This morning my wife booted up her laptop like usual, and came back later to login.
After entering her password and hitting Enter at the login screen, she saw it automatically logout.
She tried it again, and the same result.
I suggested holding down the Shift key immediately after hitting Enter, since this can prevent some startup items from launching. But it didn't make any difference.
Tried rebooting the laptop in Safe Mode, but that didn't get me to the Desktop either.
Went back to my own laptop, and a quick search on Google returned a few results relating to something called "NoeNoeJetma.vbs" (an annoying piece of malware which, if not removed correctly, can cause the login/logout loop due to the userinit.exe Registry entry being corrupted).
The fix involved getting access to the registry, and correcting a particular value at HKLM\SOFTWARE\Microsoft\WindowsNT\Curren
tVersion\Winlogon (
for the curious: The "Userinit" value needs to correctly point to the actual path and instance of the "userinit.exe" file in system32. It also should not be referencing anything else by default)
Rebooted the laptop with a
Ubuntu 8.10 Live CD (Intrepid Ibex), and mounted the laptop's primary partition. Checked the userinit.exe file was intact on wife's laptop. While I was there, I also renamed wscript.exe (this handles Windows Scripting), so there wasn't an obvious way .VBS files would execute (and also renamed the backup copy in the dllcache as well, since I didn't want it automatically restored by Windows).
Now I needed to check the registry.
To be able to check and edit the registry, I needed a way to get into it without being able to boot into Windows on the local machine.
One option was copying the registry files to my own computer, and then edit them there. This is messy and horribly error-prone, and prone to messing up the NTFS permissions.
So I went with another option: I got a copy of
BartPE, created an ISO, burned it to CD, then rebooted wife's laptop into BartPE using the CD.
Launched the Registry Editor, highlighted the HKEY_LOCAL_MACHINE branch, selected "Load Hive...", then loaded the USER.DAT relating to the most often used Profile.
Edited the relevant registry entry (as earlier mentioned), unloaded the hive (
extremely important!), then rebooted without the BartPE CD.
Logged into the usual Profile on the laptop, and waited...
The laptop didn't automatically logout. For wife's purposes, this made her laptop usable again.
Notes:
- I have not enabled the Windows Scripting yet, since there are extremely few legitimate instances where Windows Scripting would be needed. It is easy enough to enable this later, if required, but I don't foresee this happening any time soon.
- It's extremely useful having both the Ubuntu Live CD, and the BartPE CD available at hand. Luckily I had broadband available to be able to download what I needed, and I had an ISO copy of Windows XP SP2 on one of my hard drives to use with BartPE.
- Malware authors should be strung upside-down and flogged for wasting our time (about 2.5 hours, all waiting time added up)