We had a machine come in recently that had a virus.  One of the files we deleted was in the Documents And Settings\<user>\Local Settings\temp\ dir called mousehook.dll. We’ve seen this file associated with Trojan.Dropper/Multi-CN.Process. We used KillBox to delete on reboot. Well upon reboot we logged in, the wallpaper flashed briefly and instantly logged back out to the log in screen. Hmmm…. same story in safe mode. Long story short here’s the fix to the log in and log out immediately problem that worked for us.

1. Boot into your XP cd

2. Select “R” to enter Recovery Console

3. cd to c:\windows\system32

4. Look for userinit.exe

5. If it’s there type the folowing: copy userinit.exe wsaupdater.exe

6. If not type the following: copy dllcache\userinit.exe .

7. Reboot

In our case c:\system32\userinit.exe was gone. In googling the issue we found reference to removing Search Assistant causing this problem. If you did step 5 and NOT 6 then you’ll need to do the following.

8. in Start -> Run type regedit and then hit enter

9. Now find the Userinit key in:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Winlogon\

10. change the entry: C:\WINDOWS\System32\wsaupdater.exe to read C:\WINDOWS\System32\userinit.exe

11. Reboot

In our case the virus removed the userinit.exe file. Your mileage may vary. The standard disclaimer applies when editing the registry. Always back it up before making any modifications.

**UPDATE 04/03/2009**

We had a laptop come in and userinit.exe was NOT in the dllcache directory. In that case you’ll need to do the following while in the recovery console.

1. change your directory to the CDROM/DVDROM drive.

2. cd i386

3. expand userinit.ex_ c:\windows\system32

After entering the expand command you should see the text “1 file(s) copied”.

Restart your computer and you should be able to log on.

**Update 5/12/2009**

We had a XP Home system come in that immediately rebooted at the Windows splash screen while starting up before it gave us a login prompt. We went into the recovery console and started by doing a check disk.

C:> chkdsk c: /r

We exited and it rebooted to the login prompt. Obviously not the same issue as above but we wanted to throw that out there since it was a simple fix.