MS antispyware 2009 won't let a user log on Windows, Logging on ca

[leoliver]

Hi Everyone,

I have a friend with Windows Home Edition SP3 , on his Sony computer. He is infected by MS antispyware 2009 , and a pop up window appeared telling him he had to restart his computer ,because he had just installed new hard- ware and the software with the new hard ware wouldn't work right unless the computer was rebooted. But he never had installed new hard ware , but he went ahead and restarted because he thought a restart my remove the MS antispyware 2009 pop ups.

But after restarting he was unable to log on his user settings. After Windows rebooted , his log on screen appeared and when he clicked on his "Log On Icon" his desktop wall paper would appear but no desktop icons. But then the log on process stopped and Windows starting logging him off. And no matter how many times he restarted, and tried to log on , the result was the same , logging on went immediately to log off.

I tried to go to the boot menu , by holding down F8 during the restart process , but the boot menu screen would appear for just a second and the restart process continued to boot into Windows. He had a Norton Anti-virus CD , which I inserted and restarted and his system read the Norton disc. After booting to the Norton CD , I ran a scan which only scanned the MBR and it said that the MBR was clean. And I couldn't see how to boot to Safe mode on his system . I tried holding down either F11 or F12 , but in neither case did the option to boot to Safe Mode appear.

Or what options do I have since MS antispyware 2009 prevents anyone from logging on the computer?

Feedback will be appreciated !

Thanks.

[macgyvr]

Hi Everyone,

I have a friend with Windows Home Edition SP3 , on his Sony computer. He is infected by MS antispyware 2009 , and a pop up window appeared telling him he had to restart his computer ,because he had just installed new hard- ware and the software with the new hard ware wouldn't work right unless the computer was rebooted. But he never had installed new hard ware , but he went ahead and restarted because he thought a restart my remove the MS antispyware 2009 pop ups.

But after restarting he was unable to log on his user settings. After Windows rebooted , his log on screen appeared and when he clicked on his "Log On Icon" his desktop wall paper would appear but no desktop icons. But then the log on process stopped and Windows starting logging him off. And no matter how many times he restarted, and tried to log on , the result was the same , logging on went immediately to log off.

I tried to go to the boot menu , by holding down F8 during the restart process , but the boot menu screen would appear for just a second and the restart process continued to boot into Windows. He had a Norton Anti-virus CD , which I inserted and restarted and his system read the Norton disc. After booting to the Norton CD , I ran a scan which only scanned the MBR and it said that the MBR was clean. And I couldn't see how to boot to Safe mode on his system . I tried holding down either F11 or F12 , but in neither case did the option to boot to Safe Mode appear.

Or what options do I have since MS antispyware 2009 prevents anyone from logging on the computer?

Feedback will be appreciated !

Thanks.

Actually, I've been dealing with this for customers for several days, and the "Antispyware 2009" isn't the reason for the logging off right after logging in...rather something that tried to FIX the problem has caused it. I can definitely say that AdAware is one tool that will cause this problem (through no fault of its own) by trying to remove another problem. Basically, you have a file ... userinit.exe ... that has been altered or removed entirely from the computer. A repair tool may have removed it because it was infected, and you will need to replace it if so, and at the same time, the entry for this file may have been altered in the registry, and that will need to fixed too.

First, boot on an XP disc and go into the recovery console. There, look in c:\windows\system32 for userinit.exe. If the file is there, copy it to wsaupdater.exe (same location). If the file is NOT there, you will need to get it from the windows cd using the Expand command (you can google how to do this).

Now, restart. At this point, you should be able to log in...but you're not done yet.

Go into regedit, to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon. Look for a key called userinit. The value should be c:\windows\system32\userinit.exe (the path might change depending on how you installed windows). If the value is not correct, fix it.

Restart...install Anti-Malware from www.malwarebytes.org and do a "quick scan"....this will remove any other nasties from your system. You should also scan with your current, updated antivirus program (yes, scan with both). Once that is done, you should be fine.

[lordpake]

I tried holding down either F11 or F12 , but in neither case did the option to boot to Safe Mode appear.

Isn't F8 the usual key to tap when starting Windows, in order to be able to boot into safe mode?

[Tarun]

Please download my Anti-Malware Toolkit and get the Professional package. Then follow the directions in the PC Cleanup guide. After that, please post a HijackThis log.