pc logs on then off againSolved/Closed

Question

Hello, my pc keeps saving all the settings then goes back to the log on screen when I try to turn it on,my desk top appears but no icons then the pc says saving all settings then goes back to log in screen,ive tried it in safe mode but does the same ..any help out there please
                                          cheers rolla

PRBatman · Accepted Answer

Hello, I'm posting the solution here for you again. 

SOLUTION: This solution might or might not work for everyone but it did for me. (I am assuming that your Windows installation is in C:\Windows) Enter to your Windows emergency recovery console via ur boot menu. If you dont have it, then you need to boot with your Windows CD. To do that, some bioses let you press [F8] when u see the post screen to pick boot media or just go into Bios and change boot order so you boot from the CD first. Once you get to the first menu, press R for recovery console. Pick the OS you want to boot in (usually C:\windows), and enter your administrator password. If you don't have one or can't remember if you do, just hit [enter]. Then, once you get the C:\Windows> prompt, (I am assuming that your CD drive is letter E, but change to your CD drive letter accordingly) type:"EXPAND E:\i386\userinit.ex_ C:\WINDOWS\SYSTEM32" without the quotes and it doesn't have to be in caps. This should put a fresh copy of userinit.exe into your windows installation. After this just type EXIT and hit [enter] and you will reboot automatically and hopefully you will be on your way back to your precious desktop >;)  

I hope this info helps some people. Thanks for your attention. PRBatman

griever09 · Answer

this is a case of a corrupted registry, there is no way that this can be resolved by just doing any repair since windows will not start anymore because the registry key for the logon has been either deleted or corrupted, reinstall windows.

rolla · Answer

hi,ive tried to reinstall windows but it wont read the disc just keeps saving settings then taking me back to log on screen
any ideas????
                                                     cheers

rolla · Answer

hi all, thanks for the help but I finally cracked it yeeeeeeeeeeeeeha
 thanks again
                              rollarizla

link · Answer

Im having the exact same problem as you, i'd like to know how you fixed it. >.< without reformating the computer, any help or tips would be greatly appreciated, thanks.

billy · Answer

I am having the same problem with XP Pro. I went through a major hassle reinstalling the OS, only to have the same thing happen in less than a hour. I just discovered that my "C" drive Is renaming  itself "D".

Mr.Antivirus · Answer

Hi I agree that the only way to fix this is to format and reinstall.  If possible save your data using another pc.  As far as your hard drive renaming itself to d:  more than likely you have a smartcard device or media reader that takes a drive letter.   It is best to uninstall these devices and other hard drives before you format and install xp / vista.  The installer for xp has a tendancy to put volume information on both hard drives, and may choose odd drive letters for the main drive when these guys are present.

Good day

savanna · Answer

i have the same problem but I dont have the windows to do that with please helpp mee! my dad will kill me if I dont get it fixed!!!!!!

PRBatman · Answer

Hello all,

I had the same problem today when I did a repair installation with my Windows XP SP1 disk.  My computer was badly infected this week by a rootkit amongst other crap.  I still had explorer.exe, userinit.exe and spoolsv.exe infected according to Combofix. So I decided to delete them from the repair console and let the repair installation put them back in.  When I put my windows XP setup disk in, it did not recognize that it had a Windows installation on the hard disk.  So I figured that it needed explorer.exe at least to recognize this fact.  I expanded the file from the Windows CD through Emergency Repair console and put it back in C:\Windows. 

Ok, everything fine so far, I did get the repair Windows installation option in setup and proceeded with it.  Now, here is where the problem comes.  After it finished installing, it did not ask me to register Windows again apparently since it was a repair, but when it tried to enter the desktop, it kicked me back to log-in screen. >:(  So then, I remembered that I had deleted userinit.exe, which is needed to let the user into Windows, since in the past I had a similar situation where it got corrupted and I had to put it back in where it belongs.  The point is: if userinit.exe gets deleted or corrupted it can cause this problem in certain situations.  There is no need to format or do a full fresh installation of Windows where you lose your precious programs or at least all your shortcuts to your programs.

SOLUTION:  This solution might or might not work for everyone but it did for me. (I am assuming that your Windows installation is in C:\Windows) Enter to your Windows emergency recovery console via ur boot menu.  If you dont have it, then you need to boot with your Windows CD.  To do that, some bioses let you press [F8] when u see the post screen to pick boot media or just go into Bios and change boot order so you boot from the CD first.  Once you get to the first menu, press R for recovery console.  Pick the OS you want to boot in (usually C:\windows), and enter your administrator password.  If you don't have one or can't remember if you do, just hit [enter]. Then, once you get the C:\Windows prompt, type: CD SYSTEM32 and hit [enter]; you should now be in C:\Windows\System32>.  Next, type D: or E: or whichever is the letter for your CD drive where the Windows XP disk is located.  Once there, (let's assume is E:) type: CD I386 and hit [enter]; you should now be in E:\I386>.  Now type: EXPAND userinit.ex_ C:\WINDOWS\SYSTEM32 and hit [enter]. This should put a fresh copy of userinit.exe on your windows installation.  After this just type EXIT and hit [enter] and you will reboot automatically and hopefully you will be on your way back to your precious desktop >;)  

I hope this info helps some people.  Thanks for your attention.  PRBatman

P.S.  btw, I recommend to download this fantastic program ComboFix and run it on your computer, it will get rid of most spywares, virii, worms, trojans, and rootkits known to date; its free, but read instructions prior to using it and even if you are clean, it will at least install the Windows recovery console as a boot selection in your hard disk in case you don' t have it.

tykjen · Answer

Thanks a bunch PRBateman, made my month with that tip.

citizenx · Answer

when I use the expand userinit... I get an "access is denied"
help?
thanks

old_devil · Answer

I too had this problem after I foolishly used Windows Live OneCare in an effort to remove some malware. Not only did OneCare fail to remove the threat completely but it scrambled my registry as part of its "Full Scan" (don't go there!!!!). 

I tried all the solutions suggested around the Net without success (the loop can have various causes) but someone suggested using ERD Commander which gives you access to XP's system restore tool amongst other cool things. 

I eventually tracked down a copy (try http://www.fullandfree.info/software/erd-commander-2005/ ), got into system restore, only to discover that OneCare had apparently destroyed all my restore points .... but miraculously it had created one of its own prior to wrecking my registry.  

I restored to that point, rebooted and problem solved. Many thanks to the folks who suggested this solution - definitely give it a go before considering reinstalling XP.

Can't fix Bodge!! · Answer

OK for all those who have these problems follow PRBatman's solution, alternately, if you have access to another computer who also has a spare IDE/SATA slot then this is what I propose, first makesure the 'friend' called Bob from now on has a variety of anitvirus/spyware/etc. programs as this could be a Virus/Trojan etc.. The reason for a variation is that there are viruses for tailoired for some antivirus software eg McAfee, I know as I've suffered from it in the past.

Anyway...

Put the HD on as a Slave for IDE and as the Last SATA possible for SATA drives. Next run both Anti Viruses (Note Windows defender can often detect virus software where AV cannot), get an new copy of all the relevent .dll files and all operators that are common to both Operating Systems a list can be found at the windows website I'll update with a URL at later date. Also export all the Microsoft and Windows registry files by using 'regedit' from the RUN function in windows. Once the .dll, ntldr, ntdetect, and operators files are copied over, put the hardrive back into your computer. Once up and running run the registry file and this will stop occurences of the same thing happening without a repeat infection.

***NOTE*** messing with the registry can be fatal to windows, deleting without knowing what it is affecting is moronic.

One last note, as and when you get a new computer, make sure you get a disc with the operating system and drivers on it and wipe the hard disk, re-install windows on a partition about 10- 20 GB and make this D:\ (make a small partition ~128MB for C:\ with notrhing on it) and other patitions for other uses eg games, pictures and movies, do not hold any information on the D:\ dirve that is not replaceable, this will make sure if you do need to wipe windows and start again you can without loosing everything. Also alot of amature viruses attack directly using C:\Windows\ as a start point, no directory no virus.

G'Luck

danwilkie · Answer

PRBatman - Thank you so much! Works like a charm! I think I love you.

Seriously though, thanks a lot.

Dan

Forg · Answer

Just out of intressed is ur copy of windows  real copy and actervated because if it is not it wont let you log in as microsoft wanna piss the pirates off.

if its not actervated my advise would be to get an external case for ur HDD and transfer ur docs over 2 a nother comp, then reformat ;)

biggclea · Answer

prbatman YOUNARE THEEEE MANNNNNN....GOOD LOOKIN...

daniek · Answer

Hey PRBatman,

I did the fix COPY C:\Windows\$NtServicePackUninstall$\userinit.exe C:\Windows\System32 and it seemed to work. I got logged back into windows.
It looks like all the things on the computer was erased. would this effect that?

MattSoldier · Answer

Hey there, my CD drive seems not to be working, I'm unsure if it has been disabled or what the go is but it's not a hardware problem and I can't stay logged in to do anything about it.

If you can suggest anything, thank you.

i_hate_my_pc · Answer

Hi, I'm new here ,but have the same instant log off problem. 

I can't log in while in safe mode nor with last good launch settings. I don't have the windows xp installation cd.

I do know the admin. password and I can get into that BIOS setup page by hitting f1 or f10 or one of those (i wasn't sure which one so I just hit all.) 

After reading what seems like every forum on the internet regarding this subject it seems like there is no solution without owning the os install disk. 

Thanks in advance.

April · Answer

The only CD's I have are the partial recovery disks for windows xp ( four total) but I don't get the screen where it asks you for the drives.  I Press the F8 or F2 to get to the BIOS menu but I don't see anything about booting from the drives.  When I put the recovery cd's in, then press F8, it asks me for the "R" for the but only gives me two options to format ( delete) or create a backup disk.  That's it.  Can someone help me please.

Unknown · Answer

Google Log in log off problem + thinking in pixels. 
It's an entire step by step website devoted to this problem. worked fantastically for me. you get person to person help there.

Kat · Answer

I'm doing the EXPAND E:\userinit.ex_ c:\WINDOWS\SYSTEM32 but it either gives me an error that theres no CD in the drive OR says Windows Canno Find The File or Directory Specified

Biggles200 · Answer

You can easily get past the desktop problem by opening the task manager - Crtl -Alt - Delete. Then select New Task and open the folder containing program files and select a program that will repair your registry. If you haven't got one then open Internet Explorer and find one.

Guti · Answer

In most cases where replacing the userinit.exe does not work the reason is quite simple: You fooled around with your hard disk, changed the disk and/or controller. Now when you start Windows, just as you log in the operating system assigns its drive letters. However, due to a changed disk or controller, the drive letters don't get assigned correctly. They may look right in the recovery console, but standard Windows (as well as Safe Mode) is a different story.
Now you can replace userinit.exe as often as you want, it won't help, because the file is not broken or corrupt, and not infected either. Windows just can't find it, because it's not looking for it on the right drive.

To get this fixed, edit the registry of the system that always logs you off. There are many ways to do this from another system, google for it. There, find HKEY_LOCAL_MACHINE\SYSTEM\MountedDevices , look for entries like \DosDevices\D: etc. Make sure the right drive letters are assigned there. You can do so by comparing this to the system as it was before you made the change (if you still have a backup). If you don't know for sure which letter was assigned to your system drive, you may just have to try. 
Changing the entries works by right-clicking on them, selecting "rename" (in standard regedit) and changing \DosDevices\D: to \DosDevices\C:, for example.

These microsoft articles may help as well, as they explain the issue:
https://docs.microsoft.com/en-us/troubleshoot/windows-server/backup-and-storage/restore-system-boot-drive-letter
https://support.microsoft.com/en-us/help/249321/

merlingoth · Answer

I can't thank you all enough. It was a combination of things that worked for me:

copied and expanded the init.ex_ file, but still had no luck. 

I used a HawkPE boot disc to run a remote registry editor and did what was suggested:

Run REGEDIT. Navigate to:

HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ WindowsNT \ CurrentVersion \ Winlogon

In the right-pane, change the value of Userinit to "C:\WINDOWS\system32\userinit.exe," 

Prayed and then it worked :)

Thanks so much!

Jessie · Answer

hi, i'm having the same issues and I have an HP Pavilion so I tried to do the other options to get it from the preinstallled options and I tried to put "SET ALLOWALLPATHS = TRUE" but it comes back as "THE SET COMMAND IS CURRENTLY DISABLED. THE SET COMMAND IS AN OPTIONAL RECOVERY CONSOLE COMMAND THAT CAN ONLY BE ENABLED BY USING THE SECURITY CONFIGURATION AND ANALYSIS SNAP-IN". Also this log off problem happened after I ran my norton antivirus. I wanted to know if there's anyway I can enable the set command without the error above, I really need help with this, I don't want to lose my documents and precious pics. i'm getting the recovery disk from HP which includes the xp OS and i'm going to try to repair it but will that solve the issue? will that erase my documents and pics? I have a C: drive but most of my info is in my D: drive since it has a lot more memory. please help...thank you in advance

ihairbook · Answer

Dear PRbatman, 

I've tried all your methods to repair the logs on then off again problem. Finally, I solved this problem by using "REPAIR INSTALL" by windows XP CD. I did follow all your steps and Now, my pc have fixed! Many Thanks for your time! If you have chance Please stop by my salon and I'll give you FREE haircut. Check it out here: ihairbook.yelp.com Thanks again!

Shadowz · Answer

Ok so I tried literally everything on this site. My computer still won't log on, and I know I have the Internet security 2010 virus, and I thought I got everything but the login thing, so I restarted. Since then, I've looked up all the help forums I can find, but nothing helps. Maybe my problem isn't with the userinit thing? It replaced, but nothing happened. PLEASE HELLLPPPPPP!!!!!!!!!!!!!!!!!!!

ihairbook · Answer

Hello All, PLEASE READ THIS PART 1 MESSAGE BEFORE QUESTION!!! IT MIGHT SAVE YOUR TIME AND PRBATMAN'S TIME TOO :-)

I'm going to post 10 messages reply from PRbatman here and wanna save each others(like a new questioner) time here. 

My pc got a logs in and logs on problems 2 days ago. I READ THIS FORUM EACH MESSAGE FROM PRBATMAN VERY CAREFULLY. I ALSO SPENT 3 HOURS ALMOST TO FIX MY PC, I HAD TIRED MANY WAYS BUT IT DIDN'T WORK OUT! FINALLY, I TRIED THE "REPAIR INSTALL" BY WINDOWS XP CD(JUST FOLLOW PRBATMAN STEPS) THEN I FIXED AND NO MORE LOGS IN AND LOGS ON PROBLEM. HIGHLY THANKS PRBATMAN  HERE AND I SAVE SOME MONEY ON THAT (NO NEED TO FIND FRIENDS OR PC FIXER IN LOCAL AREA FOR HELP)

Stummped:

A trojan like the non-destructive but infamous W32.Virut.## (the ## is for the version or mutation) is estimated to have infected up to 30% of the PC's in the world and half of the people don't even know it. My Grisoft AVG antivirus didn't even see it when I got infected with it last February. This trojan will infect all of the .exe and .scr files in your computer faster than a common cold in a day care center. So even if you place a fresh copy of any .exe from a CD back into your hard disk, IT WILL GET INFECTED AGAIN. When the .exe's get infected they place a rootkit inside NTDLL.DLL to modify its coding to take control of all the network section of your computer and make it dial some bogus servers owned by the creator of the virus somewhere in China. That way the hacker will zombify your computer and take control over it and theoretically have access to all the information stored inside.

I recommend you download and install the best free Anti-virus software out there that effectively detects W32.Virut.## and every virus and trojan out there: Avira AntiVir; goto www.free-av.com. Goto options first, pick to use smart detection, set heuristics to medium or high, pick to run all the recommended extensions, all recommended disk areas, compressed files, etc. Put in the Automatic test to quarantine. This will remove the infected files but will give you the option to put any back where it belongs in case is an important file for Windows to work. Also run the RootKit finder test.

It is not recommended to run Avira Antivir from the infected hard disk nor from your computer so you don't get infected also. Instead, you should make a Universal Boot CD for Windows XP (you didn't mention if your friend has Windows XP, but I'm assuming it is since you landed in this thread) and include the Avira Antivir when you burn the disk. Another choice would be to boot the UBCD for Windows XP and then run the Avira Antivir from a pen drive. The idea is to isolate the hard disk so the infection doesn't keep spreading. The hard drive becomes sort of a slave drive. After you run Avira for the whole drive, turn off the computer totally for 10 seconds, including turning the power supply switch off on the back or unplugging it from the wall. Some trojans are known to reside in memory and survive a reboot and even survive more than 5 seconds after turning off the computer (I know, it sounds like a science fiction/SkyNet sort of thing, lol). After that, boot in to UBCD again and do a second scan again of all the hard disk to make sure it is totally clean.

After this, you can try to extract again from the Windows XP CD userinit.ex_, svchost.ex_, explorer.ex_, winlogon.ex_, spoolsv.ex_ all to C:\Windows\System32>; if you get access denied enter: SET AllowAllPaths = TRUE at the prompt. (leave a space before and after the equal sign). Try to see if you can log in to Windows XP again. If you can't, then I recommend to do a repair install. Boot with the Windows XP CD, then don't enter the repair console. Press to install Windows, then press F8 to accept the EULA and then the #1 option should be to repair the current detected windows installation. Hopefully that should fix and replace most of the files that were deleted by the antivirus. That will not change any shortcuts or alter any of the programs installed in your friend's disk. But copy or expand the files I mentioned before anyhow prior to doing the repair installation because sometimes they dont get copied back into the disk automatically.

Hope this info works and you can get that computer going again. Good luck.

PRBatman

ihairbook · Answer

HELLO ALL, PART# 2 MESSAGE

Hello again Colasus:

I would like to point out that it is not .EXE it is .EX_ otherwise you will get a "file not found" message.

If you are able to switch to E: but you can't switch to cd i386 or get a "can't read from disk" error, then your drive lens could be dirty or your Windows CD could be damaged.

A second option for people who can't read from their CD drives or their Windows disk is damaged or they have a computer like an HP or Compaq that has the Windows pre-installed, is to get userinit.exe from within the same C:\Windows> folder, since Windows keeps its own backup copies when installing and upgrading Service Packs, etc. The only problem with this method is that those copies might be also be infected if you have or had a virus infection in your computer, as some trojans affect only .EXE files. Do this at your own risk and as a last resort to get into windows. The best way is to get a fresh copy of userinit.exe from a Windows CD-ROM; it can be from a borrowed one from a friend or neighbor even. YOU HAVE BEEN WARNED.

Once inside the Recovery Console from C:\Windows>_ prompt type:

COPY C:\Windows\ServicePackFiles\i386\userinit.exe C:\Windows\System32

if that doesn't work (meaning that the file was not found) try:

COPY C:\Windows\System32\DLLcache\userinit.exe C:\Windows\System32

and if that still doesn't work (still not found), try:

COPY C:\Windows\$NtServicePackUninstall$\userinit.exe C:\Windows\System32

Always leave a space between .EXE and C: And this time it IS .EXE not .EX_

Hope that helps more people having trouble to find this file. PRBatman

If that happens then your CD drive is not E:, try using D: or F:. But you really don't need to navigate to the CD in order to put a copy of userinit in your hard drive. Just type: "EXPAND E:\i386\userinit.ex_ C:\windows\system32" without the quotes and just change the letter to D: or F: if it doesn't work with E:, then type EXIT and the computer will reboot immediately.

Hope that helps. PRBatman

Hello Colasus,

I have several questions: Can you get into the Windows recovery console? Did you try the last resort method to copy the file from the hard disk itself using one of the 3 different locations I gave you? Here are the instructions again:

Once inside the Recovery Console from C:\Windows>_ prompt type:

COPY C:\Windows\ServicePackFiles\i386\userinit.exe C:\Windows\System32

if that doesn't work (meaning that the file was not found) try:

COPY C:\Windows\System32\DLLcache\userinit.exe C:\Windows\System32

and if that still doesn't work (still not found), try:

COPY C:\Windows\$NtServicePackUninstall$\userinit.exe C:\Windows\System32

Always leave a space between .EXE and C: And this time it IS .EXE not .EX_ 

Hello Melling,

That means that you DO have an administrator password. It needs the same administrator password that you use to get into Windows when you log in as administrator. Try using that password. If you don't remember it or you still can't get in, then you are going to have to search for a method or program in the internet to reset that password so you can get in without it into the Recovery Console.

Also when you are booting up the computer keep hitting F8 to go to the Windows Boot Menu to see if you have the Recovery Console already installed in the hard disk so you dont need to use the Windows CD. Usually when you use the Recovery Console from the hard drive, you don't need a password.

Good luck!

PRBatman

Hello Citizenx,

Type:

EXPAND E:\i386\userinit.ex_ C:\windows\system32

Please notice that it is .ex_ NOT .exe and there is a space between _ and C.

If you get an access denied message enter the following command on C:\Windows>_ prompt:

SET AllowAllPaths = True (leave a space before and after the equal sign)

Then try the EXPAND command above again.

Good luck !


PRBatman

Hello Bry,

If you get a "can't read from disk" error, then your drive lens could be dirty or your Windows CD could be damaged.

Depending on your computer brand, the boot menu is accessed differently. Usually, all brand-name computers will boot up from the CD/DVD-ROM when they detect that is inside the drive. Computers like HP and Compaq can be forced to be booted from any drive when you press [ESC] really quick when you get the boot up screen for about 2 seconds where you also get the choice to press F10 for the BIOS setup. Other computers may use F1, F11, F8, etc. It all depends on the brand or if they are home-made clone PC's.

Anyhow if you can't still get to boot from the Windows CD, then your other choice is to enter your Motherboard BIOS when turning on the computer, by usually pressing, F10, F1, [DEL], [CTRL-DEL], etc. Look into your computer's manual to see how to get into the BIOS. Once in there, look for the option to change the booting order of your Hard and CD drives. Make the CD/DVD the first, second your hard drive or another CD/DVD drive and third your hard drive if you had 2 CD/DVD's drives. That will force the computer to boot from the CD/DVD drive first.

I have to also bring to your attention that when you boot from the Windows CD, you get a message on top of the screen saying: "Please press any key to boot from the Windows Setup CD....." If you don't press anything in about 5 seconds, Windows will not load the setup and will skip to the normal boot-up sequence from the hard disk. That might be why you always go back to the normal boot-up process and log-in screen.

I assume that you were able to log into the Recovery Console. Anyhow, first of all try to do it from C:\windows>_ (i will be assuming that your CD drive letter is E:, switch accordingly to D: or F: and make sure that you have your windows CD inside the drive already).

Type:

EXPAND E:\i386\userinit.ex_ C:\windows\system32

Please notice that it is .ex_ NOT .exe and there is a space between _ and C. If you get an "access denied" message enter the following command on C:\Windows>_ prompt:

SET AllowAllPaths = True (leave a space before and after the equal sign), then try the EXPAND command once again.

A second option for people who can't read from their CD drives or their Windows disk is damaged or they have a computer like an HP or Compaq that has the Windows pre-installed and came with no Windows CD, is to get userinit.exe from the from within the same hard disk. It can be from the pre-installed recovery partition which is usually D: or it can be from within the C:\Windows> folder, since Windows keeps its own backup copies when installing and upgrading Service Packs, etc. The only problem with this method is that those copies might be also be infected if you have or had a virus infection in your computer, as some trojans affect only .EXE files. Do this at your own risk and as a last resort to get into windows. The best way is to get a fresh copy of userinit.exe from a Windows CD-ROM; it can even be a borrowed one from a friend or neighbor. YOU HAVE BEEN WARNED.

Once you are inside the Recovery Console at C:\Windows>_ , type this to give you access to all drives and folders:

SET AllowAllPaths = True (leave a space before and after the equal sign)

Then type:

COPY D:\i386\userinit.exe C:\Windows\System32

If that doesn't work (meaning that the file was not found) try:

EXPAND D:\i386\userinit.ex_ C:\Windows\System32

If that doesn't work (meaning that the file was not found) try:

COPY D:\i386\System32\userinit.exe C:\Windows\System32

If that doesn't work (meaning that the file was not found) try:

EXPAND D:\i386\System32\userinit.ex_ C:\Windows\System32

If that doesn't work (meaning that the file was not found) try:

COPY C:\Windows\ServicePackFiles\i386\userinit.exe C:\Windows\System32

if that doesn't work (meaning that the file was not found) try:

COPY C:\Windows\System32\DLLcache\userinit.exe C:\Windows\System32

and if that still doesn't work (still not found), try:

COPY C:\Windows\$NtServicePackUninstall$\userinit.exe C:\Windows\System32

Always leave a space between .EXE and C: And notice that sometimes is .EXE and sometimes .EX_

Hope that helps you and other people having trouble to find this file. By the way, the same method can be used to replace other important files for booting up Windows XP like explorer.exe, winlogon.exe, svchost.exe, spoolsv.exe, etc.

PRBatman

Stummped:

A trojan like the non-destructive but infamous W32.Virut.## (the ## is for the version or mutation) is estimated to have infected up to 30% of the PC's in the world and half of the people don't even know it. My Grisoft AVG antivirus didn't even see it when I got infected with it last February. This trojan will infect all of the .exe and .scr files in your computer faster than a common cold in a day care center. So even if you place a fresh copy of any .exe from a CD back into your hard disk, IT WILL GET INFECTED AGAIN. When the .exe's get infected they place a rootkit inside NTDLL.DLL to modify its coding to take control of all the network section of your computer and make it dial some bogus servers owned by the creator of the virus somewhere in China. That way the hacker will zombify your computer and take control over it and theoretically have access to all the information stored inside.

I recommend you download and install the best free Anti-virus software out there that effectively detects W32.Virut.## and every virus and trojan out there: Avira AntiVir; goto www.free-av.com. Goto options first, pick to use smart detection, set heuristics to medium or high, pick to run all the recommended extensions, all recommended disk areas, compressed files, etc. Put in the Automatic test to quarantine. This will remove the infected files but will give you the option to put any back where it belongs in case is an important file for Windows to work. Also run the RootKit finder test.

It is not recommended to run Avira Antivir from the infected hard disk nor from your computer so you don't get infected also. Instead, you should make a Universal Boot CD for Windows XP (you didn't mention if your friend has Windows XP, but I'm assuming it is since you landed in this thread) and include the Avira Antivir when you burn the disk. Another choice would be to boot the UBCD for Windows XP and then run the Avira Antivir from a pen drive. The idea is to isolate the hard disk so the infection doesn't keep spreading. The hard drive becomes sort of a slave drive. After you run Avira for the whole drive, turn off the computer totally for 10 seconds, including turning the power supply switch off on the back or unplugging it from the wall. Some trojans are known to reside in memory and survive a reboot and even survive more than 5 seconds after turning off the computer (I know, it sounds like a science fiction/SkyNet sort of thing, lol). After that, boot in to UBCD again and do a second scan again of all the hard disk to make sure it is totally clean.

After this, you can try to extract again from the Windows XP CD userinit.ex_, svchost.ex_, explorer.ex_, winlogon.ex_, spoolsv.ex_ all to C:\Windows\System32>; if you get access denied enter: SET AllowAllPaths = TRUE at the prompt. (leave a space before and after the equal sign). Try to see if you can log in to Windows XP again. If you can't, then I recommend to do a repair install. Boot with the Windows XP CD, then don't enter the repair console. Press to install Windows, then press F8 to accept the EULA and then the #1 option should be to repair the current detected windows installation. Hopefully that should fix and replace most of the files that were deleted by the antivirus. That will not change any shortcuts or alter any of the programs installed in your friend's disk. But copy or expand the files I mentioned before anyhow prior to doing the repair installation because sometimes they dont get copied back into the disk automatically.

Hope this info works and you can get that computer going again. Good luck.

PRBatman

PnPonboard · Answer

Ultimately you have to take it to someone with the tools to fix this problem. Different Viruses do different things. One makes the OS logon then log off. Others will just want your credit card information. So With that in mind Take to someone that can do the problem solving. Never TAKE IT TO GEEK SQUAD. I'm telling you this for your own good. If you want all your pictures and files intact don't take it to them.


As it was posted before This link works  I just used it today, and now I'm removing the virus that messed with the computer.  I had to use ERD or Another Alternative OS to get into the regedit. 

I cannot recommend you doing this yourself if you have not done regedit before. Please save yourself the hassle and take to a well known good PC TECH. (someone with morals)

https://docs.microsoft.com/en-us/troubleshoot/windows-server/user-profiles-and-logon/cannot-log-on-windows

alice · Answer

pc Won't accept my password!!!!!!!!

Pc logs on then off again

32 responses

Similar discussions

Subscribe To Our Newsletter!