I had a virus and was able to remove the virus.  Now,

when I tried to log on to Win XP, the PC starts to log on

and the logs off.



I ran recovery system (the one after you hit f8 key for

the agreement) and still have the same problem.



Any help on fixing my log on problem?





Thank you in advance



Ruben

I am having the same problem and would appreciate any help





"Ruben" <rubencisneros@sbcglobal.net> wrote in message

news:53a901c42cd2$6390e110$a501280a@phx.gbl...

> I had a virus and was able to remove the virus.  Now,

> when I tried to log on to Win XP, the PC starts to log on

> and the logs off.

>

> I ran recovery system (the one after you hit f8 key for

> the agreement) and still have the same problem.

>

> Any help on fixing my log on problem?

>

>

> Thank you in advance

>

> Ruben

So... did any of you guys have any luck with this?

I'm having the same problem and nothing seems to help, tried to install XP on top of the old but no luck.



Thanks

Jonas




	
Quote:
	

	

		

			
				Originally posted by Jason 

I am having the same problem and would appreciate any help





"Ruben" <rubencisneros@sbcglobal.net> wrote in message

news:53a901c42cd2$6390e110$a501280a@phx.gbl...

> I had a virus and was able to remove the virus.  Now,

> when I tried to log on to Win XP, the PC starts to log on

> and the logs off.

>

> I ran recovery system (the one after you hit f8 key for

> the agreement) and still have the same problem.

>

> Any help on fixing my log on problem?

>

>

> Thank you in advance

>

> Ruben 
			
		
	
	

I have found that viruses sometimes modify the following key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows

NT\CurrentVersion\Winlogon



"Userinit" = "C:\WINNT\system32\userinit.exe,"



and change it to



"Userinit" = "C:\WINNT\system32\<some other virus exe>.exe,"



This will cause the issue that you are having.  To fix it, simply

change it back.  Of course you will not be able to do this by logging

on.  You can use another machine (computer A) on the same network (or

borrow a friends computer to network with A) and use regedit.exe to

remote connect to the machine with the problem (computer B) and make

the change that way.  Just make sure that the Remote Registry service

on machine A is running.  That same service may have to be running on

computer B (can't remember) but you can start it using Computer

Management and remoting from A to B as well.  Anyway, that is a bit of

a different subject and there are many messages regarding that.



I feel sorry for those that have re-built machines because of this

simple issue .



Hope this helps,



Jeff



schnyffeldogg <schnyffeldogg.15r59w@mail.mcse.ms> wrote in message news:<schnyffeldogg.15r59w@mail.mcse.ms>...[vbcol=seagreen]

> So... did any of you guys have any luck with this?

> I'm having the same problem and nothing seems to help, tried to install

> XP on top of the old but no luck.

>

> Thanks

> Jonas

>

> Jason wrote: 

I have the same problem, what can I do? I tried doing a remote desktop connection to the other computer, but how is the computer going to accept if its not logged on?

I had this problem and, after the better part of a day and a half, I finally hacked a fix without restoring or using the recovery console.



Jeff's note about the Userinit key led me to the answer, but simply editing the registry from another machine is not always possible. In fact, it's not possible at all if the corrupted registry is on a machine running XP Home Edition, since Remote Registry is not enabled in that version. Also, many savvy admins disable that service anyway...



Here's my fix:



+ Get the offline registry/password editor from http://home.eunet.no/~pnordahl/ntpasswd/

There's a bootable linux CD image there, which is what I used. You don't have to be linux-aware, since it starts the editor. You do have to be patient, since it's a simple command-line program.



+ Boot the editor CD, and follow the prompts to load the 'Software' registry and go into the full registry editor.



+ Navigate down to the Microsoft/Windows NT/CurrentVersion/Winlogon key, and examine the value of the Userinit subkey. If it's not "C:\WINDOWS\System32\userinit.exe,", then change it. (Note: For some reason, simply changing the value was not enough to get the value change saved back to the Windows registry. I got around this by adding a temporary key and then saving.)



+ Quit and save, then go back through the editor process to make sure the change took.



+ Remove the CD and reboot Windows. You'll have to wait through a chkdsk, but that's a small price to pay for not having to rebuild your system!



+ Run regedit and delete the temporary key you created in HKLM/Software/Microsoft/Windows NT/CurrentVersion/Winlogon



+ Back up your registry



+ My recommendation: purchase and install NAV 2004, which has complete antivirus, adware and spyware protection. It was adware nonsense that got me in trouble in the first place....

	
Quote:
	

	

		

			
				Originally posted by pabakertx 

I had this problem and, after the better part of a day and a half, I finally hacked a fix without restoring or using the recovery console.



Jeff's note about the Userinit key led me to the answer, but simply editing the registry from another machine is not always possible. In fact, it's not possible at all if the corrupted registry is on a machine running XP Home Edition, since Remote Registry is not enabled in that version. Also, many savvy admins disable that service anyway...



Here's my fix:



+ Get the offline registry/password editor from http://home.eunet.no/~pnordahl/ntpasswd/

There's a bootable linux CD image there, which is what I used. You don't have to be linux-aware, since it starts the editor. You do have to be patient, since it's a simple command-line program.



+ Boot the editor CD, and follow the prompts to load the 'Software' registry and go into the full registry editor.



+ Navigate down to the Microsoft/Windows NT/CurrentVersion/Winlogon key, and examine the value of the Userinit subkey. If it's not "C:\WINDOWS\System32\userinit.exe,", then change it. (Note: For some reason, simply changing the value was not enough to get the value change saved back to the Windows registry. I got around this by adding a temporary key and then saving.)



+ Quit and save, then go back through the editor process to make sure the change took.



+ Remove the CD and reboot Windows. You'll have to wait through a chkdsk, but that's a small price to pay for not having to rebuild your system!



+ Run regedit and delete the temporary key you created in HKLM/Software/Microsoft/Windows NT/CurrentVersion/Winlogon



+ Back up your registry



+ My recommendation: purchase and install NAV 2004, which has complete antivirus, adware and spyware protection. It was adware nonsense that got me in trouble in the first place.... 
			
		
	
	


Hi pabakertx,



I also have the same problem: I cleaned a virus, rebooted the machine and then I couldnt log in.



I was doing what you posted and I changed the value to "C:\WINDOWS\System32\userinit.exe," coz it was something else. But the problem that I have now is that I cannot save changes. I also tried to create a new temporary key and new values, but nothing works. It says its OK, but when I check it again, its the old value again. And there is also no sign of the temporary key that I made.



Whats wrong with the linux program? Is it coz I have FAT32 and not NTFS?



thx

	
Quote:
	

	

		

			
				Originally posted by pabakertx 

I had this problem and, after the better part of a day and a half, I finally hacked a fix without restoring or using the recovery console.



Jeff's note about the Userinit key led me to the answer, but simply editing the registry from another machine is not always possible. In fact, it's not possible at all if the corrupted registry is on a machine running XP Home Edition, since Remote Registry is not enabled in that version. Also, many savvy admins disable that service anyway...



Here's my fix:



+ Get the offline registry/password editor from http://home.eunet.no/~pnordahl/ntpasswd/

There's a bootable linux CD image there, which is what I used. You don't have to be linux-aware, since it starts the editor. You do have to be patient, since it's a simple command-line program.



+ Boot the editor CD, and follow the prompts to load the 'Software' registry and go into the full registry editor.



+ Navigate down to the Microsoft/Windows NT/CurrentVersion/Winlogon key, and examine the value of the Userinit subkey. If it's not "C:\WINDOWS\System32\userinit.exe,", then change it. (Note: For some reason, simply changing the value was not enough to get the value change saved back to the Windows registry. I got around this by adding a temporary key and then saving.)



+ Quit and save, then go back through the editor process to make sure the change took.



+ Remove the CD and reboot Windows. You'll have to wait through a chkdsk, but that's a small price to pay for not having to rebuild your system!



+ Run regedit and delete the temporary key you created in HKLM/Software/Microsoft/Windows NT/CurrentVersion/Winlogon



+ Back up your registry



+ My recommendation: purchase and install NAV 2004, which has complete antivirus, adware and spyware protection. It was adware nonsense that got me in trouble in the first place.... 
			
		
	
	
Hi, i have been trying your fix, but with no luck, i can boot the floppy disk, but when i go to registry editor, it says simple registry editor, and i cannot see any keys or anything, so i cant navigate to the winlogon key, i cannot create a CD image because the broken computer is the one with the burner  , can someone please help me

	
Quote:
	

	

		

			
				Originally posted by Izi 

Hi pabakertx,



I also have the same problem: I cleaned a virus, rebooted the machine and then I couldnt log in.



I was doing what you posted and I changed the value to "C:\WINDOWS\System32\userinit.exe," coz it was something else. But the problem that I have now is that I cannot save changes. I also tried to create a new temporary key and new values, but nothing works. It says its OK, but when I check it again, its the old value again. And there is also no sign of the temporary key that I made.



Whats wrong with the linux program? Is it coz I have FAT32 and not NTFS?



thx 
			
		
	
	
I tried changing the value of Userinit and saving and it wouldn't save.  How exactly did you get around the problem of not being able to save changes by adding a temporary key?

	
Quote:
	

	

		

			
				Originally posted by pabakertx 

I had this problem and, after the better part of a day and a half, I finally hacked a fix without restoring or using the recovery console.



Jeff's note about the Userinit key led me to the answer, but simply editing the registry from another machine is not always possible. In fact, it's not possible at all if the corrupted registry is on a machine running XP Home Edition, since Remote Registry is not enabled in that version. Also, many savvy admins disable that service anyway...



Here's my fix:



+ Get the offline registry/password editor from http://home.eunet.no/~pnordahl/ntpasswd/

There's a bootable linux CD image there, which is what I used. You don't have to be linux-aware, since it starts the editor. You do have to be patient, since it's a simple command-line program.



+ Boot the editor CD, and follow the prompts to load the 'Software' registry and go into the full registry editor.



+ Navigate down to the Microsoft/Windows NT/CurrentVersion/Winlogon key, and examine the value of the Userinit subkey. If it's not "C:\WINDOWS\System32\userinit.exe,", then change it. (Note: For some reason, simply changing the value was not enough to get the value change saved back to the Windows registry. I got around this by adding a temporary key and then saving.)



+ Quit and save, then go back through the editor process to make sure the change took.



+ Remove the CD and reboot Windows. You'll have to wait through a chkdsk, but that's a small price to pay for not having to rebuild your system!



+ Run regedit and delete the temporary key you created in HKLM/Software/Microsoft/Windows NT/CurrentVersion/Winlogon



+ Back up your registry



+ My recommendation: purchase and install NAV 2004, which has complete antivirus, adware and spyware protection. It was adware nonsense that got me in trouble in the first place.... 
			
		
	
	
I've tried adding new keys and adding new values to the Winlogon key as temporaries but nothing works.  It either gives me an error and quits or it says it saved successfully but it really didn't.  Can you show step-by-step what you did once you were in the Winlogon key? Thanks in advance.