Can't log into Windows XP...

[Vertigo-1]

I have a rather serious problem here with a computer that can't boot into Windows XP. I'll click on the Owner icon of the log on screen, then it'll log in for about a second and then say "Saving settings..." and log right back out. Already tried pulling the hard drive out and doing a virus and ad scan on it, removed like 85 viruses and 100 ads or so, was hoping that was the problem but apparently not. Next step I'd do would be a Windows repair, but is there anything else I can try?

 

[phatrabt]

Have you tried logging in as Administrator? Ctrl-Alt-Del twice and it SHOULD prompt you just like Win2k does, then you can log in as Admin (if you have the password). If that doesn't work a repair might be in order (but if it was me I would do a fresh install since the box was infected so badly... no telling what little nasties are left).

 

[MulLa]

Do a repair. Had the same problem at a friend's place and that's how I got back in.

 

[dclive]

Originally posted by: Vertigo-1
I have a rather serious problem here with a computer that can't boot into Windows XP. I'll click on the Owner icon of the log on screen, then it'll log in for about a second and then say "Saving settings..." and log right back out. Already tried pulling the hard drive out and doing a virus and ad scan on it, removed like 85 viruses and 100 ads or so, was hoping that was the problem but apparently not. Next step I'd do would be a Windows repair, but is there anything else I can try?

Don't do a Windows repair - this can be solved in 3 minutes.

On another computer on your network, go into regedt32 and, remotely over the network, load the registry of your computer that's having the problem.

Go to this key on the 'bad' computer:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Userinit REG_SZ C:\WINNT\system32\userinit.exe,

and ensure it looks JUST like that. If it looks at all different, change it so it looks just like that - including the trailing comma.

That should resolve the problem. Post back if you have any questions.

 

[Vertigo-1]

Well, I'm actually not on a network...and this person's computer is running XP Home. Don't suppose I could use this method with a hard drive pull? I suspect there could very well be additional ads hidden in that computer's registry, just that as a hard drive pull, those aren't going to be found in a typical hard drive only scan.

 

[FinalFantasy]

You should just do a fresh install of XP since you computer was so badly "mauled" and it sounds like a HD pull would work to fix the registry problem if you decide to go that way.

 

[dclive]

Originally posted by: Vertigo-1
Well, I'm actually not on a network...and this person's computer is running XP Home. Don't suppose I could use this method with a hard drive pull? I suspect there could very well be additional ads hidden in that computer's registry, just that as a hard drive pull, those aren't going to be found in a typical hard drive only scan.

XP Home - no problem.

This isn't an 'ad' problem - if your login doesn't look just like what I posted, you won't be able to log in fully. When you try to log in, the program in that 'space' is called, and if it can't be found, you won't be logged in.

It's possible that malware changed the file that points to, and then when your anti-malware program ran it removed the new (bad) logon file, so now you can't logon because there's no file present there anymore.

Pull the hard drive, put it in another machine, and then fix it that way. It would take you all of 3 minutes once you're booted up....it's easy!

 

[Vertigo-1]

Alright, got the hard drive back into another machine. What should I be looking for in terms of the file name i.e. what is the default registry file that XP uses? I assume I do an import? This is my first time doing this so...

 

[dclive]

Originally posted by: Vertigo-1
Alright, got the hard drive back into another machine. What should I be looking for in terms of the file name i.e. what is the default registry file that XP uses? I assume I do an import? This is my first time doing this so...

These directions are for Win2k; under XP they'll be marginally different; you might need to go to a different menu rather than REGISTRY - it's the one furthest on the left.

Go into regedt32. Highlight HKeyLocalMachine. Go to the REGISTRY menu, then LOAD HIVE. Load the SOFTWARE hive (your_bad_hard_drive_letter:\windows\system32\config\software. You're prompted for a name - call it bad_sw. Now go to HKeyLocalMachine\Bad_sw. Go to Microsoft folder, then Windows NT, then CurrentVersion, then Winlogin and find UserInit on the right, and change the data in the Winlogin\UserInit value to match "c:\winnt\system32\userinit.exe,".

Unload the hive by highlighting bad_sw and going to REGISTRY and UNLOAD HIVE. Put the drive in your old system. Reboot and try again.

If that doesn't work, remove everything before the last \, so it looks like "userinit.exe," and try it again.

 

[Vertigo-1]

Originally posted by: dclive

If that doesn't work, remove everything before the last \, so it looks like "userinit.exe," and try it again.

Thanks so much, that did the trick. Now that I can get in, I'm seeing yet more malware and crud that's getting loaded on bootup. I'm not so sure a format wouldn't have been better!

 

[dclive]

Originally posted by: Vertigo-1

Originally posted by: dclive

If that doesn't work, remove everything before the last \, so it looks like "userinit.exe," and try it again.

Thanks so much, that did the trick. Now that I can get in, I'm seeing yet more malware and crud that's getting loaded on bootup. I'm not so sure a format wouldn't have been better!

Pop the HDD into another machine and re-scan it with a few AV and anti-malware apps. When the OS is running lots of malware can be hidden. And stop clicking dangerously.