ED HAYES

One of my clients caught a virus on her computer this last week.  In an attempt to correct the problem, she installed Norton Antivirus 2010 before doing a full system scan using the boot disk.  The first time she rebooted the computer, she got into a logon logoff loop; after entering her login information and submitting it, Windows XP would automatically logoff the account.  It was at this point she contacted me and I came to help her solve the problem.  [See the bottom of this post for the solution]

I was stumped rather quickly after many internet searches.  I could tell the solution would not be easy.  The logon logoff loop persisted in all versions of safe mode; I was unable to access a command prompt.  I ran the bootable Norton CD and cleaned any remaining viruses off the machine; that didn’t solve the problem. My attempts to rename or copy files from another working machine, using a Windows Repair Console, did not solve the problem either.

Before telling my client I could not fix the problem, I called Norton to see if they could help me. Norton’s support was unacceptable, they could not help me.  I documented Norton’s inadequate support in a separate post.

I brought the computer to Best Buy, where my client originally purchased the Norton product.  I talked with the Geek Squad agent for a while, and we came to the same conclusion, a Windows Reinstall was most likely necessary.  I told my client I could do this at a fraction of the cost Best Buy would charge.

I attempted one last time to save the instillation of Windows, and returned to the internet once more.  I quickly realized I had managed to miss one of the possible solutions; fixing the registry.  I originally did not try this because I was unable to access Regedit.  This time, however, I brought some blank CDs and a copy of Windows XP Professional SP2 so that I could create a BartPE disk.  Using that disk I was able to open the local machine’s software registry hive and solve the problem.  My client’s computer booted successfully, and everything was as good as it was pre virus infection.

I learned two lessons with this service call:

• Run a full system scan prior to an Antivirus instillation; the scan provided on the bootable CD.
  • The Bootable Norton CD will download new virus definitions automatically if the machine is connected to a LAN.
  • Installing Norton on an infected machine could possibly cause damage.
• Come to all clients with all the tools at your disposal.  Even the tools you don’t think you will need.

Conditions

A Windows XP Professional machine was infected with several viruses.  Norton Antivirus 2010 was installed prior to a full system scan.

Symptoms

After rebooting, the system enters a logon logoff (or login logoff) loop; unable to get to the desktop. Safe mode will not work.

Solution

1. Boot from BartPE disk (Download and creation instructions for BartPE)
2. Open Regedit
3. Select the HKEY_USERS hive
4. Click File and choose Load Hive
5. Open the SOFTWARE  registry hive, likely located in:
   C:\Windows\System32\Config\SOFTWARE (Note: No filename extension)
6. Give the Hive a name: MyLocalHive
7. Navigate to:
   HKEY_USERS\MyLocalHive\Microsoft\Windows NT\CurrentVersion\Winlogon
8. Validate the value for the Userinit string equals:
   C:\Windows\System32\Userinit.exe, (Note: comma should be there)
9. The preceding string and value may be missing and must be added
10. Close Regedit and reboot the machine

Solution Credit: MVPS.org