Computer loads personal settings and then logs off instantly
Sounds like a malware issue I've seen before:
XP logs user off immediately when the user tries to log in - can't get to any desktop
Allegedly 3rd party advertising software Blazefind (homepage and searchbar highjacker)
Boot to the Windows XP CD (RAID systems will need the RAID driver floppy during the bootup - hit the F6 key when directed in the bottom message).
Enter the Recovery Console by choosing 'R' at the Welcome to Setup screen.
Choose the OS shown (1) and hit enter.
Hit enter for a blank password if asked for one. If this isn't accepted, make sure that the user is using the correct XP CD (using a PRO version CD for a HOME version install or visa versa will result in a password rejection. If the user has upgraded to PRO over a HOME edition, try booting the HOME CD). If the CD is correct, and the user can't produce the correct Administrator password, then a clean reinstall of the OS (with full data loss) becomes the final answer.
Assuming the user now sees a command prompt, type "CD %systemroot%\system32" (without quotes) and hit ENTER. Normally the %systemroot% default is "c:\windows\" but this depends on if the system defaults were kept or changed during OS installation, of course.
Type "COPY USERINIT.EXE WSAUPDATER.EXE" (again, without quotes) and hit ENTER. This makes a copy of "userinit.exe" and simultaneously names the new copy "wsaupdater.exe".
Type "EXIT" and ENTER. Remove the XP CD while the system is restarting.
The user should now be able to log in normally... but there is one more thing that needs to be done or the issue will repeat itself when the user runs his anti-spyware program again.
Once logged into an administrator account, click the START button.
Choose RUN from the Start Menu.
Enter "REGEDT32" in the OPEN window (notice there is no "i" in edit) and click OK.
By clicking on the + signs next to each branch, click through the tree in the left pane until you get to
Click on the WINLOGON folder in the left pane tree, so that it is highlighted.
Look for "UserInit" in the right pane. It should have a value of "C:\WINDOWS\system32\wsaupdater.exe," (yes, there is a comma at the end of the value). Double-click on "UserInit" and carefully change its value to "C:\WINDOWS\system32\userinit.exe,". Click OK.
Close the Registry Editor. Reboot. Fix is complete. Anti-spyware programs will probably identify and remove "wsaupdater.exe" but the system is no longer using it.
Jan 27, 2010 |
Dell Inspiron 6000 Notebook