Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Logged off before fully logging on


  • Please log in to reply
5 replies to this topic

#1 Fly CHiCA

Fly CHiCA

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:01:28 PM

Posted 07 February 2009 - 12:36 PM

I have a Windows XP HP laptop. I was running a virus scan with Malwarebytes as soon as signs of viruses started to show, but my computer star acting weird so i just turn it off . So, then i turn it on again and I tried to log back in & It played the logging in music sound, and I was only able to see my desktop wallpaper for a few seconds before it logged me back out again. I tried using Safe Mode but it does the same thing.

-; what can i do please?

BC AdBot (Login to Remove)

 


#2 hamluis

hamluis

    Moderator


  • Moderator
  • 55,733 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:02:28 PM

Posted 07 February 2009 - 12:47 PM

IMO, the inability to complete a malware scan could be a sign of infection.

I would try to connect the removed drive...to another system with a reliable AV program which could be used to scan the drive for possible malware issues.

Louis

#3 Cirdan

Cirdan

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:02:28 PM

Posted 07 February 2009 - 08:10 PM

Do you have Spybot installed?

#4 Fly CHiCA

Fly CHiCA
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:01:28 PM

Posted 08 February 2009 - 12:55 AM

IMO, the inability to complete a malware scan could be a sign of infection.

I would try to connect the removed drive...to another system with a reliable AV program which could be used to scan the drive for possible malware issues.

Louis

so you thinq is a malware

Do you have Spybot installed?


noo why?

#5 hamluis

hamluis

    Moderator


  • Moderator
  • 55,733 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:02:28 PM

Posted 08 February 2009 - 09:06 AM

To be honest...I don't know what to think.

When I am confronted with a "computer mystery", I just try to go about eliminating possible causes...not necessarily trying to pinpoint "the cause", since that is quite difficult when dealing with such. For me, it's a process of eliminating the obvious and (hopefully) thereby being able to resolve the factors that contribute to my momentary inability to have the system function properly.

Malware being what it is...and users being what they are...it makes sense to me to eliminate that as a suspect as quickly as possible. Then I can go on to other things (operating system, hardware, file corruption/damage, etc.). IMO, the complexity involved in a computer system mandate this approach by me.

I try to be logical in approach and use the tools provided users to attempt resolution. Malware detection and defense programs are one of these tools.

Louis

#6 Cirdan

Cirdan

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:02:28 PM

Posted 08 February 2009 - 04:01 PM

There was a problem with a Spybot false positive which resulted in the registry value of userinit being deleted. The symptoms were similar to yours-- login was never completed before being returned to the logon screen.

Guidance that may help you to regain control of your computer is detailed in this Spybot blog.

After you have control of your computer, you will want to check the registry value of HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit. Follow these steps: Start>>Run>>regedit>>OK, then navigate by clicking on the + of each item in the registry hives to expand. For Windows XP, the value should be "c:\windows\system32\userinit.exe,". (Make sure to include the trailing comma.)

If the userinit value is missing or points elsewhere, then it is possible that a virus has changed the value. Make sure to fully check for malware. This is easily most easily done by submitting a HJT (HijackThis) log to the appropriate forum. There will be instructions within that forum on how to create and submit the HJT log.

Alternatively, hP support may be able to guide you through a "backdoor" restore which would take care of your problem. You might want to check with hP before you try the solutions outlined in the Spybot blog/forums.

Edited by ragergle, 09 February 2009 - 10:28 AM.





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users