I recently received a call from a client who was unable to login to Windows XP after trying to remove malware with Spybot S&D. As the computer started, it would pass the welcome screen, display the wallpaper, and then suddenly jump back to the login screen. If a user name was clicked, it would say “loading settings…” and return once again to the login screen.
I tried the following with no success:
- Starting the computer in safe mode and logging in as both the standard user and Administrator. It didn’t matter which one was selected, the problem was the same.
- Attempted to restore the registry by pressing F8 during startup and selecting “Use Last Known Good Configuration”.
- Running chkdsk from the recovery console to see if there were any errors on the disk. Errors were found and fixed, but it did not solve the problem.
I searched Google and discovered that this is quite a common problem that generally occurs after removing spyware. I figured that Spybot must have caused the problem by removing a file or changing a registry setting.
That was indeed the case. Let me explain how this problem happens.
Normally after a user logs in, Windows will execute the file pointed to by this registry key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit
The value of Userinit is normally “C:\Windows\System32\userinit.exe”. Userinit.exe is a file that manages different start up sequences.
Certain pieces of spyware will modify this registry setting to point to their own infected version of the file. If you remove the infected file with Spybot, etc., the registry then points to a file that no longer exists. Without the original file in place, you can no longer login to Windows.
THE FIX:
You need to have access to the computer’s registry to identify the value of the Userinit registry key. To do this, you’ll need a boot CD like BartPE or UBCD (Ultimate Boot CD) that includes a registry editor. The following assumes you have an UBCD.
1. Boot from the CD, and select Launch “The Ultimate Boot CD” from the menu.
*** Note: If the UBCD doesn’t load and instead Windows loads, you must configure your BIOS to boot from the CD-ROM before the hard drive
2. Open the remote registry editor. Click Start -> Programs -> Registry Tools -> RegEdit (Remote)
*** NOTE: You will be presented with the message “Do you wish to load remote user profile(s) for scanning”. Just click NO and the registry of the local machine should load.
3. Navigate to the Winlogon folder by clicking the plus symbols beside the registry folders
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\
4. Double click the “Userinit” key. Change it’s value to “C:\Windows\System32\userinit.exe”. Try rebooting. If you are now able to login, you are finished. If not, the userinit.exe file may be missing or it may be corrupt in which case you will have to copy the userinit.exe file from the UBCD to your System32 directory.
5. Reboot the computer with the UBCD still in the drive.
6. This time, select to enter the Windows recovery console.You will see a blue screen as files are loaded into memory.
7. At the “Welcome to Setup” screen press the ‘R’ key to enter the Recovery Console.
*** Note: If you get an error message stating “Setup did not find any hard disk drives installed in your computer”, you will have to recreate a new UBCD with SATA drive support. To learn how to do this, click here.
8. Once you are at the recovery console, issue the following command:
copy X:\I386\System32\userinit.exe C:\Windows\System32\
“X” being the drive letter of the CD-ROM that the UBCD is in (typically D, E or F).
The file should copy successfully. Restart the computer – you should now be able to login to Windows.
Related Posts
29 Responses to “Windows XP Logs out as soon as you Login”
Leave a Reply
February 16th, 2009 at 8:19 am
Hey I have the problem you are talking about and I finally got UBCD and am now at the registry editor. How exactly do I “navigate to the userinit key”?
February 16th, 2009 at 12:39 pm
Hi Joe,
What you need to do is click the little plus sign beside HKEY_LOCAL_MACHINE to expand it. Then you would click the plus sign beside SOFTWARE, etc. Keep drilling down until you find the userinit key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit
February 18th, 2009 at 9:20 am
Thank you for your help but I am still confused. When I boot from UBCD disk I have been selecting the offline NT password and registry editor which is DOS I believe and I can’t click anything you are talking about and am having trouble navigating through it to where I need to be. Sorry that I’m not understanding lol
February 18th, 2009 at 12:31 pm
No problem
When you boot from the UBCD disk, you should select:
Launch “The Ultimate Boot CD for Windows”
Once Windows loads, click the start button, go to programs, hover the mouse over “registry tools”, and then click on “RegEdit”. You should now be able to navigate to the userinit key as described above.
February 18th, 2009 at 8:40 pm
OH! haha well that was easy, I was going in the wrong direction. Thank you so much for your help you have saved my computer (life)
February 18th, 2009 at 9:20 pm
Glad I could help.
February 19th, 2009 at 11:16 am
agh, one last question, I thought I had it figured out but I guess not lol.
when I’m at the recovery console, for I know you said to use whatever the name was for userinit key but all I saw and wrote down was name: Userinit type: REG_SZ and then data: X:\I386\system32\userinit.exe,
February 19th, 2009 at 11:56 am
did not mean to end that last one with just that, but what I meant to say was “for …”
I don’t know what to put for filename, I tried the long X:\I386yada yada yada but it’s saying the system cannot find the file specified.
February 19th, 2009 at 12:39 pm
Okay, just try changing the userinit key to read:
C:\Windows\System32\userinit.exe
Then restart the computer and see if it works.
February 19th, 2009 at 12:49 pm
If that doesn’t work, it may be that the userinit.exe file is either corrupt or been deleted. Then try the following:
From the recovery console, manually copy userinit.exe from the X:\I386\SYSTEM32 folder to C:\Windows\system32\. (X:\ being the UBCD drive)
February 19th, 2009 at 1:10 pm
Do I change the userinit key on the boot CD after I double click it and it has that crazy path?
February 19th, 2009 at 1:26 pm
Yes, boot using the UBCD, open the registry editor and open the key (by double-clicking it):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit
Change it’s value to:
C:\Windows\System32\userinit.exe
Try rebooting and see if it works.
February 19th, 2009 at 1:49 pm
alright that didn’t seem to work, how would I go about doing the other method you suggested, sorry I’m needing such specific instructions
February 19th, 2009 at 1:57 pm
Okay if that didn’t work then the userinit.exe file may not exist or it may be corrupt.
Enter the windows recovery console from the UBCD menu. Copy the userinit.exe file from the UBCD to the system32 directory by typing the following:
copy X:\I386\system32\userinit.exe C:\windows\system32\
Where ‘X’ will be the drive letter of the CD-ROM that the UBCD is in. IE: probably D, E, or F
February 19th, 2009 at 2:10 pm
Should I navigate to C:\Windows\System32\userinit.exe before entering this command or does it matter
February 19th, 2009 at 2:11 pm
oops minus userinit.exe
February 19th, 2009 at 2:16 pm
disregard that, it said that the file was copied, am I good to go?
February 19th, 2009 at 2:16 pm
no, it’s simpler to just type the full command
copy X:\I386\system32\userinit.exe C:\windows\system32\
that way you don’t have to navigate anywhere
February 19th, 2009 at 2:16 pm
if the file copied, then try restarting and see if it works.
February 19th, 2009 at 2:20 pm
I was able to log in, (THANK GOD)
February 19th, 2009 at 2:24 pm
lol great, I’m happy that it finally worked
February 19th, 2009 at 2:29 pm
Yeah I guess I don’t have to change the value of userinit still do I? Internet doesn’t seem to be working, either, might be another issue, but I’ll check into all that when I get back from work, thanks for everything, you’ve been a great help!!
February 19th, 2009 at 2:34 pm
No, you don’t have to change the value as it is now pointing to the correct file.
Depending on the type of spyware you had, it may have damaged other system files. Worst case scenario, you would have to run a Windows XP repair install from the XP CD.
Good luck with your Internet issue.
Your welcome
March 25th, 2009 at 7:20 am
I have the same problem as Joe, but I do not see a winlogon folder where you say to find it. No folder is visible using the registry editor.
any ideas?
April 6th, 2009 at 7:31 am
Hi, same problem here, but I’m confused as to how I
Launch “The Ultimate Boot CD for Windows”
I have been typing this in at the bot screen but it says cannot find kernel image, am I doing something wrong?
April 6th, 2009 at 10:46 am
The computer should boot from the UBCD when you have it in your CD-ROM and reboot the computer. Once booted, the CD gives you several options (ie: test memory, load Windows Recovery Console) including “Launch Ultimate Boot CD”. At least, the last version I used had this menu.
April 28th, 2009 at 12:08 pm
The problem is that UBCD loads ITS OWN Registry and NOT the Windows Registry. That’s why you are seeing X:\I386\System32\userinit.exe
That’s a virtual drive that UBCD uses. If you inspect the rest of the Registry, such as HKLM/Software, you’ll see that the only software in there is the UBCD utilties and not your PCs apps.
I’m not sure how you were able to connect to the local Registry instead of UBCD’s.
but I was able to copy the userinit.exe over and that fixed the problem.
however, a virus writer could change the registy key to point to userinit2.exe and I wouldn’t know the location changed. Would be nice if you could explain how you were able to view your PC’s registry and not UBCD’s.
April 28th, 2009 at 6:25 pm
The problem may be that you are using the NORMAL registy editor instead of the REMOTE registry editor. My UBCD (v 3.13) has an icon on the desktop named “Remote Registry”. Click on that, and the registry of the connected hard drive should load. If you click Start -> Programs -> Registry Tools there are several registry editing tools including “RegEdit” and “Regedit (Remote)”. Going into “RegEdit” will bring up the registry of the UBCD. Going into “RegEdit (Remote)” will load the connected hard drive’s registry.
Note: When you click on “RegEdit” remote it will ask you “Do you wish to load remote user profile(s) for scanning”. Just click no and the registry should open.
April 28th, 2009 at 6:27 pm
I’m noticing that my instructions weren’t accurate. I’ve updated them in the main post.