Windows XP Unable to Login After Cleaning Out Rogue Antivirus



This article may come in handy if you are out there battling the latest rogue du jour. Occasionally I have been through a cleaning process for these rogues and got to a point where the scanner had run and cleaned things out (whether it was malwarebytes antimalware or superantispyware.) It was time to reboot and the system reboots, starts to load the desktop wallpaper and then…. You see the windows login screen and the words “saving settings” under the username followed by the words “logging out”. You may try again, but it doesn’t even load the desktop icons it just boots you back out to the login screen. If you try safe mode you may get the same behavior (it was in my case), administrator or the typical system user didn’t seem to make a difference. I couldn’t even get to safe mode with the command prompt. No choice but to reinstall right? Wrong….


For this you will need to get access to the registry. Obviously given that this system is problematic we have limited options. If you have been able to access the registry remotely over the network that may work for you, but in my case I have an Ultimate boot CD which includes a Windows live cd environment. One catch with windows live boot cds though is that they need to be made from a working windows system. So, if you don’t already have one in your toolkit, you will need to scrounge your way to a working windows xp system with your windows disk, internet connection and then get your boot cd setup.

You may be able to use a linux boot cd to edit the registry (using wine perhaps as this article suggests.) Although that’s a path I haven’t gone down before… Other than that though I don’t know another way to edit the registry from linux.

Here’s what you will need to check in the registry.

HKeyLocalMachineSoftwareMicrosoftWindows NTCurrentVersionWinlogon

You are looking for the userinit value which should be c:windowssystem32userinit.exe and shell should be explorer.exe

In my case userinit was set to c:windowssystem32winlogon32.exe or some such nonsense. Fixing this restored the ability to login.

However, if it appears set correctly it may be that your copy of userinit.exe is corrupted and you may need to extract it from the windows install disk in recovery console mode…

expand d:i386userinit.ex_ c:windowssystem32userinit.exe

So, if you’re stuck in a windows login logout loop that you just cannot login to windows it automatically logs you back out before you see the desktop the above may solve the problem for you.

Related Posts

Blog Traffic Exchange Related Posts
  • Remote Tech Support using VNC (Ultravnc SC and x11vnc+wrapper script) Ok, some time back I'd done a writeup on UltraVNC SC, which is a nice customizable (windows version) VNC server that essentially let's someone doing remote support build their own downloadable .exe that runs and automatically tries to make a direct connection to a "listening" vnc viewer. It's good for......
  • How to Remove Windows Smart Security (Removal Guide) Windows Smart Security is a rogue spyware application that may fool people into installing and purchasing due to the use of the words Windows and Security in the title. It may fool people into thinking that it is related to Microsoft Windows and perhaps even a part of the operating......
  • Updating Windows XP SP2 serial number Intelliadmin published this earlier today... with all the problems some people have had with the Genuine advantage notification that their copy of Windows may not be legitimate (many reasons for this...) it may be necessary to buy a new copy of Windows and it would be a nuisance to have......
Blog Traffic Exchange Related Websites
  • How to Replace a Window Replacing your windows can bring numerous benefits to your home. Not only will they look nicer and add value to your property, but you can also gain significant energy savings. Most new windows are now heat and cold efficient and will greatly reduce the amount of drafts coming in as......
  • Has Carpal Tunnel Syndrome Stopped You Reading ? Carpal Tunnel can quite literally stop us indulging in one of our favorite pastimes – Reading a book. Holding a book open sometimes for long periods of time becomes so painful that thousands of sufferers decide they have little choice but to refrain. It is often recommended that a well......
  • What You Need From a WordPress Hosting Company Wordpress has taken over the world of websites and blogs, creating a simple and easy way for individuals get information out into the world of the Internet. The system gives users an incredibly easy platform to create the blogs, information, and news sites that they need to be successful. The......
PDF24    Send article as PDF   

Similar Posts


See what happened this day in history from either BBC Wikipedia
Search:
Keywords:
Amazon Logo

Comments are closed.


Switch to our mobile site