XP Logs Off Immediately When I Log On

[brvheart]

My computer just started popping up windows alerts saying the computer was infected so I restored the computer to a restore point yesterday. All was well after that. Then to be cautious I ran Spybot S&D and AdAware scans. One of the AdAware alerts prompted a restart so I did.

Now when I click on my user (the only user) to log into windows, it immediately says logging off, and goes right back to the login screen. It does this every time now.

Any ideas??

[Panama Red]

Can you boot to Safe mode? If so, boot to Safe mode with Networking and install Malwarebytes. Update it and run a full scan.

[brvheart]

I somehow missed a thread when I searched earlier where several people are having the same problem. It's something Adaware does when removing some files that causes it. This link has the fix: http://www.opentechsupport.net/forum...c/20552-1.html

But I may need someone to explain what to do in laymans terms for me. It says to COPY userinit.exe to wsaupdater.exe in the recovery console. I'm in the recovery console, I just don't know exactly what the command will look like when I type it.

It would be easier if I could do it in safe mode, but I can't get there by pressing f8 at startup like I normally would..

[brvheart]

I'm bumping back up because I think I may have been misleading on my last post. I did find the "solution" on another site, but I don't know how to make it happen. You have to go into the recovery console and do this:

COPY userinit.exe to wsaupdater.exe. (overwrite wsaupdater.exe if needed - DON'T RENAME userinit.exe, you might need it later on, see further).

My problem is, I don't know HOW to do this in the recovery console at the prompt. I could do it in the registry if I could log into windows, but I'm not very skilled at the prompt in the Recovery Console.

Can someone please help me with this? I will probably have to be told exatly what to type in!

I have cut and pasted the complete explanation below for how to fix this..


_______________________
Very easy solution.

Problem: Computer Logs off out when you login
Cause: Search Assistant (search bar aside the clock in windows)

3 Steps.

1.- Get into the recovery console (with boot disks, you can get them from microsoft page).

2.- Get the file userinit.exe from another NOT INFECTED computer. (located in windows/system32 folder)

3.- Overwrite the userinit.exe original file (from the infected computer) with the new one (use a cd or disk to transport it) (COMMAND: COPY e:/userinit.exe c:/windows/system32/userinit.exe)

4.- Rename the userinit.exe to wsaupdater.exe

5.- Exit and ENJOY.
___________

You can get the "best and fastest solution from rcmcom" even faster.
Especially if you don't have a userinit.exe from another computer at hand.

Just skip step 2 and 3!
As far as a know userinit.exe did'nt get infected at all.
Just COPY userinit.exe to wsaupdater.exe. (overwrite wsaupdater.exe if needed - DON'T RENAME userinit.exe, you might need it later on, see further).

[In my case adaware deleted wsaupdater while this file was still registered as the winlogon-key in the registry, causing windows to logoff immediately after login.]

Reboot and see if it works.

Later on you can use the fix of rib0n to clean the registry.
___________________________________

[glc]

That is incorrect - you use a backslash (\), not a forward slash (/).

Try this - boot to the recovery console and log in. You should be at a c:\windows prompt. Type the following:

cd\windows\system32

You should be at a c:\windows\system32 prompt.

copy userinit.exe wsaupdater.exe

Allow it to overwrite.

Type exit and allow it to reboot, pull the CD.

[brvheart]

Thank you so much!

I'm back up and running. It took a little extra work, I had no userinit.exe file on the computer at all, but I was able to get it off of another computer. It went basically like the first solution I pasted above. But of course the commands are wrong as glc pointed out.

I use the command prompt just little enough to always forget everything I previously learned..