Member Avatar for chris.rapson

I picked up something off MSN today, and noticed things were acting strange. I scanned the two files I had downloaded (clean) and then deleted them. The computer would not hibernate, so I shut it down. The next reboot appeared to work fine. But when I ran Norton AV, it came up with some error - unfortunately I didn't look too closely what error, I panicked and decided it would be better to scan in safe mode. Trying to shut down at this point gave me a BSOD. Even more unexpectedly, when I tried to run safe mode, the system immediately logged out as soon as I logged in. Then when I tried 'Last known good configuration' and normal boot they had the same problem (immediate logout).

Sorry I can't provide more specific information, I'd like to run HJT but I'm a bit restricted now that I can't login.

Any help would be much appreciated, I guess the first thing would be how to log into Safe Mode?
Chris

  • 1 Contributor
  • 2 Replies
  • 275 Views
  • 6 Days Discussion Span
  • Latest Post Latest Post by chris.rapson

Dani AI

Generated

Immediate logoff right after entering credentials (even in Safe Mode) is a classic sign that the Winlogon startup values were changed or the user-init/shell executable is missing or replaced by malware. Restoring the Winlogon entries (the Shell and Userinit values under HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon) is the usual first fix because Winlogon will drop the session if it cannot start the expected shell/process. (learn.microsoft.com)

Practical order-of-attack (least invasive first): if you can reach Safe Mode with Command Prompt, run System Restore to roll the system back to a known-good point; that often removes the registry changes that cause immediate logout. If you cannot boot interactively, use Windows RE/WinPE or a separate working PC to edit the offline registry hive: open Regedit, select HKEY_LOCAL_MACHINE, use File→Load Hive on the infected drive’s SOFTWARE file, correct the Winlogon keys, then unload the hive. Always export/save a copy of the hive before making edits. (support.microsoft.com)

After restoring login capability, do a full cleanup from updated tools and, preferably, from offline rescue media before reconnecting to the Internet. Bootable AV rescue disks can find persistent droppers and rootkit components that run before Windows; follow with an on-disk scan (Malwarebytes and similar tools detect UserInit-style hijacks and PUMs). Keep the AV definitions current and repeat scans until clean. (support.kaspersky.com)

If registry fixes and offline scans do not restore a trustworthy state, treat the machine as compromised: image critical data (do not copy executable files), change all exposed passwords after cleanup, and consider a clean OS reinstall. Note that the approach above is the same one that resolved this case for : restoring the logon registry then running System Restore returned access, followed by an AV update+scan. (learn.microsoft.com)

Member Avatar for chris.rapson

To update the situation... I have since done some research and tried:
bootcfg /rebuild
fixboot
copying userinit.exe to wsaupdater.exe
copying registry files from the repair directory

Still no idea what is causing the problem specifically :s

I am about to try a Repair Install from the CD, unless anyone has any ideas before then? I have read that this procedure is not particularly reliable. Also it seems overkill, since if I could login to windows, i am fairly sure that System Restore could solve the rest of the problems.

Member Avatar for chris.rapson

For future reference: I managed to fix it, finally, following the instructions on this website:

And then doing a proper system restore in Safe Mode. After updating my AV, it found trojan.dropper - nasty little mofo.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.