Norton Internet Security / Norton AntiVirus

[efgraham]

I had recenty purchased Nortons AV 2009 and the program identified a MH690.A virus with high priority.  There were other lower priority threats.  The CPU usage was very high and it could not remove due to pending status.  I manually turned off the computer, and now when I loggin with password, it automaticly logs me off.  Is there another way to log on or am I froced to reformat? 

Edward

[yogesh_mohan]

Hi Edward,

You can try starting your computer in Last Known Good Configuration.

1. Restart your computer.

2. As soon as the computer starts, tap the F8 key about once per second until you see the Windows Advanced Options menu.

3. Use the arrow keys on the keyboard to select Last Known Good Configuration, and then press Enter.

4. Click Yes to proeed.

5. Check whether you are able to get into Windows.

Let us know the results.

Yogesh

[Rohit1gupta]

If last known good config fails try to boot in safe mode

try using both accounts, ur own and another 1 is there by default i.e. administrator.

Pls tell if both works or 1 work and other don't.

Then we may able to solve ur problem. 

[efgraham]

Nope, safe mode on Last known success, administrator or password does not work.  The same automatic log off procedure occurs. 

[yogesh_mohan]

This issue happens if the userinit key in the registry has been modified or deleted, this is the common location in registry:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

If you have Windows XP Cd, you can try to boot from it and then repair the Windows using Check disk utility. Boot your system from the XP CD. At the XP Setup screen press R to enter the Recovery Console. Select the installation you want to work with (Usually 1). Log on the the desired installation with the administratiors password. If you don't know the password you can try just hitting Enter. You should now be at a C:\WINDOWS> prompt. Type chkdsk \p and press Enter. When it completes, type Exit and again press Enter. Then restart the computer and remove the CD. Let us know whether you are able to start Windows. If you are still unable, then you may need to copy the userinit.exe (c:/windows/system32/) file from another computer to this computer using the same Recovery Console.

[efgraham]

Not successful. Another problem is that each time I boot up, I must manually turn off the computer again because the boot up just sit there and will not do anything in the BIOS start up. This pattern repeats one unsuccessful then one successful startup.  Thus after the repair and exit to restart it will not work, because I must force another restart and then it will erase the repaired settings. Is that what is happening?

Now, I copied to userinit.exe to cd and tried to copy from D: to C: via copy D: userinit.exe.   The copy does not support wildcards or directory copies.  How do you eject in DOS?  I accidently deleted usinit.exe in C drive and my other computer does not have this file.  Is usinit.exe important?

[Quads]

You could have had a Malware like "wsaupdater.exe" which when removed causes the login problem.

Userinit.exe is one of the files that is used to login a user into their account.  If "userinit.exe" is gone then when you click on your account you may get as far as seeing your wallpaper for like 2 seconds then you automatically get logged off.   This also happens in safe mode and for the Administrator account...........

You can use the Windows CD and do as Yogesh says to start the recovery console.

If you know you have a folder on the HD called "Service Pack Files" then, in the recovery console type with spaces

---

copy C:\WINDOWS\servicepackfiles\i386\userinit.exe C:\WINDOWS\system32

---

there is a space between userinit.exe and C:\.

In the recovery console when you first log in you shouyld start at C:\WINDOWS to see if you have the "Service pack files" folder type "DIR"  without "" to give you a list.

If it is the Registry entry is at fault as well or seperate as it is pointing to the wrong file or missing altogether, it is a lot harder to fix as "regedit" cannot be used without logging in unless you use a remote registry programs 

Here is a page with 2 programs with screenshots http://www.raymond.cc/blog/archives/2008/07/02/how-to-edit-windows-registry-key-values-without-booti...   I have tried PC Regedit and it works.  There home page http://www.pcregedit.com/

If the whole value is gone . Look for Userinit key and make sure that the value is set as C:\Windows\System32\Userinit.exe, If the Userinit key is not there, you can add a new key by right clicking at the right pane and select Add Key.

Then type in or select this data

Name = userinit.exe

Type   = REG_SZ

Data   = C:\WINDOWS\system32\userinit.exe,

Quads 

[bugcrusher]

Quads,

I joined this forum simply because your one-liner above fixed my virus-induced logon/loggoff right away issue. I used

the line from a command prompt using Ultimate Boot CD for Windows (also would have worked from recovery console but I couldn't get the admin pw to work). This line DID WORK after trying several other techniques in forum. Thanks!

copy C:\WINDOWS\servicepackfiles\i386\userinit.exe C:\WINDOWS\system32

This let me boot up and now am scanning with Malwarebytes, and also Symantec is also helping clean up...a bit late, I must say...

Thanks again!

[Quads]

---

bugcrusher wrote:

Quads,

I joined this forum simply because your one-liner above fixed my virus-induced logon/loggoff right away issue. I used

the line from a command prompt using Ultimate Boot CD for Windows (also would have worked from recovery console but I couldn't get the admin pw to work). This line DID WORK after trying several other techniques in forum. Thanks!

copy C:\WINDOWS\servicepackfiles\i386\userinit.exe C:\WINDOWS\system32

This let me boot up and now am scanning with Malwarebytes, and also Symantec is also helping clean up...a bit late, I must say...

Thanks again!

---

No problem

 

Quads 

[bugcrusher]

Quads,

You were able to get me logged in, but now I'm finding an ever-changing,  unending amount of viruses. Symantec Client Security (Antivirus) is picking up infections it can't fix (or they come back), Malwarebytes is also not completely successful either, I am now running (don't laugh) Windows OneCare Live safety scanner online, just to see what they pick up. The computer I'm working on has important data on it and they prefer not to have it wiped and reloaded, but have been working on this for 3 days now. Geting Trojan.Agent, Spyware.Passwords (on MalwareBytes), Symantec latest find it packed.generic.198. It goes on and on. But anyway, I DID get logged on! what good it's doing me...can sure see how bad it is....

Thought you'd be interested.