Help!!! Windows XP Stuck in logon loop!!!

[itguy22]

Right this is driving me loopy!

I have a windows xp laptop that as soon as you log on it !immediatly! logs off again no matter what user you try.

I have tried safe mode but the same thing happens, yes there has been a number of viruses on this machine but i have 'Manually removed them via a HDD caddy and run a full virus sweep with AVG and MS essensials.

Anyone any ideas.

Thanks Itguy22

[elsiegee40]

Right this is driving me loopy!

I have a windows xp laptop that as soon as you log on it !immediatly! logs off again no matter what user you try.

I have tried safe mode but the same thing happens, yes there has been a number of viruses on this machine but i have 'Manually removed them via a HDD caddy and run a full virus sweep with AVG and MS essensials.

Anyone any ideas.

Thanks Itguy22

Probably not the answer you want, I'm afraid...

If it's being this much of a pain and you know it's virus ridden, I would go for reformat hard drive and re-install. TBH it will save you hours of possibly wasted time and the machine will definitely be clean afterwards.

[itguy22]

Yep, Ususally I would do that but this particular machine has over 60gig of Docs and programs that the CDs have gone missing for. Hence me trying to repair.

Thanks for your help

[cookie_monster]

Grab a Linux live CD and copy everything you need off.

http://www.knopper.net/knoppix/index-en.html

[Michael]

It's possibly spyware or a corrupt profile causing the issue.

In theory you should be able to go in as administrator in Safe Mode as this uses a different profile.

[RTFM]

Could it be an issue with a boot sector somewhere?

I don't suppose it is worth trying a chkdsk and fixboot using the repair function from an XP CD?

Edit;

question regarding the above; If there was a boot sector problem would that allow XP begin to load in the first place?

[SYSMAN_MK]

You'll need to access the registry. The issue is most probably down to the malware changing the following reg value.

KEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit

The value should be

C:\\WINDOWS\\system32\\userinit.exe,

If you can access the machine via the network connect to the remote registry and check the value.

[elsiegee40]

Yep, Ususally I would do that but this particular machine has over 60gig of Docs and programs that the CDs have gone missing for. Hence me trying to repair.

Thanks for your help

Why is it always the ones with many gig of unbacked up docs?

The linux idea to backup sounds a good one.

[NikChillin]

We keep a HDD usb connector for these problems then we can remove the drive and access all the documents without having to boot up the laptop/computer. It's a really useful device!

[TwoZeroAlpha]

Sysman has it, complete PITA if you can't get registry access 'cos it's reinstall time.

I've found the Linux Mint live CD very useful for getting stuff off knackered windows systems. Sometimes have issues with knoppix (not) allowing write permissions to USB drives.

[mac_shinobi]

Sysman has it, complete PITA if you can't get registry access 'cos it's reinstall time.

I've found the Linux Mint live CD very useful for getting stuff off knackered windows systems. Sometimes have issues with knoppix (not) allowing write permissions to USB drives.

1. Created a Bart PE iso, nothing extra added, just used defaults.
2. Booted dead system from PE CD.
3. Downloaded LoadHive from MATCODE - Tools for Professionals and put it on a floppy.
4. Ran it from the floppy in PE, loaded C:\WINDOWS\System32\Config\software ... it mounted the hive as SOFTWARE_00.
5. Ran regedit, found the SOFTWARE_00 subkey and navigated to CurrentVerion, exported that subkey to the floppy.
6. I moved to a working XP machine, backed up my DigitalProductId key. I edited the reg file from the floppy to only contain the DigitalProductId key.
7. I merged the DigitalProductId key from the floppy, ran Keyfinder (Magic Jellybean Software) and it pulled the key !
8. I merged the backup I made and ran it again, and sure enough it had my original key.

very very cool...I did not think this was possible. Thanks for all the help!

Not sure if you can do a similiar procedure to load in the correct registry

[Newton]

Had similar problem last week, turned out ot be some malware rubish

booted in safe mode, ran malwarebytes , this allowed me into normal mode ran maleware bytes again and everythings ok.

[SYSMAN_MK]

Had similar problem last week, turned out ot be some malware rubish

booted in safe mode, ran malwarebytes , this allowed me into normal mode ran maleware bytes again and everythings ok.

Problem with this issue is that you are unable to logon in safemode either. The only way is by remotely accessing the registry or editing / repairing the registry via other means.

[Phil-Dyer]

I had the same issue not so long ago

After trying pretty much every option possible i ended up using a hirens boot cd, booted into mini xp and copied the data across to a portable hdd, then just completely imaged the system.

[coquet636]

If i have laptops stuck in a loop or blue screen just before i logon the attached document works around 80% of the time.... cant remember where i originally got it.....

and instead of using the command line i use an ubcd to delete and move files but suppose a hard drive caddy would work.