Windows login logout session
bullsabs
Posted messages
8
Status
Membre
-
Fred QC -
Fred QC -
Hello everyone
I have a small problem to bring to you, who can help me, please?
When I start a Windows XP session by clicking on my user icon, my session opens for a quarter of a second and immediately disconnects. I therefore no longer have access to my PC?
I have already repaired it with the original XP DVD but the same problem comes up every time.
Who could help me solve this problem?
Thank you
Bullsabs
I have a small problem to bring to you, who can help me, please?
When I start a Windows XP session by clicking on my user icon, my session opens for a quarter of a second and immediately disconnects. I therefore no longer have access to my PC?
I have already repaired it with the original XP DVD but the same problem comes up every time.
Who could help me solve this problem?
Thank you
Bullsabs
64 réponses
- 1
- 2
- 3
- 4
Suivant
Problem solved
In short, a virus can erase the value of the registry or delete the userinit.exe file (virus BlazeFind for example)
Solution:
1) The problem often comes from the removal of spyware (blazefind or hijack), which modifies the registry (HKeyLocal Machine\SOFTWARE\Microsoft\WindowsNT\Current Version\Winlogon) by adding or replacing Userinit.exe with wsaupdater.exe.
So if you delete this file, XP cannot find the file to log in.
2) Solution: first, in console mode, copy the file c:\windows\system32\userinit.exe to wsaupdater.exe
3) log in and modify the above key with regedit as follows:
HKeyLocal Machine\SOFTWARE\Microsoft\WindowsNT\Current Version\Winlogon: replace the content with "userinit.exe
If console mode scares you, you can always mount your disk as a slave in another PC to copy this file.
In my case, the file was present but the value of the registry key was empty, so I gave it the value userinit.exe and everything is fine, sorry for those who formatted and good luck to the others....
In short, a virus can erase the value of the registry or delete the userinit.exe file (virus BlazeFind for example)
Solution:
1) The problem often comes from the removal of spyware (blazefind or hijack), which modifies the registry (HKeyLocal Machine\SOFTWARE\Microsoft\WindowsNT\Current Version\Winlogon) by adding or replacing Userinit.exe with wsaupdater.exe.
So if you delete this file, XP cannot find the file to log in.
2) Solution: first, in console mode, copy the file c:\windows\system32\userinit.exe to wsaupdater.exe
3) log in and modify the above key with regedit as follows:
HKeyLocal Machine\SOFTWARE\Microsoft\WindowsNT\Current Version\Winlogon: replace the content with "userinit.exe
If console mode scares you, you can always mount your disk as a slave in another PC to copy this file.
In my case, the file was present but the value of the registry key was empty, so I gave it the value userinit.exe and everything is fine, sorry for those who formatted and good luck to the others....
Hey, I just had this problem on my laptop yesterday when I got up (great ...) and it's really because of MSN. A window said "someone has posted your pic on this site" and I, like an idiot, clicked it. Now, three days later, I enter my password to log into my account and I get logged out right away. I'm not very good with computers, I'm trying to follow the information from pcweb and scrat34, but I'm having a bit of trouble. Is it necessary to dismantle the laptop to test the hard drive on another PC?
Hello everyone,
I have a login problem on a workstation at the agency where I work.
Thanks to a live CD (UBCD4W), I was able to check the integrity of the userinit key by loading the hive of my faulty system, and I also verified the presence of the userinit.exe file in my system folder.
Thinking that I might have an integrity issue with this file, I replaced it with the userinit from my healthy workstation.
After a standard reboot, my problem persists: I can't log in either locally or on the domain. Safe mode has the same issue.
MSN Messenger is not installed on this machine.
I cannot afford to completely reinstall the workstation due to the presence of very expensive specific software that requires the intervention of an outside technician for installation (which is charged very highly).
Thank you for your help.
Yann
I have a login problem on a workstation at the agency where I work.
Thanks to a live CD (UBCD4W), I was able to check the integrity of the userinit key by loading the hive of my faulty system, and I also verified the presence of the userinit.exe file in my system folder.
Thinking that I might have an integrity issue with this file, I replaced it with the userinit from my healthy workstation.
After a standard reboot, my problem persists: I can't log in either locally or on the domain. Safe mode has the same issue.
MSN Messenger is not installed on this machine.
I cannot afford to completely reinstall the workstation due to the presence of very expensive specific software that requires the intervention of an outside technician for installation (which is charged very highly).
Thank you for your help.
Yann
Good evening,
Well, I reformatted the disk, after investigation the virus might be Restarter.F from MSN (click on a photo)
http://www.secuser.com
the solution might be to test MSNfix
bye
Well, I reformatted the disk, after investigation the virus might be Restarter.F from MSN (click on a photo)
http://www.secuser.com
the solution might be to test MSNfix
bye
Hello, I have the same issue with opening a session but I can't access safe mode.
If anyone can help me, thank you in advance
LOLO
If anyone can help me, thank you in advance
LOLO
I managed to regain access to the PC by reverting to the original configuration. (Admin session)
The problem is that two of the users can find their personal folders, but two of them cannot.
I think they are still on the hard drive (volume), but I can't find them.
Is there a procedure to thoroughly explore the hard drive and thus retrieve my data?
Thank you
I really find this forum very rich.
LOLO
The problem is that two of the users can find their personal folders, but two of them cannot.
I think they are still on the hard drive (volume), but I can't find them.
Is there a procedure to thoroughly explore the hard drive and thus retrieve my data?
Thank you
I really find this forum very rich.
LOLO
For those who have no idea how to change the value in the registry without having to log in as a user on Windows, I used Ultimate Boot CD for Windows (it's a free software), you boot the computer from the CD-ROM and it then emulates an operating system that works without the need for a hard drive to operate.
Once booted:
In the system tray near the start menu, there's the quick launch area, just click on the registry editor icon (a light blue cube).
It will ask you if you want to open the Registry with a different username, do so and specify a username that has Administrator privileges or simply use the name Administrator.
Once the editor is open, look for the key ''HKeyLocal Machine_on_C'' the letter C represents the drive letter on which your Windows is installed. If you only find the key ''HKeyLocal Machine'' without the on_C, it means you are seeing the registry key of Windows that is on the CD-ROM and not the one on your hard drive.
A file explorer is also available on this CD-ROM, so use it to check that userinit.exe is indeed on your hard drive, as a good key value without the file being present is useless; you will have the same problem.
Once booted:
In the system tray near the start menu, there's the quick launch area, just click on the registry editor icon (a light blue cube).
It will ask you if you want to open the Registry with a different username, do so and specify a username that has Administrator privileges or simply use the name Administrator.
Once the editor is open, look for the key ''HKeyLocal Machine_on_C'' the letter C represents the drive letter on which your Windows is installed. If you only find the key ''HKeyLocal Machine'' without the on_C, it means you are seeing the registry key of Windows that is on the CD-ROM and not the one on your hard drive.
A file explorer is also available on this CD-ROM, so use it to check that userinit.exe is indeed on your hard drive, as a good key value without the file being present is useless; you will have the same problem.
Hi everyone.
I have the same issue on a colleague's machine. The winlogon and userinit files have been replaced with valid ones, and the registries are correct. Msnfix detected and cleaned 3 files. However, the login still goes into automatic disconnection mode.
For your information, when you want to use your machine without logging in (or when it doesn't work), you just need to reboot in 'command line safe mode', where the administrator login works and opens a 'cmd'. But you also have the option in this mode to do a 'ctrl alt delete' and thus go into the task manager. There, you simply go to the 'processes' tab and from the 'file' menu 'new task', you just need to type 'explorer' or regedit or any other command......Admire the result......
As for my problem, if someone can tell me what happens between winlogon, userinit, and the display or reading of the user profile, I might know which file is triggered to cause the disconnection.
I have the same issue on a colleague's machine. The winlogon and userinit files have been replaced with valid ones, and the registries are correct. Msnfix detected and cleaned 3 files. However, the login still goes into automatic disconnection mode.
For your information, when you want to use your machine without logging in (or when it doesn't work), you just need to reboot in 'command line safe mode', where the administrator login works and opens a 'cmd'. But you also have the option in this mode to do a 'ctrl alt delete' and thus go into the task manager. There, you simply go to the 'processes' tab and from the 'file' menu 'new task', you just need to type 'explorer' or regedit or any other command......Admire the result......
As for my problem, if someone can tell me what happens between winlogon, userinit, and the display or reading of the user profile, I might know which file is triggered to cause the disconnection.
Thank you for all this very useful information!
My question: I created a CD-ROM with UBCD4Win, it works fine, but when I reboot the PC with the CD-ROM and request to start in command-line safe mode with F8, Windows does not give me access to the command line. It goes directly to the login screen, which is useless since it disconnects automatically even with the admin user.
Do you have any ideas? Thank you for your help.
Eric
My question: I created a CD-ROM with UBCD4Win, it works fine, but when I reboot the PC with the CD-ROM and request to start in command-line safe mode with F8, Windows does not give me access to the command line. It goes directly to the login screen, which is useless since it disconnects automatically even with the admin user.
Do you have any ideas? Thank you for your help.
Eric
Hello,
I have the same problem and I don't understand how to solve it either.
I got the Ultimate Boot CD for Windows software but I don't understand how to use it since my PC doesn't recognize anything anymore!!! Should it automatically boot when I insert it?
I can't call a professional and I would like a solution that is maybe a bit more detailed if possible.
Thank you in advance.
I have the same problem and I don't understand how to solve it either.
I got the Ultimate Boot CD for Windows software but I don't understand how to use it since my PC doesn't recognize anything anymore!!! Should it automatically boot when I insert it?
I can't call a professional and I would like a solution that is maybe a bit more detailed if possible.
Thank you in advance.
Another thing...
I heard about Linux Live CD to recover my files. What is it and how does it work?
I need to recover some files pretty quickly and I'm worried about getting in trouble... :s:s
I heard about Linux Live CD to recover my files. What is it and how does it work?
I need to recover some files pretty quickly and I'm worried about getting in trouble... :s:s
Hello, I had the same problem as Brigitte; I connected the HDD via USB to another PC to run MSNFix on it, but it didn't find anything. I reinserted the HDD into the tower, and I’m currently booting from a live CD to try the tips from pcweb. I'll keep you updated on how it goes!
pcweb could you contact me at bachelotg@gmail.com please, I have 2 or 3 questions to ask you, some little points to clarify =)
Hello everyone,
thanks to pcweb for the information and I would like to clarify the process:
it is indeed this empty registry key
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Winlogon\userinit and it needs to be modified by putting C:\WINDOWS\system32\userinit.exe in place of the empty value
to access this key when the system won't start, there are 2 solutions:
1- connect the non-booting disk to another PC with an external case
launch the registry editor (regedit)
go to the HKEY_LOCAL_MACHINE branch
go to file and click on load hive
locate the registry file of the non-booting disk, you need to take the SOFTWARE file from \WINDOWS\system32\config of the non-booting disk
it will ask for a key name, you can put whatever you want
then simply go find the empty key in this branch: \Microsoft\WindowsNT\CurrentVersion\Winlogon\userinit
and modify it
unload the hive (file unload hive)
you can put the disk back on the PC and it will boot
2-you can use a Windows autoboot disk (like bouldows) and follow the same procedure as in 1
I tested it on a laptop and I had no issues
I then ran the MSNFix that can be found on www.secuser.com
the PC is working again and I haven't lost anything
hoping to have helped you
thanks to pcweb for the information and I would like to clarify the process:
it is indeed this empty registry key
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Winlogon\userinit and it needs to be modified by putting C:\WINDOWS\system32\userinit.exe in place of the empty value
to access this key when the system won't start, there are 2 solutions:
1- connect the non-booting disk to another PC with an external case
launch the registry editor (regedit)
go to the HKEY_LOCAL_MACHINE branch
go to file and click on load hive
locate the registry file of the non-booting disk, you need to take the SOFTWARE file from \WINDOWS\system32\config of the non-booting disk
it will ask for a key name, you can put whatever you want
then simply go find the empty key in this branch: \Microsoft\WindowsNT\CurrentVersion\Winlogon\userinit
and modify it
unload the hive (file unload hive)
you can put the disk back on the PC and it will boot
2-you can use a Windows autoboot disk (like bouldows) and follow the same procedure as in 1
I tested it on a laptop and I had no issues
I then ran the MSNFix that can be found on www.secuser.com
the PC is working again and I haven't lost anything
hoping to have helped you
Thanks to scrat34.
I caught this virus a week ago and since then I've struggled quite a bit searching for solutions until I stumbled upon this forum and this message 21.
I opted to boot from a bootable CD => UBCD4windows created on another computer, and then I just had to follow your instructions. For unloading the hive, you need to remember to go back to the key that you created specifically for this operation, and it's bingo.
Just one last question: How can we be sure that the virus responsible for modifying this registry key is no longer active on my computer?
I caught this virus a week ago and since then I've struggled quite a bit searching for solutions until I stumbled upon this forum and this message 21.
I opted to boot from a bootable CD => UBCD4windows created on another computer, and then I just had to follow your instructions. For unloading the hive, you need to remember to go back to the key that you created specifically for this operation, and it's bingo.
Just one last question: How can we be sure that the virus responsible for modifying this registry key is no longer active on my computer?
https://www.casimages.com/i/0803190304482672329.png.html
Arriving here, I have no idea where to go, I can't see Winlogon?
Thank you in advance.
Arriving here, I have no idea where to go, I can't see Winlogon?
Thank you in advance.
Actually, I was on Ubuntu and I was using regedit thanks to Wine... so it must not be the regedit associated with Win XP, I suppose.
Anyway, I searched for where to find bouldows but I only found very long download links on Emule and torrent.
And I can't find the registry editor in UBCD...
I'm not very skilled at this :-(
Anyway, I searched for where to find bouldows but I only found very long download links on Emule and torrent.
And I can't find the registry editor in UBCD...
I'm not very skilled at this :-(
https://www.casimages.com/i/0803190304482672329.png.html
Arriving here, I have no idea where to go, I don't see Winlogon?
Arriving here, I have no idea where to go, I don't see Winlogon?
Hello Scrat34,
I also have this problem: connection/disconnection on a laptop. I extracted the hard drive and connected it to another PC. Apparently, in REGEDIT we have the database of the PC on which we booted. I suppose that the "load hive" operation allows loading another registry? I have 2 SOFTWARE files: software.??? and software.txt. I took the first one but I don't feel like much is happening. In fact, when I go to the key it is not empty and "unload hive" remains grayed out. How can I be sure that the registry from the infected hard drive is loaded? Do I need to be in administrator mode or is a user account with admin rights enough?
Thank you in advance.
I also have this problem: connection/disconnection on a laptop. I extracted the hard drive and connected it to another PC. Apparently, in REGEDIT we have the database of the PC on which we booted. I suppose that the "load hive" operation allows loading another registry? I have 2 SOFTWARE files: software.??? and software.txt. I took the first one but I don't feel like much is happening. In fact, when I go to the key it is not empty and "unload hive" remains grayed out. How can I be sure that the registry from the infected hard drive is loaded? Do I need to be in administrator mode or is a user account with admin rights enough?
Thank you in advance.
Hi,
I don't know if you need to be an admin or not, but if you take the correct software file (in \WINDOWS\system32\config, it's the only one without an extension) it should ask you for the name you want to give to your new branch.
If it doesn't ask you anything, it means the file you took is not the right one.
In my folder, I have 3 software files:
1 without an extension, about 20MB (that's the one to take)
1 with a .log extension
1 with a .sav extension.
I don't know if you need to be an admin or not, but if you take the correct software file (in \WINDOWS\system32\config, it's the only one without an extension) it should ask you for the name you want to give to your new branch.
If it doesn't ask you anything, it means the file you took is not the right one.
In my folder, I have 3 software files:
1 without an extension, about 20MB (that's the one to take)
1 with a .log extension
1 with a .sav extension.
Hello everyone
ERD Commander does this well; it's a maintenance live CD that you need to boot from, and this way, access to the infected PC's registry can be easily modified.
ERD Commander does this well; it's a maintenance live CD that you need to boot from, and this way, access to the infected PC's registry can be easily modified.
- 1
- 2
- 3
- 4
Suivant
I'm not very good with computers, so I'm sorry, but the solution is really too technical for me.
Could you help me by guiding me step by step? It bothers me to go to Darty or elsewhere and pay €200...
Here’s a summary of my problem: I got infected by the MSN virus "masi que fait ta photo sur ce site."
And three days later, I can't open my session; it logs me out every time before I have a chance to reach my desktop.
I would also like to back up my data because, like an idiot, I haven't saved anything, and there are photos of my baby!
Thank you for your help,
Brigitte
If I'm sending you to see an IT technician like me, it's precisely because it's very technical, and explaining all of this in a step-by-step guide for average Windows users is like teaching a three-year-old boolean mathematics and combinatorial logic.
If you live in Quebec, however, I could help you since I’m physically there and I have all the necessary software.
Good luck!
Could you explain that to me in more detail? I have the same problem on a friend's computer.
Thank you in advance.
There is an operating system on your computer called Windows, which requires a multitude of different files (like userinit.exe) to function.
To be able to operate all these files, we need a logical structure, meaning a place where all the necessary information regarding your computer's hardware, user information, and information about the location of files required for the functioning of Windows is stored; we call this the Registry.
Since each computer has parts from different manufacturers and each user does not have the same desktop background, for example, Windows must note all these different parameters, and it does so thanks to the Registry.
To log into a user session, Windows needs two things:
The first is a file named userinit.exe, which is generally found in the System32 folder.
The second is a Registry Key, for example, UserConnection = 'userinit.exe' (a fictitious key for example), and thus userinit.exe is the value of this key.
When you log into your user session, Windows checks the value of this key in the registry to determine which file to use for the login.
If either of these two things is missing (file or registry key & value), Windows will not be able to log in with a user session.
Situation__________________
In my first post, we talked about the BlazeFind Virus; it's an old virus, and I would be surprised if you were affected by it in 2008. It's more likely to be a newer worm-type virus that attacks your Windows Live Messenger from another Windows Live Messenger from one of your friends who has you in their contact list, and so on, it spreads across the web and bothers everyone (it's like World War III; it doesn't hurt, but everyone suffers similarly :)
So if I were the virus, I could reach you in several ways to create this anti-connection, either by deleting userinit.exe from your PC or by penetrating the registry and deleting the key that tells Windows to use userinit.exe.
But my dear brilliant and malicious programmers have something better for you:
The virus replaces the userinit.exe file with wsaupdater.exe in the System32 folder and tells your registry to have Windows use the wsaupdater.exe file to log in, so the key UserConnection = 'userinit.exe' (a fictitious key for example) changes to UserConnection = 'wsaupdater.exe' (a fictitious key for example).
So if your antivirus encounters the 'wsaupdater.exe' file (a virus-infected file that records your user passwords, for example) on your hard drive, it will delete it or probably quarantine it, and at that moment, Windows will refuse any connection despite itself because the registry now tells it to use a file that is no longer present on the hard drive for user connections.
That's what this nasty BlazeFind was doing.
Currently, all computers that have this problem have not had file modifications; the virus simply deletes the value of the userinit.exe key in the registry, so UserConnection = 'userinit.exe' (a fictitious key for example) becomes UserConnection = ''empty'' (a fictitious key for example).
Then Windows goes "crazy" and doesn't know how to connect a user anymore.
I hope I have clarified some points for some.
Eric D.
I wish you good luck :)
When you say to copy "copy the file c:\windows\system32\userinit.exe to wsaupdater.exe ", I'm having difficulty understanding. Isn't it more like replacing? Or maybe there's a specific command line to type? (I've never used the console mode so far)
Thank you.