Takes a bit of work to fix, but it's not too difficult. I find using a Vista/Win 7 Recovery disk is the easiest method (Method 2 below), as you don't have to guess what file name the malware used. You also don't have to build the disk, just download and burn the ISO file to a disk.
The looping logon can happen if your spyware software removed the
wsaupdater.exe or
winlogon86.exe malware file, or if the
userinit.exe file is missing, corrupted, or being redirected. You'll need to use the Recovery Console, a Vista/Win7 DVD, or a Live CD to fix this.
If the userinit file is being redirected, you need some way to edit the Registry, so the Recovery Console won't do.
Ultimate Boot CD for Windows
BartPE CD/DVD
A Vista RE disk can be downloaded from one of these links:
Vista Recovery Environment CD
64 bit Vista
32 bit Vista
Windows 7 from here:
Recovery Environment CD
This link shows how to use a BartPE disk:
Looping Login Fix using a BartPE CD
Method 1
Recovery Console Steps
Boot to the Recovery Console.
Set your system to boot from CD, either by setting the boot order in the BIOS, or using the boot menu if your system provides one, usually by pressing one of the
FX keys;
F9,
F10,
F12 are common.
Insert the Windows XP CD and boot the system.
When prompted to
Press any key to boot from CD... press any key like
Spacebar or
Enter
When you boot from the CD, the following is displayed:
On a black screen:
Setup is inspecting your computer's hardware configuration...
Screen turns Blue, and
Windows Setup is displayed at the top.
at the bottom is displayed the following in sequence:
Press F6 if you need to install a third party SCSI or RAID driver
Press F2 to run Automated System Recovery (ASR)...
Setup is loading files (file names displayed)
Title changes to
Windows XP Professional (or
Home Edition)
Setup
The options to setup or repair Windows are displayed
Choose
To repair a Windows XP installation using recovery console, press R.
You may need to choose the Windows installation if you have a dual boot system. Type the number of the Windows installation you want to log into.
You will need to enter the Administrator password unless you previously disabled that requirement; if it's blank, just press enter.
You should now be at a
C:\WINDOWS> prompt (or whatever letter your system is installed on)
Type the following at the
C:\Windows prompt then press
Enter:
cd system32
Dir userinit.exe
If not found we need to copy it from the Service Pack Files backup, or the CD. Even if it is present, you may want to replace it in case it's corrupted.
First try this:
copy C:\Windows\ServicePackFiles\i386\userinit.exe
If that fails, copy it from the CD using this command:
copy X:\Windows\ServicePackFiles\i386\userinit.ex_ userinit.exe
where
X: is the drive letter of the CD Rom. You can find it by typing
MAP
Now type this:
copy userinit.exe wsaupdater.exe
copy userinit.exe winlogon86.exe
exit
If one of those two files replaced the
userinit.exe file, this should let you boot into Windows. Once at your Desktop:
Click
Start | Run, type
regedit, press
Enter
navigate to here:
Code:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
In the right pane, double click the
userinit item.
It likely says
C:\Windows\System32\wsaupdater.exe, or
C:\Windows\System32\winlogon86.exe,
Edit this to read:
C:\Windows\System32\Userinit.exe,
Be sure to include the trailing comma and use the correct drive letter for your installation.
Close the registry editor.
Now delete the
wsaupdater.exe and
winlogon86.exe files from
C:\Windows\System32
If it still loops, the
userinit.exe file may be being redirected in the registry. This will require a Live CD or connecting the system to another PC to edit the registry.
Method 2
Using a Live CD
From a Live CD that can edit the registry, or from a Vista/Win7 DVD, we just need to make sure
userinit.exe exists, then edit the registry.
Boot with the Vista/Win7 DVD
Select Language, click
Next
Click
Repair your Computer
It will search for Vista/Win7 installations, just wait for it to finish.
If using Win7 Disk, select
Use recovery tools that can help fix problems starting Windows.
Click
Next
Click
Command Prompt.
Type
regedit and press
Enter:
In the left pane, click on
HKEY_LOCAL_MACHINE to highlight it
Click
File | Load Hive...
Browse to
C:\Windows\system32\config
Double click on
SOFTWARE (the one with no extension)
In the
Key Name: box type
@Software
navigate to here:
Code:
HKEY_LOCAL_MACHINE\@SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
In the right pane, double click the
userinit item.
It likely says
C:\Windows\System32\wsaupdater.exe, or
C:\Windows\System32\winlogon86.exe,
(If so, the
userinit.exe file is probably just fine)
Edit this to read:
C:\Windows\System32\Userinit.exe,
Be sure to include the trailing comma and use the correct drive letter for your installation as seen when booted to Windows.
Next, navigate to here:
Code:
HKEY_LOCAL_MACHINE\@SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
Check in the left pane for a folder named
userinit.exe. If present, delete it.
Close the Registry Editor.
To verify that
userinit.exe is present, type the following commands followed by
Enter:
cd /D C:\Windows\system32
Dir userinit.exe
If missing, type this:
copy C:\Windows\ServicePackFiles\i386\userinit.exe
If that can't be found, you'll need your XP CD.
Type this command:
expand E:\i386\userinit.ex_ userinit.exe
where
E: is the drive letter of the CD Rom
(Quick way to determine the CD drive letter is to open notepad by typing
C:\Windows\notepad and using the
File | Open dialog)
Type
Exit and press
Enter
Click
Restart
Note that drive letters as seen from the Recovery Console, a Vista/Win7 DVD, or a Live CD may be different than when booted into Windows.