the best free Anti-virus software out there that effectively detects W32.Virut.## and every virus and trojan out there: Avira AntiVir; goto www.free-av.com. Goto options first, pick to use smart detection, set heuristics to medium or high, pick to run all the recommended extensions, all recommended disk areas, compressed files, etc. Put in the Automatic test to quarantine. This will remove the infected files but will give you the option to put any back where it belongs in case is an important file for Windows to work. Also run the RootKit finder test.

It is not recommended to run Avira Antivir from the infected hard disk nor from your computer so you don't get infected also. Instead, you should make a Universal Boot CD for Windows XP (you didn't mention if your friend has Windows XP, but I'm assuming it is since you landed in this thread) and include the Avira Antivir when you burn the disk. Another choice would be to boot the UBCD for Windows XP and then run the Avira Antivir from a pen drive. The idea is to isolate the hard disk so the infection doesn't keep spreading. The hard drive becomes sort of a slave drive. After you run Avira for the whole drive, turn off the computer totally for 10 seconds, including turning the power supply switch off on the back or unplugging it from the wall. Some trojans are known to reside in memory and survive a reboot and even survive more than 5 seconds after turning off the computer (I know, it sounds like a science fiction/SkyNet sort of thing, lol). After that, boot in to UBCD again and do a second scan again of all the hard disk to make sure it is totally clean.

After this, you can try to extract again from the Windows XP CD userinit.ex_, svchost.ex_, explorer.ex_, winlogon.ex_, spoolsv.ex_ all to C:\Windows\System32>; if you get access denied enter: SET AllowAllPaths = TRUE at the prompt. (leave a space before and after the equal sign). Try to see if you can log in to Windows XP again. If you can't, then I recommend to do a repair install. Boot with the Windows XP CD, then don't enter the repair console. Press to install Windows, then press F8 to accept the EULA and then the #1 option should be to repair the current detected windows installation. Hopefully that should fix and replace most of the files that were deleted by the antivirus. That will not change any shortcuts or alter any of the programs installed in your friend's disk. But copy or expand the files I mentioned before anyhow prior to doing the repair installation because sometimes they dont get copied back into the disk automatically.

Hope this info works and you can get that computer going again. Good luck.

PRBatman

Ultimately you have to take it to someone with the tools to fix this problem. Different Viruses do different things. One makes the OS logon then log off. Others will just want your credit card information. So With that in mind Take to someone that can do the problem solving. Never TAKE IT TO GEEK SQUAD. I'm telling you this for your own good. If you want all your pictures and files intact don't take it to them.


As it was posted before This link works I just used it today, and now I'm removing the virus that messed with the computer. I had to use ERD or Another Alternative OS to get into the regedit.

I cannot recommend you doing this yourself if you have not done regedit before. Please save yourself the hassle and take to a well known good PC TECH. (someone with morals)

http://support.microsoft.com/kb/555648

this is a case of a corrupted registry, there is no way that this can be resolved by just doing any repair since windows will not start anymore because the registry key for the logon has been either deleted or corrupted, reinstall windows.

hi,ive tried to reinstall windows but it wont read the disc just keeps saving settings then taking me back to log on screen
any ideas????
cheers

hi all, thanks for the help but i finally cracked it yeeeeeeeeeeeeeha
thanks again
rollarizla

Im having the exact same problem as you, i'd like to know how you fixed it. >.< without reformating the computer, any help or tips would be greatly appreciated, thanks.

I am having the same problem with XP Pro. I went through a major hassle reinstalling the OS, only to have the same thing happen in less than a hour. I just discovered that my "C" drive Is renaming itself "D".

Hello all,

I had the same problem today when I did a repair installation with my Windows XP SP1 disk. My computer was badly infected this week by a rootkit amongst other crap. I still had explorer.exe, userinit.exe and spoolsv.exe infected according to Combofix. So I decided to delete them from the repair console and let the repair installation put them back in. When I put my windows XP setup disk in, it did not recognize that it had a Windows installation on the hard disk. So I figured that it needed explorer.exe at least to recognize this fact. I expanded the file from the Windows CD through Emergency Repair console and put it back in C:\Windows.

Ok, everything fine so far, I did get the repair Windows installation option in setup and proceeded with it. Now, here is where the problem comes. After it finished installing, it did not ask me to register Windows again apparently since it was a repair, but when it tried to enter the desktop, it kicked me back to log-in screen. >:( So then, I remembered that I had deleted userinit.exe, which is needed to let the user into Windows, since in the past I had a similar situation where it got corrupted and I had to put it back in where it belongs. The point is: if userinit.exe gets deleted or corrupted it can cause this problem in certain situations. There is no need to format or do a full fresh installation of Windows where you lose your precious programs or at least all your shortcuts to your programs.

SOLUTION: This solution might or might not work for everyone but it did for me. (I am assuming that your Windows installation is in C:\Windows) Enter to your Windows emergency recovery console via ur boot menu. If you dont have it, then you need to boot with your Windows CD. To do that, some bioses let you press [F8] when u see the post screen to pick boot media or just go into Bios and change boot order so you boot from the CD first. Once you get to the first menu, press R for recovery console. Pick the OS you want to boot in (usually C:\windows), and enter your administrator password. If you don't have one or can't remember if you do, just hit [enter]. Then, once you get the C:\Windows prompt, type: CD SYSTEM32 and hit [enter]; you should now be in C:\Windows\System32>. Next, type D: or E: or whichever is the letter for your CD drive where the Windows XP disk is located. Once there, (let's assume is E:) type: CD I386 and hit [enter]; you should now be in E:\I386>. Now type: EXPAND userinit.ex_ C:\WINDOWS\SYSTEM32 and hit [enter]. This should put a fresh copy of userinit.exe on your windows installation. After this just type EXIT and hit [enter] and you will reboot automatically and hopefully you will be on your way back to your precious desktop >;)

I hope this info helps some people. Thanks for your attention. PRBatman

P.S. btw, I recommend to download this fantastic program ComboFix and run it on your computer, it will get rid of most spywares, virii, worms, trojans, and rootkits known to date; its free, but read instructions prior to using it and even if you are clean, it will at least install the Windows recovery console as a boot selection in your hard disk in case you don' t have it.

Thanks a bunch PRBateman, made my month with that tip.

when i use the expand userinit... i get an "access is denied"
help?
thanks

I too had this problem after I foolishly used Windows Live OneCare in an effort to remove some malware. Not only did OneCare fail to remove the threat completely but it scrambled my registry as part of its "Full Scan" (don't go there!!!!).

I tried all the solutions suggested around the Net without success (the loop can have various causes) but someone suggested using ERD Commander which gives you access to XP's system restore tool amongst other cool things.

I eventually tracked down a copy (try http://www.fullandfree.info/software/erd-commander-2005/ ), got into system restore, only to discover that OneCare had apparently destroyed all my restore points .... but miraculously it had created one of its own prior to wrecking my registry.

I restored to that point, rebooted and problem solved. Many thanks to the folks who suggested this solution - definitely give it a go before considering reinstalling XP.

OK for all those who have these problems follow PRBatman's solution, alternately, if you have access to another computer who also has a spare IDE/SATA slot then this is what I propose, first makesure the 'friend' called Bob from now on has a variety of anitvirus/spyware/etc. programs as this could be a Virus/Trojan etc.. The reason for a variation is that there are viruses for tailoired for some antivirus software eg McAfee, I know as I've suffered from it in the past.

Anyway...

Put the HD on as a Slave for IDE and as the Last SATA possible for SATA drives. Next run both Anti Viruses (Note Windows defender can often detect virus software where AV cannot), get an new copy of all the relevent .dll files and all operators that are common to both Operating Systems a list can be found at the windows website I'll update with a URL at later date. Also export all the Microsoft and Windows registry files by using 'regedit' from the RUN function in windows. Once the .dll, ntldr, ntdetect, and operators files are copied over, put the hardrive back into your computer. Once up and running run the registry file and this will stop occurences of the same thing happening without a repeat infection.

***NOTE*** messing with the registry can be fatal to windows, deleting without knowing what it is affecting is moronic.

One last note, as and when you get a new computer, make sure you get a disc with the operating system and drivers on it and wipe the hard disk, re-install windows on a partition about 10- 20 GB and make this D:\ (make a small partition ~128MB for C:\ with notrhing on it) and other patitions for other uses eg games, pictures and movies, do not hold any information on the D:\ dirve that is not replaceable, this will make sure if you do need to wipe windows and start again you can without loosing everything. Also alot of amature viruses attack directly using C:\Windows\ as a start point, no directory no virus.

G'Luck

PRBatman - Thank you so much! Works like a charm! I think I love you.

Seriously though, thanks a lot.

Dan

Just out of intressed is ur copy of windows real copy and actervated because if it is not it wont let you log in as microsoft wanna piss the pirates off.

if its not actervated my advise would be to get an external case for ur HDD and transfer ur docs over 2 a nother comp, then reformat ;)

prbatman YOUNARE THEEEE MANNNNNN....GOOD LOOKIN...

Hey PRBatman,

I did the fix COPY C:\Windows\$NtServicePackUninstall$\userinit.exe C:\Windows\System32 and it seemed to work. I got logged back into windows.
It looks like all the things on the computer was erased. would this effect that?

Hey there, my CD drive seems not to be working, I'm unsure if it has been disabled or what the go is but it's not a hardware problem and I can't stay logged in to do anything about it.

If you can suggest anything, thank you.

Hi, I'm new here ,but have the same instant log off problem.

I can't log in while in safe mode nor with last good launch settings. I don't have the windows xp installation cd.

I do know the admin. password and i can get into that BIOS setup page by hitting f1 or f10 or one of those (i wasn't sure which one so i just hit all.)

After reading what seems like every forum on the internet regarding this subject it seems like there is no solution without owning the os install disk.

Thanks in advance.

The only CD's I have are the partial recovery disks for windows xp ( four total) but I don't get the screen where it asks you for the drives. I Press the F8 or F2 to get to the BIOS menu but I don't see anything about booting from the drives. When I put the recovery cd's in, then press F8, it asks me for the "R" for the but only gives me two options to format ( delete) or create a backup disk. That's it. Can someone help me please.