Windows login logout session

bullsabs Posted messages 8 Status Membre -  
 Fred QC -
Hello everyone

I have a small problem to bring to you, who can help me, please?

When I start a Windows XP session by clicking on my user icon, my session opens for a quarter of a second and immediately disconnects. I therefore no longer have access to my PC?
I have already repaired it with the original XP DVD but the same problem comes up every time.

Who could help me solve this problem?

Thank you

Bullsabs

64 réponses

  • 1
  • 2
  • 3
  • 4
pcweb
 
Problem solved

In short, a virus can erase the value of the registry or delete the userinit.exe file (virus BlazeFind for example)

Solution:
1) The problem often comes from the removal of spyware (blazefind or hijack), which modifies the registry (HKeyLocal Machine\SOFTWARE\Microsoft\WindowsNT\Current Version\Winlogon) by adding or replacing Userinit.exe with wsaupdater.exe.
So if you delete this file, XP cannot find the file to log in.

2) Solution: first, in console mode, copy the file c:\windows\system32\userinit.exe to wsaupdater.exe
3) log in and modify the above key with regedit as follows:
HKeyLocal Machine\SOFTWARE\Microsoft\WindowsNT\Current Version\Winlogon: replace the content with "userinit.exe
If console mode scares you, you can always mount your disk as a slave in another PC to copy this file.

In my case, the file was present but the value of the registry key was empty, so I gave it the value userinit.exe and everything is fine, sorry for those who formatted and good luck to the others....
8
brigitte
 
Hello,

I'm not very good with computers, so I'm sorry, but the solution is really too technical for me.
Could you help me by guiding me step by step? It bothers me to go to Darty or elsewhere and pay €200...
Here’s a summary of my problem: I got infected by the MSN virus "masi que fait ta photo sur ce site."
And three days later, I can't open my session; it logs me out every time before I have a chance to reach my desktop.
I would also like to back up my data because, like an idiot, I haven't saved anything, and there are photos of my baby!

Thank you for your help,

Brigitte
0
pcweb > brigitte
 
The situation is easy to resolve, so go ahead and print the solutions on this page and take them to your IT technician so he doesn't spend hours searching for the problem and the solution. If he’s really good, he should be able to fix everything in about an hour, no more. As for your photos, they are probably not lost; for now, you just cannot access Windows, but all your personal data is still present on your hard drive. Don’t let anyone format your computer, as that is not the right solution, and you will lose your photos in the process. You just need to follow the steps I posted.

If I'm sending you to see an IT technician like me, it's precisely because it's very technical, and explaining all of this in a step-by-step guide for average Windows users is like teaching a three-year-old boolean mathematics and combinatorial logic.

If you live in Quebec, however, I could help you since I’m physically there and I have all the necessary software.

Good luck!
0
gutistef
 
Hello, I don't quite understand the replacement of userinit.exe with wsaupdater.exe in system32...

Could you explain that to me in more detail? I have the same problem on a friend's computer.
Thank you in advance.
0
pcweb > gutistef
 
OK to clarify the situation regarding the replacement of the userinit.exe file by wsaupdater.exe.

There is an operating system on your computer called Windows, which requires a multitude of different files (like userinit.exe) to function.

To be able to operate all these files, we need a logical structure, meaning a place where all the necessary information regarding your computer's hardware, user information, and information about the location of files required for the functioning of Windows is stored; we call this the Registry.

Since each computer has parts from different manufacturers and each user does not have the same desktop background, for example, Windows must note all these different parameters, and it does so thanks to the Registry.

To log into a user session, Windows needs two things:

The first is a file named userinit.exe, which is generally found in the System32 folder.

The second is a Registry Key, for example, UserConnection = 'userinit.exe' (a fictitious key for example), and thus userinit.exe is the value of this key.

When you log into your user session, Windows checks the value of this key in the registry to determine which file to use for the login.

If either of these two things is missing (file or registry key & value), Windows will not be able to log in with a user session.

Situation__________________

In my first post, we talked about the BlazeFind Virus; it's an old virus, and I would be surprised if you were affected by it in 2008. It's more likely to be a newer worm-type virus that attacks your Windows Live Messenger from another Windows Live Messenger from one of your friends who has you in their contact list, and so on, it spreads across the web and bothers everyone (it's like World War III; it doesn't hurt, but everyone suffers similarly :)

So if I were the virus, I could reach you in several ways to create this anti-connection, either by deleting userinit.exe from your PC or by penetrating the registry and deleting the key that tells Windows to use userinit.exe.

But my dear brilliant and malicious programmers have something better for you:

The virus replaces the userinit.exe file with wsaupdater.exe in the System32 folder and tells your registry to have Windows use the wsaupdater.exe file to log in, so the key UserConnection = 'userinit.exe' (a fictitious key for example) changes to UserConnection = 'wsaupdater.exe' (a fictitious key for example).

So if your antivirus encounters the 'wsaupdater.exe' file (a virus-infected file that records your user passwords, for example) on your hard drive, it will delete it or probably quarantine it, and at that moment, Windows will refuse any connection despite itself because the registry now tells it to use a file that is no longer present on the hard drive for user connections.

That's what this nasty BlazeFind was doing.

Currently, all computers that have this problem have not had file modifications; the virus simply deletes the value of the userinit.exe key in the registry, so UserConnection = 'userinit.exe' (a fictitious key for example) becomes UserConnection = ''empty'' (a fictitious key for example).

Then Windows goes "crazy" and doesn't know how to connect a user anymore.

I hope I have clarified some points for some.

Eric D.

I wish you good luck :)
0
Freud
 
Hello.
When you say to copy "copy the file c:\windows\system32\userinit.exe to wsaupdater.exe ", I'm having difficulty understanding. Isn't it more like replacing? Or maybe there's a specific command line to type? (I've never used the console mode so far)
Thank you.
0
mix51 Posted messages 6 Status Membre 1
 
Hey, I just had this problem on my laptop yesterday when I got up (great ...) and it's really because of MSN. A window said "someone has posted your pic on this site" and I, like an idiot, clicked it. Now, three days later, I enter my password to log into my account and I get logged out right away. I'm not very good with computers, I'm trying to follow the information from pcweb and scrat34, but I'm having a bit of trouble. Is it necessary to dismantle the laptop to test the hard drive on another PC?
1
Anonymous user
 
No, it is not necessary to remove the hard drive from the computer; it is only for those who have difficulty obtaining a virtual OS (such as Ultimate Boot CD, Iron Boot CD, etc.) and then modifying the registry.
0
Yann (Paris)
 
Hello everyone,

I have a login problem on a workstation at the agency where I work.
Thanks to a live CD (UBCD4W), I was able to check the integrity of the userinit key by loading the hive of my faulty system, and I also verified the presence of the userinit.exe file in my system folder.
Thinking that I might have an integrity issue with this file, I replaced it with the userinit from my healthy workstation.

After a standard reboot, my problem persists: I can't log in either locally or on the domain. Safe mode has the same issue.
MSN Messenger is not installed on this machine.

I cannot afford to completely reinstall the workstation due to the presence of very expensive specific software that requires the intervention of an outside technician for installation (which is charged very highly).

Thank you for your help.

Yann
1
fred
 
Hello
I'm in the same situation as you, I can't find a solution and I would like to know what the cause of this problem is...
Thank you for your advice
0
pcweb
 
I also have the same problem and for now no solution :(
0
wood
 
I have the same problem... I'm starting to bite my nails down to the bone!
HELP!!!
0
dam's
 
I have the same problem. What caused this breakdown? Is it MSN?
0
mik > dam's
 
Weird,

I just picked up my neighbor's PC and the problem is the same, Virus???
MSN is installed on the PC, do you have it too?
0
fred > dam's
 
Yes, MSN is apparently installed on the PC; it seems to be a virus, but I can't do anything.
0
Mïky'x
 
me too, I have the same problem, connection, disconnection, I'm going crazy! who can help us
0
mik
 
Good evening,

Well, I reformatted the disk, after investigation the virus might be Restarter.F from MSN (click on a photo)
http://www.secuser.com
the solution might be to test MSNfix

bye
0
mrlegnu
 
Heu, have you thought about a repair with a Gnu/Linux CD? There’s not just Windows in life... fortunately, otherwise we would be in a buggy world…
0
LOLO
 
Hello, I have the same issue with opening a session but I can't access safe mode.
If anyone can help me, thank you in advance
LOLO
0
pcweb
 
It's normal LOLO not to be able to connect in safe mode, because with this problem Windows doesn't know how to log in users regardless of the attempt.

It's frustrating, but I got through it and my client was very happy.

Good luck!
0
cybermarie > pcweb
 
Hello,
I have the same problem and I would like to solve it myself. With a bit more detail in your explanation, I hope to manage it.
Can you help me?
Thank you

mare
0
LOLO > pcweb
 
I managed to regain access to the PC by reverting to the original configuration. (Admin session)
The problem is that two of the users can find their personal folders, but two of them cannot.
I think they are still on the hard drive (volume), but I can't find them.
Is there a procedure to thoroughly explore the hard drive and thus retrieve my data?
Thank you
I really find this forum very rich.
LOLO
0
pcweb
 
For those who have no idea how to change the value in the registry without having to log in as a user on Windows, I used Ultimate Boot CD for Windows (it's a free software), you boot the computer from the CD-ROM and it then emulates an operating system that works without the need for a hard drive to operate.

Once booted:

In the system tray near the start menu, there's the quick launch area, just click on the registry editor icon (a light blue cube).

It will ask you if you want to open the Registry with a different username, do so and specify a username that has Administrator privileges or simply use the name Administrator.

Once the editor is open, look for the key ''HKeyLocal Machine_on_C'' the letter C represents the drive letter on which your Windows is installed. If you only find the key ''HKeyLocal Machine'' without the on_C, it means you are seeing the registry key of Windows that is on the CD-ROM and not the one on your hard drive.

A file explorer is also available on this CD-ROM, so use it to check that userinit.exe is indeed on your hard drive, as a good key value without the file being present is useless; you will have the same problem.
0
pcweb
 


*He will ask you if you want to open the Registry with a different username; do so and specify a username that has Administrator privileges or simply use the username Administrator.*

It's not a username; it's actually a file. There is a browse button. Sorry for my mistake in the solution... :(
0
morane62
 
Hi everyone.
I have the same issue on a colleague's machine. The winlogon and userinit files have been replaced with valid ones, and the registries are correct. Msnfix detected and cleaned 3 files. However, the login still goes into automatic disconnection mode.

For your information, when you want to use your machine without logging in (or when it doesn't work), you just need to reboot in 'command line safe mode', where the administrator login works and opens a 'cmd'. But you also have the option in this mode to do a 'ctrl alt delete' and thus go into the task manager. There, you simply go to the 'processes' tab and from the 'file' menu 'new task', you just need to type 'explorer' or regedit or any other command......Admire the result......

As for my problem, if someone can tell me what happens between winlogon, userinit, and the display or reading of the user profile, I might know which file is triggered to cause the disconnection.
0
schlouki
 
I also have the same problem on my computer
but my CD drive doesn't work so I can't
open the files from the original CD. What can I do?
Thank you in advance.
0
xuttor > morane62
 
Thank you for all this very useful information!
My question: I created a CD-ROM with UBCD4Win, it works fine, but when I reboot the PC with the CD-ROM and request to start in command-line safe mode with F8, Windows does not give me access to the command line. It goes directly to the login screen, which is useless since it disconnects automatically even with the admin user.
Do you have any ideas? Thank you for your help.
Eric
0
Dave
 
Hello
I am trying to use the UBCD software but I can't restart my PC in CD-ROM mode
Could you please tell me how to do it? Thank you
0
laura
 
Hello,

I have the same problem and I don't understand how to solve it either.
I got the Ultimate Boot CD for Windows software but I don't understand how to use it since my PC doesn't recognize anything anymore!!! Should it automatically boot when I insert it?
I can't call a professional and I would like a solution that is maybe a bit more detailed if possible.

Thank you in advance.
0
laura
 
Another thing...
I heard about Linux Live CD to recover my files. What is it and how does it work?
I need to recover some files pretty quickly and I'm worried about getting in trouble... :s:s
0
smouky
 
Hello, I had the same problem as Brigitte; I connected the HDD via USB to another PC to run MSNFix on it, but it didn't find anything. I reinserted the HDD into the tower, and I’m currently booting from a live CD to try the tips from pcweb. I'll keep you updated on how it goes!
0
smouky
 
pcweb could you contact me at bachelotg@gmail.com please, I have 2 or 3 questions to ask you, some little points to clarify =)
0
scrat34
 
Hello everyone,
thanks to pcweb for the information and I would like to clarify the process:
it is indeed this empty registry key
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Winlogon\userinit and it needs to be modified by putting C:\WINDOWS\system32\userinit.exe in place of the empty value

to access this key when the system won't start, there are 2 solutions:
1- connect the non-booting disk to another PC with an external case
launch the registry editor (regedit)
go to the HKEY_LOCAL_MACHINE branch
go to file and click on load hive
locate the registry file of the non-booting disk, you need to take the SOFTWARE file from \WINDOWS\system32\config of the non-booting disk
it will ask for a key name, you can put whatever you want
then simply go find the empty key in this branch: \Microsoft\WindowsNT\CurrentVersion\Winlogon\userinit
and modify it
unload the hive (file unload hive)
you can put the disk back on the PC and it will boot
2-you can use a Windows autoboot disk (like bouldows) and follow the same procedure as in 1

I tested it on a laptop and I had no issues
I then ran the MSNFix that can be found on www.secuser.com

the PC is working again and I haven't lost anything

hoping to have helped you
0
cybermarie > scrat34
 
Hello,
I was able to access the command prompt and replace the file as described by pcweb, but the session still doesn’t start, so it's not possible to access the registry...
What should I do?
Thank you

Marie
0
scrat34 Posted messages 11 Status Membre > cybermarie
 
Hi,
by following the method explained, you should be able to do it
if there is something you don't understand, ask the question
to be continued
0
WindowsVictim > scrat34
 
Thank you for these tips. I, who only use Windows out of necessity, struggled for a while before finding your post.
I followed the procedure carefully, and it’s fixed!!!
0
nokoutz > scrat34
 
Thanks to scrat34.
I caught this virus a week ago and since then I've struggled quite a bit searching for solutions until I stumbled upon this forum and this message 21.

I opted to boot from a bootable CD => UBCD4windows created on another computer, and then I just had to follow your instructions. For unloading the hive, you need to remember to go back to the key that you created specifically for this operation, and it's bingo.

Just one last question: How can we be sure that the virus responsible for modifying this registry key is no longer active on my computer?
0
gutistef
 
Scrat34,

thank you, it's great, it works very well!!!!
0
Domingo
 
https://www.casimages.com/i/0803190304482672329.png.html

Arriving here, I have no idea where to go, I can't see Winlogon?

Thank you in advance.
0
scrat34 Posted messages 11 Status Membre
 
What version of Windows did you use to have this setup?
If it's an autoboot Windows, you need to load the hive by going to File > Load Hive in regedit and follow what I wrote above.
0
D0mingo Posted messages 6 Status Membre > scrat34 Posted messages 11 Status Membre
 
Actually, I was on Ubuntu and I was using regedit thanks to Wine... so it must not be the regedit associated with Win XP, I suppose.

Anyway, I searched for where to find bouldows but I only found very long download links on Emule and torrent.

And I can't find the registry editor in UBCD...


I'm not very skilled at this :-(
0
cybermarie > scrat34 Posted messages 11 Status Membre
 
To create an Ultimate Boot CD, how should I burn it so that it boots from the CD? Should I burn the program as I downloaded it?
Thanks
0
scrat34 Posted messages 11 Status Membre > cybermarie
 
Hi,
for the ultimate boot, if you downloaded an .iso, you take Nero (or another program) and you go to file / open and you find your .iso and burn it
otherwise you download the .iso
however, I don't know all the programs in the ultimate and I don't know how to use it to perform the operation.
0
D0mingo Posted messages 6 Status Membre > scrat34 Posted messages 11 Status Membre
 
Arf...

And you don't have another software like Bouldows?

Plus, Ubuntu is acting up a bit... it's really not convenient.
0
Utilisateur anonyme
 
https://www.casimages.com/i/0803190304482672329.png.html

Arriving here, I have no idea where to go, I don't see Winlogon?
0
smouky
 
lol thanks scrat I've been waiting 2 hours to burn my ubcd I'm trying it right now!!!
0
morane62
 
You can also use the Avast Bart CD, all the necessary tools to recover the registry, files, etc.
0
forsail92
 
Hello Scrat34,

I also have this problem: connection/disconnection on a laptop. I extracted the hard drive and connected it to another PC. Apparently, in REGEDIT we have the database of the PC on which we booted. I suppose that the "load hive" operation allows loading another registry? I have 2 SOFTWARE files: software.??? and software.txt. I took the first one but I don't feel like much is happening. In fact, when I go to the key it is not empty and "unload hive" remains grayed out. How can I be sure that the registry from the infected hard drive is loaded? Do I need to be in administrator mode or is a user account with admin rights enough?

Thank you in advance.
0
scrat34 Posted messages 11 Status Membre
 
Hi,
I don't know if you need to be an admin or not, but if you take the correct software file (in \WINDOWS\system32\config, it's the only one without an extension) it should ask you for the name you want to give to your new branch.
If it doesn't ask you anything, it means the file you took is not the right one.
In my folder, I have 3 software files:
1 without an extension, about 20MB (that's the one to take)
1 with a .log extension
1 with a .sav extension.
0
D0mingo Posted messages 6 Status Membre > scrat34 Posted messages 11 Status Membre
 
Good evening
I finally managed to find Bouldows, but at a certain level I don’t understand:

you just need to look for the empty key in this branch: \Microsoft\WindowsNT\CurrentVersion\Winlogon\userinit


Are you talking in the continuation of the HKEY_LOCAL_MACHINE branch or another one?
0
scrat34 Posted messages 11 Status Membre > D0mingo Posted messages 6 Status Membre
 
Good evening,
you go to the HKEY_LOCAL_MACHINE branch, you click on File, Load Hive and you take the "software" file from the windows\system32\config folder from the infected drive
it will then ask you for a new branch name and it is on this new branch that you change the userinit key.
0
D0mingo Posted messages 6 Status Membre > scrat34 Posted messages 11 Status Membre
 
Weird, when I did that, I couldn't find userinit in that branch.
0
forsail92 > scrat34 Posted messages 11 Status Membre
 
Good evening,
Thank you, that's great, it works perfectly, I just didn't understand that I needed to explore the new branch. Problem solved in 10 minutes and I'm far from being a pro.
0
didi
 
Hello everyone

ERD Commander does this well; it's a maintenance live CD that you need to boot from, and this way, access to the infected PC's registry can be easily modified.
0
schlouki
 
I also have the same problem on my computer
but my CD drive doesn't work so I can't
open the files from the original CD. What can I do?
It's frustrating, I don't know what to do anymore.
Do you have a solution?
0
forsail92
 
The best solution would be to remove your hard drive, connect it to another PC without booting from it, and use solution 21 from SCRAT34. It works perfectly.
0
  • 1
  • 2
  • 3
  • 4