Windows keeps logging me off.

[computergeek1]

Had a customer drop a computer off yestaday with virus problems, he had been on the porn sites, I slaved the drive to another computer and cleaned up the virus, now when i log in normal mode or in safe mode it keeps logging me off, i have searched google and find this soloution and does not work
put your XP cd into the machine and go to the recovery, then enter CD SYSTEM32, then type COPY USERINIT.EXE WSAUPDATER.EXE, then says the system can't find the file specified, I have tried a few things but nothing has worked, problem seems to be winlogon userinit been set to wsaupdater.exe instead of userinit.exe.
can anyone sugguest anything else i can try before i do a nuke and pave.

 

[drewster]

Sure, often viruses may affect userinit.exe and winlogon.exe

Copy known good versions of these files from a clean system to the affected computer and you may get back into windows.

 

[Methical]

Did you try SFC ?

 

[Doctor Micro]

as above, then in recovery console, bootcfg /rebuild. If you want, throw in a fixboot, chkdsk /r, and fixmbr just for good measure.

 

[computergeek1]

Did you try SFC ?

What's that?

 

[drewster]

How does one run SFC on a system that doesn't boot into the OS?

 

[Doctor Micro]

What's that?

You're kidding, right?

 

[computergeek1]

You're kidding, right?

Yes ha ha, not yet.

 

[Methical]

System File Checker

I would do what Doctor Micro said; just to be on the safe mode. And might as well cover all basis while your in the recovery console as well.

 

[computergeek1]

as above, then in recovery console, bootcfg /rebuild. If you want, throw in a fixboot, chkdsk /r, and fixmbr just for good measure.

Okay thanks for that, will try that in a bit, will post back and let you know if it worked.

 

[iisjman07]

Replacing the file will not always work, as even though the file may be legitimate, the registry key pointing to the file may be corrupt. Assuming you have already replaced the file 'userinit.exe',

1)Use UBCD4WIN Remote Registry and navigate to: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Winlogon]

2)In the right-pane, change the value of Userinit to

"C:\WINDOWS\system32\userinit.exe,"

*type the above value exactly as given, including the comma - exclude the quotes.

3)Close Registry Editor, unload hives if neccassery, and restart Windows.

 

[jbutler9]

Yes ha ha, not yet.

Unfortunately, I don't believe that you are kidding. I have read your other posts when it comes to computer repair, and your responses are indicative of someone trying to learn how to fix computers, instead of someone who knows how to fix them. These Technibble forums are not your personal learning tool.

In another post, you completely ignored good advice for purchasing a replacement CPU rather than purchasing a motherboard when diagnosing a laptop that doesn't turn on. Now you are stuck with a laptop motherboard that you may never use again. You can use a CPU many times in this situation. I think as a general rule, replacing a CPU first is the way to go.

Second, you have not posted in this thread all the troubleshooting steps you have taken. The only steps you have taken is to search the internet for a solution. The steps offered by the other members on this thread are steps you should have known to take before even popping on the internet. Not being able to log in could mean anything.

So this is why I believe that you are learning instead of knowing.

I am sorry but I someone has to call you on this. I would like for you to post or provide a link to your A+ certification or your Microsoft Transcripts (granted having MS certs is at least a beginning).

 

[angry_geek]

Before any of your steps, did you try system recovery from a boot cd?

 

[fingers]

sfc

How to run SFC with the scannow option

Click Start > Run and type sfc /scannow and the click OK.
Note the space between the c and the /
You may need your Windows XP CD so have it ready.
If you have Service Pack 2 (SP2) or SP3 installed, you will need the SP2 or SP3 version of the version of the CD. This can be done with a borrowed CD, if you don't have one.
Allow the scan to run and when completed, reboot the system.

 

[basic]

What's that?

SFC is System File Checker. It, essentially, checks your protected system files and "fixes" them as needed.

 

[gravator]

I would try a system repair and see if it fixes it. I have ran into this often and sometimes the system repair works for me.

 

[Davis Computer Services]

I am sorry but I someone has to call you on this. I would like for you to post or provide a link to your A+ certification or your Microsoft Transcripts (granted having MS certs is at least a beginning).

While I agree with you that he isn't the most experienced of techs and it seems he is learning on clients machines. I couldn't post an A+ cert or Microsoft Transcripts, as I don't have them. It isn't really a requirement when running a business for yourself.

 

[ComputerClinic]

What exact steps did you take to remove the infection? For serious infections, I like to use removal tools like ComboFix and SDFix. I would give ComboFix a try if you haven't already. If you could provide the exact steps you took to remove the virus, we could be more confident that the problem you are experiencing is a WINDOWS problem and not a VIRUS problem.

 

[computergeek1]

Thanks for advice, tried some of your sugguestings but none of them work, i had tried a lot of things myself and what other techs said but in the end the virus had done a lot of damage to the windows files, so i have reloaded windows and is all sorted now, people can question my experience as much as they like, i dont have qualifications like i have already said, if you don't like my posts then put me on your ingnore list, like some people have done already.

 

[iisjman07]

Probably a file infector like 'virut' or 'sality'