Windows Automatically Logs Me off

Discussion in 'Malware Help (A Specialist Will Reply)' started by chattermaran, Feb 16, 2008.

  1. chattermaran

    chattermaran Private E-2

    First post, so please be gentle. Not sure if I have this in the right place but..
    Was struggling to get rid of Webhancer , Dcads, Mysidesearch and something else I can't remember. Did a bit of DIY with CCleaner and Hijackthis, which seemed to fix the problem, even though the registry keys still appeared in Hijack this reports, albeit with no associated files. Shoulda left well enough alone. But then loaded Norman Malware remover and ran that to be sure-which picked up a few more remnants of other malware I didn't know I had. Good so far. Then I restarted the PC. Now, when I start the PC, I get to the logon screen-I log on, get to see my background-and then I get logged off again. This happens all all accounts, whether Admin or general user. Safe mode no help either; same behaviour.
    Running windows XP Home SP2, system is running two HDD in raid 0.
    I will be away from sick PC for a couple of days, so prioritise me accordingly.
    Thanks in advance
     
  2. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Welcome to Major Geeks!

    There is really not too much we can do to help you with any malware problems until you can get properly logged into Windows. It may be best for you to work the inability to login via our Software Forum; but I will get you pointed in the right direction.

    You are going to need your Windows XP Home SP2 boot disk. It has to be a bootable version of the Windows CD and not a factory recovery disk that restores you to the way your PC was shipped. If you don't have one, you either need to borrow one (the same version and type, that is WinXP Home SP2) or you will need to buy one. You need the bootable CD to get to the Windows Recovery Console where you can attempt to repair your problem. This problem can be cause by a couple of issues:
    1. Your C:\Windows\System32\userinit.exe file has either been deleted or is corrupted.
    2. The registry key that loads userinit.exe at startup has been deleted or has been modified and the userinit.exe file is not in the key and therefore does not run.
    The respective fixes would be:
    1. boot to the recovery console and copy the userinit.exe file from your CD to the C:\Windows\System32 folder of your hard disk
    2. Run this procedure: How to recover from a corrupted registry that prevents Windows XP from starting
    There are other method that are sometimes used where people create Linux boot CD or using Ultimate Boot CD Windows (UBCDWin - which still requires your Windows CD to make this CD) however this is outside the scope of the Malware Forum.
     
  3. chattermaran

    chattermaran Private E-2

    Thanks chaslang but I was not clear. After I finished messing with Hijackthis and CCleaner, the PC started and stopped OK and I could log on and off. Did this several times in fact to see if the unwanted registry keys were coming back at startup. PC ran OK too. The log in immediate log off only manifested at first start up AFTER running Norman Malware remover-I wonder if the Malware remover removed more than the malware? The version of Malware remover was pretty much at the date of my posting. 1) Wonder if you have heard anything of this behaviour with malware removers?
    2) Is it OK for me to repost to your software forum?
    Thanks again
     
  4. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Yes I understood this and I was still telling you what the potentional problems and fixes are and that is still the same. It does not matter how you got there.

    Not recently but things like this will happen especially if malware gets in that infects the userinit.exe file or the registry key associated with it. Possibly an improper removal of an entry in the below registry key:

    Yes but the fixes will still be what I gave you. The other alternatives are a factory recovery (you loose everything you have) or a repair install/rebuild. Some one in the Software Forum should be able to help you with this. You should reference this thread by copying and posting in the below which will link them here:

    http://forums.majorgeeks.com/showthread.php?t=151854
     
  5. chattermaran

    chattermaran Private E-2

    Thanks for that chaslang but more questions:
    1) I mangaged to get to the recovery console. (this involved a bit of messing about getting a hold of raid 0 drivers which explains my delay in responding). My userinit.exe file is timestamped 08/04/04-does this give any confidence one way or another that the the userinit.exe is uncorrupted?
    2) I used a XP homeSP2 disc (not a factory restore item) to get to the recovery console, but could see no userinit.exe file on it. Could a boot disc from the ultimate boot CD do the trick?
    Thanks again
     
  6. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    It tells you that the file is there but it does not prove that it is not corrupted. However I would bet the file is okay and that it is a registry issue which is the cause for your problem.

    I don't know where on the CD you were looking, but it should be in the \i386 folder of the CD; however it will probably be compresses into a file named userinit.ex_ Yes the underscore is correct. You would have to expand the file using the expand command. This is a topic for the Software Forum as already mentioned. But I still think your best bet is option 2 from my first message.

    Actually this UBCD4Win is more useful and can even make doing the registry fix from Microsoft easier.
     
  7. chattermaran

    chattermaran Private E-2

    Hi Chaslang
    Thanks for your help-UBCD4Win got me going and let get data since my last back up off. The Microsoft instructions you directed me to worked too so I could start the PC http://forums.majorgeeks.com/images/smilies/smile.gif
    :) I then executed "Read and run me first". I got as far as the end of Step 2 of the XP cleaning process (Found and repaired Webhancer with both Spybot and SUPERAntiSpyware-that was the only thing they found) Combofix and Mgtools run wasn't exactly clean, I disabled Norton Antivirus, but it came up again in the reboots and fought with Combofix and Mgtools but I got there. Ran Spybot and yep, no threats found. More smiles. Then ran SUPERAntiSpyware and got the attached.
    Understand the restore point detections should disappear with a system restore toggle, but concerned about the new detections-where do they come from?
    BTW, some of the MG tools logs contain personal information (eg user names)-if you need said logs for further diagnosis, is it OK if I replace names, provided I do it consistently?
    Once again thanks
     

    Attached Files:

    Last edited: Mar 2, 2008
  8. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Without the logs I cannot help you fix your PC. If you edit the logs then any place I need to give you a fix that refers to a path to a file may result in an automatic fix or registry patch not working. User names appearing in a log are really not issues. How is some one going to learn anything personal from just seeing a name in a log? However I do know that some people are just worried about this and my answer is that you should never have used personally identifiable user names to begin with which is mentioned in the below link in step 14:

    How to Protect yourself from malware!
     
  9. chattermaran

    chattermaran Private E-2

    Thanks, It wasn't just usernames it was files too. Anyway, I'll tidy things up on the PC so that when I pass you logs they will be unedited.
    In the meanwhile would you care to comment on why more spypare was found the second time round I ran the scanner-its just kinda puzzling.
    Also noted that DCADS adware pop ups come up on Firefox (V2.0.0.12), but not on IE.
    Cheers
     
  10. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Without seeing all of your problems it is hard to comment. However some malware's sole purpose is to install more malware. Thus over a period of time, more and more can be found. Certain malware gets quite annoyed ;) when you try to remove it and if you don't get all of it at once, they slap your hand by mutating and spreading even more. And in addition to above, some malware will automatically spread each time you powerdown or powerup (this includes just rebooting).
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds