Here is a new one.
A client had a computer where when she went to log in, the desktop picture would flash, and then it would immediately go to “logging off…” back to the startup screen. This would happen in safe mode as well as standard mode.
As one would suspect, her machine was virus infected. Here were the steps I took to fix it.
- Boot into Recovery Console from a Windows XP disk. Having one that was of the same Service Pack is needed.
- Check under C:\Windows\System32 to confirm that userinit.exe is missing.
- Run this command: copy d:\i386\userinit.ex_ c:\windows\system32\userinit.exe, assuming that D is the CD drive, and C is the boot drive. Your mileage may vary.
- Assuming all is well, run Malware Bytes with the latest updates, as well as ComboFix. WARNING: Use of ComboFix has the potential to damage your OS install, but I have yet to have it cause an issue. Also, restart inbetween each scan job.
- Update the machine with the latest MS patches and AV software.
Note; this particular virus ruined Microsoft AutoUpdates, and this fine Wiki helped me find the answer, although the “C:\Winnt…” didn’t apply, as that path wasn’t available.