Windows XP fault - anyone seen it before?

quidsinquentin

We've just had a serious problem with our pc and windows xp. When the pc was started it went to the users screen as normal, but then when you clicked on a users name it started the logging on process then went straight to logging off.

We were not able to get into the users names by any means - even safe mode. We contacted DELL's software people, and we spent a day trying to sort it out, but couldn't. In the end we had to reset the pc to factory settings, losing all the (220Gb) data on the pc.

I know we should have backed it ALL up, and the most crucial was. But the rest is gone forever.:mad:

Has anyone seen this problem before, or a virus that does this?

We were running AVG anti-virus, Zonealarm firewall, and several spyware products, inc. spywareblaster, windows defender, etc.

superscaper

I've never even heard of that before but it does sound like some kind of windows corruption. Sounds like you did everything you could in terms of pc protection (except the frequent backing up).

T4i

It's quite common with infected computers. You need to have access to the registry to fix it,

This CD is bootable and is quite a handy utility for those situations:-

http://windowsxp.mvps.org/peboot.htm

Its a shame Dell don't have any initiative to do what I've just done and find a fix in seconds....

---

Google - 'xp logon logoff problem'

---

Logon - Logoff loop, also caused by BlazeFind

Another critical symptom caused by this malware: This malware modifies the Userinit area in the registry (replacing the userinit.exe with wsaupdater.exe) and Ad-Aware (with a particular definition update) removes the wsaupdater.exe file from the system, thus causing the Logon - Logoff loop. That is, when you login to Windows, the 'loading personal settings" verbose will appear, but suddenly it will logoff. This issue was documented clearly by Lavasoftusa in it's Lavahelp Knowledgebase.

Here is the solution to the logon - logoff issue in Windows XP.

Enter the Recovery Console

Boot the system using the Windows XP CD-ROM. In the first screen when the Setup begins, read the instructions press "R" (in the first screen) enter the Recovery Console. Type-in the built-in Administrator password to enter the Console. You'll see the prompt reading C:\Windows (Or any other drive-letter where you've installed XP)

Type the following command and press Enter.

CD SYSTEM32
(If that does not work, try CHDIR SYSTEM32)

COPY USERINIT.EXE WSAUPDATER.EXE

Quit Recovery Console by typing EXIT and restart Windows.

You'll be able to login successfully as you've created the wsaupdater.exe file (now, a copy of userinit.exe)

Now, change the USERINIT value in the registry (see Phase II in this page) and change it accordingly.

Phase II - Fixing a registry entry which causes the Quick Launch issue (not retaining the settings)

Click Start, Run and type REGEDIT. Navigate to:

HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ WindowsNT \ CurrentVersion \ Winlogon

In the right-pane, change the value of Userinit to "C:\WINDOWS\system32\userinit.exe,"

Type the above value exactly as given, including the comma - exclude the quotes. Also, change the path to userinit.exe appropriately if Windows is installed in a different drive.

Close Registry Editor and restart Windows. The Quick Launch settings should be retained now.

quidsinquentin

Hi - thanks for the suggestions of googling.

It appears most likely that it was a virus or malware that came in through MSN from what I read. The login/logoff loop appears to be well documented and "Blazefind" malware/virus appears to be the most likely culprit. (Sonofa*****!)

Has anyone encountered this virus before??

nej

T4i,

You've just proved what we all know - helpdesks are awful. Their first response to any problem is to run their "recovery" cd, which usually wipes everything. This is such awful service that something needs to be done really. Thousands of people lose their data because the helpdesk staff are either too lazy or too incompetent to actually fix a problem.

I'm glad that I (like you, I presume) have the knowledge to fix my own problems.

f3lix

Recenty happened on my lap top, had to reinstall.
Never found out the reason.

T4i

I think adaware6 will remove blazefind. Then running Hijackthis sholud locate the bridge.dll and find URLsearchHook to be removed.

Thats only if it defo is BlazeFind.

hechizero

If you have Zonealarm installed - Can cause issue with fast user switching by shutting down your PC. Remove and use Windows firewall - just as good IMO.

superscaper

hechizero wrote:

If you have Zonealarm installed - Can cause issue with fast user switching by shutting down your PC. Remove and use Windows firewall - just as good IMO.

Don't think I've seen that before but I guess it's possible, but definitely try both firewalls and see which you prefer I know windows firewall isn't configurable for outgoing connections and can cause problems with other things. Everyone has their own software preferences so don't take any of our biased opinions for granted (including mine).

hechizero

superscaper wrote:

Don't think I've seen that before but I guess it's possible, but definitely try both firewalls and see which you prefer I know windows firewall isn't configurable for outgoing connections and can cause problems with other things. Everyone has their own software preferences so don't take any of our biased opinions for granted (including mine).

Hi superscraper do you work for Zonelabs? Um...well I am glad you guess it is possible...cause it is actually a fact that Zonealarm causes multiple issues with user switching including the symptoms listed, else I would not have bothered posting. Done any research on that? Secondly why would the OP want to continue running a particular firewall if it is causing an issue? I never make a software recommendations, however it is wise to have one firwewall running if you are removing another...and the Windows one is free...so for the purpose of testing this is the most sensible thing to do. Now what is your advice exactly?

quidsinquentin

hechizero wrote:

If you have Zonealarm installed - Can cause issue with fast user switching by shutting down your PC. Remove and use Windows firewall - just as good IMO.

Easy there fella's - I appreciate all the comments.

We did have the free Zalarm firewall in, but we didn't "fast switch" - unless thats just switching users. We didn't have any other probs with ZA.

But my son was using utorrent and MSN regularly, and from the googling, I gather that Blazefind can get into your pc through MSN or P2P.

This is the link where I found one of the answers - http://www.winxptutor.com/wsaremove.htm.

but as with all things PC, it might not be that one thing. Thats why I asked if anyone else had seen it.

But you were right, there is a solution and I didn't need to delete all the data. Bloody DELL!