There is a virus going around that causes Windows to automatically log off once you log on. After a bit of time messing with it I found the following solution. Either use Remote Registry or startup with a Bart-PE disk or connect the hard drive to another PC to access the HKLM registry.

Edit these values and type the correct path of shell :

Shell = explorer.exe
Userinit=c:\windows\system32\userinit.exe

NOTE: These files may also be deleted by spyware. You may need to extract them using the Windows CD.

Steps for rectifying this problem:

Log on to a networked computer.
Run Regedit.exe
Point your cursor to HKEY_LOCAL_MACHINE
Select File > Connect Remote Registry
Type computer name (infected computer)
Navigate to the following location in registry of destination or infected computer


HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon


Edit these two values in right pane:

Shell
Userinit


Change these two values to
Shell=explorer.exe
Userinit = c:\windows\system32\userinit.exe
Exit from Registry
Restart Infected computer.
You should be able to log on to computer.
If it did not work then go to back steps and just copy or write the file userinit.exe

If you have any questions or need assistance call us at 661-268-4110.