Windows Logon Loop?

[hikaricloud]

This computer we have in the shop is doing something very odd.

Either in normal or safe mode, when you try to log onto an account, it logs on and you see the desktop, and immediately after you see the desktop it logs you off, bringing you back to the welcome screen.

Last thing I did to this machine was an AVG scan, and it needed to reboot to get rid of some viruses.

Can anyone shed some light on this situation?

 

[Inaris]

safemode, then run a scan again. I suspect that you have a problem with the virus you were wanting to remove...

 

[hikaricloud]

Either in normal or safe mode, when you try to log onto an account, it logs on and you see the desktop, and immediately after you see the desktop it logs you off, bringing you back to the welcome screen.

Can't get into safe mode either, it does the same thing, otherwise this would have been resolved already. :\

I'm thinking I might have to edit the AUTOEXEC batch file from prompt...but I'm not sure how. :\

 

[Inaris]

Autoexec isn't used anymore...

Try logging in with the left shift key pressed down. This might stop something from running that is causing a problem...

Also, look at this:
http://www.trendmicro-middleeast.co...opedia.php?LYstr=VMAINDATA&VName=TROJ_DELF.GW

 

[hikaricloud]

no go. :\ same thing happens.

 

[hikaricloud]

so anyone else have any ideas? the only way i can think to fix this is edit the autoexec batch file, which i am not sure how to do...and it IS still used.

so, any ideas?

 

[Inaris]

wait, what OS are you on? I was thinking XP...

 

[hikaricloud]

yes, it is XP. XP Pro SP2. but XP does still use the autoexec batch file, we've had to edit it in the past with other client's machines...course, that was my boss doing it. so I'm not learned on that.

at the moment im trying to run the recovery console from the XP Pro SP2 disk. that's the only way i can get any kind of command prompt...but past that i'm not sure what to do.

 

[hikaricloud]

and i just saw your edited post on the trojan...that does sound exactly like what is happening...but i cant rescan to pull it off because i cant log on. doozy of a pickle, eh? :\

 

[Inaris]

no, autoexec.nt is used for the cmd interpeter, but what usually happens is that you get an error indicating a problem with the file. Then you have to edit it. Autoexec.bat is not used in XP because xp like win2k and NT don't run on dos. The bat extention is a batch file to be processed by dos. in the NT platform (XP, win2k) it's all emulated. so they use a differnt file extention to pass the main aruguments to the interpeter. Everything runs under NTVDM.exe and is then processed.

Anyway, what version is the file NTVDM.exe. %systemroot%\system32\ is the path.
right click, properties, then version tab and the version in the little window near the bottom... What does that say there?