XP logs in then logs out immediately :(

[Kinslayer777]

Preface Erm...This *seems* like the right forum...Sorry if i'm wrong :

I'd like to blame it on any messenger friends, but in anycase i've having a erm, difficult problem with my computer. I cannot log in on any of my accounts (administer or not) of my new Windows XP Pro computer. I've only downloaded a few trusty programs (bitdefender free, avg free [bitdefender= non active], trillian, ad-aware, and spycatcher express.

So during normal startup if i log in, i'll instantly start logging out and have only gotten past the welcome screen once or twice (for mere seconds). I've heard various posts calling it "Search Assistant" [Warning- random googl'ed forum link- http://www.opentechsupport.net/forums/archive/topic/20552-1.html]

My symptons are slightly different though as i AM able to run in starup. I did run all my programs which had been updated in the last 10 hours (minus bitdefender) but they showed no problems.


I'm hoping to find some help perhaps here before i have to deal with registry...I've screwed registery (my fault) once and am VERY wary of trying again...
I can only think of one notable thing- bitdefender won't load anymore
Edit: I tried the full registry fix but that didnt work...Figures it was a 2005 old solution

Thanks for any info,

Kin-Kinslayer-Kinnishian

 

[Kinslayer777]

Edit: Could anyone move this please? Sorry i'm beggining to feel i really messed and this would be under...perhaps software and apps or operating systems and this forum is more hardware-ish.

 

[Kinslayer777]

Ok, it definetly feels like an app. I noticed i'm getting past logging in for sure, and something is just triggering logging out asap. How? Avg sneaked in an autoupdate before it logged this time (which pops above the welcome screen) and paused logged out for the extra split second to see my background of a pretty porsche nine eleven

 

[Kinslayer777]

A lot of results show people saying malware changed userinit (in registry) to wsaupdater.

Userinit seems in perfect shape
[No wsaupdater found only userinit]


And when i tried 'modify' to see if userinit.exe had wsaupdater.exe i didnt find anything.

I never installed recovery controller and can't do this as a command and just have to find it in regedit

It seemed like the perfect reason especially considering ad-aware found 1 tracking cookie recently

 

[Kinslayer777]

Well, i got into recover console by booting my liteon first (never knew how to do that) with my OEM Windows CD in...

Tried Cd System32>Copy Userinit.exe wsaupdater.exe

It said 1 file(s) copied, i got excited, exited, rebooted, and...

Didnt work! [Most google results suggested it]


Gargh!

 

[Kinslayer777]

Ok, i went through it completely, 4th result down on http://www.tek-tips.com/viewthread.cfm?qid=924408, it didnt work, i think i pretty much ruled out the blazefinder problem :\ I dont know if that's good or bad

 

[Kinslayer777]

Well, windows repair didnt work either Nothing is working...


OI. I'm lost.

 

[John]

Originally posted by: Kinslayer777
Well, windows repair didnt work either Nothing is working...


OI. I'm lost.

Recovery console repair or repair install? Try the latter if you haven't done so already.

 

[Kinslayer777]

Repair Install = Didnt work (Well, it worked, but it didnt solve the problem)
Not sure what you mean by Recovery Console Repair...but i can access recovery console.

t's odd i can't think of what could it be. We have...

Malware? What use would malware have though keeping my computer off? However it doesn't happen in


Startup? I think i'll look into that more. It's all i know about safe mode (i know hardly anything...nothing about it) that differs from regular except of course not being able to connect to internet.

Program compatibility? I'm not sure what it could be...I hadnt installed anything besides AVG Spyware remover...but wait..I must have somehow managed to unistall it earlier in safe mode. Gargh! They why can't i unistall anything atm?! This is fishy...


Any other possible causes?

 

[Ulukia]

It's the profile itself or the ntuser.dat is corrupting. If its the admin profile, there isn't much you can do if its the only profile with admin rights. If the ntuser.dat is not present, it may have been changed to user.man, if so the profile will not allow changes and may be kicking you out. That is a valid Windows recognized extension and will pass a repair install.

 

[Kinslayer777]

Err...I didnt quite understand that. Sorry. But one thing is i can get in in safe mode, and have made new accounts (including with adm status) and have still had the problem

 

[Kinslayer777]

An odd little thing....A sqaured i just managed to unistall, and it seems only Bitdefender Free 8th edition is the one that claims the window installer can't be accessed.

 

[Kinslayer777]

Ha! SOB! Thanks Kakomu!

I had hijackthis already on my comp because i figured it would be a good thing to have. So in safe mode i ran it. i found this nasty little applitDLL described as something that loads into your memory while booting before any other processes. Fixed that and now im up and running. the weird thing is, in the system32 folder (where its located) i clicked it to check its properties and it said "module required fro SpyCathcer". wtf?


i deleted another called "intercepthelp". but the "interceptor" will not delete, not even in safe mode.

I'm free!!!!! I found this, and fixed it with MyLordjin's tool Hijackthis !!!! woohooO!! Any suggestions for followups now that i can log in normally?

 

[John]

Originally posted by: Kinslayer777
Any suggestions for followups now that i can log in normally?

Since you have malware on your pc please click the link in my sig and do steps 1-10, then install AOL Kaspersky and do a full system scan.