Hello,
ive recently hit a snag, my windows xp boots up as usual to the log on screen, as soon as I imput my password, windows will play the log on sound and then just automatically log me off again, ive had many attempts to try and get windows to stay running including booting from CD and repair, but unsuccesful.
is there another way, a friend of mine suggested trying to activate the guest account at the log on screen, but I have no knowledge how and neither does he, will this rectify the problem for now?
i am planning on getting a new pc soon, but need access to my user account as there are many important documents for my work on it as well as 10Gb of music that I dont want to see vanish
any and all help is greatly appreciated, thank you
NOTE: These files may also be deleted by spywares. You may need to extract them using Windows CD.
Steps for rectifying this problem:
Log on to a networked computer.
Run Regedit.exe
Point your cursor to HKEY_LOCAL_MACHINE
Select File > Connect Remote Registry
Type computer name (infected computer)
Navigate to the following location in registry of destination or infected computer
Change these two values to
Shell=explorer.exe
Userinit = x:\windows\system32\userinit.exe
Exit from Registry
Restart Infected computer.
You should be able to log on to computer.
if it not work then go to back steps and just copy orwrite the file userinit.exe
actually you are supposed to replace the "x" with the letter that is relevant to your particular setup, its like in algebra "x" can be anything.
in my case c:\ is my hdd with windows on it and d:\ is my dvdrom but I have other setups where its completely different
now on a more serious note if the registry entries he mentioned are intact(ie the way they are supposed to be) the issue could be a missing userinit.exe file. more clear instructions on how to replace it would be helpful so here's what happened to me last night.
but in my case I got the "file could not be created" error so I expanded the file to another directory (the root of c:\) and used "winternals erd commander 2005" and moved the file to the system32 folder, that solved that issue
if you don't have "winternals erd commander" cd you could use somthing else like a PE cd such as BartsPE or even a Linux live cd like ubuntu.
for more information use google search and try not to read Microsoft's "official" help they are confusing. reading is good for you (at least they say it is) so read as much as you can about how others solved this issue as well, I have only given details of my latest effort, its different everytime.
hi, I've seen everything you wrote about. mine stared when my antivirus deleted a virus from my computer. the problem I'm having right now is that I don't have a windows xp cd available around me and this system has to work sometime soon. also I do not have the cables necessary to connect the hard disk to another system and copy the file. I only have a flash drive with me. is there anyway I can copy the userinit.exe file from another system into the flash drive then also copy it to the necessary drive on the infected computer
as stated above you can make use of a knoppix cd to boot the pc with linux and then use USB stick to copy userinit.exe from abother maschine to this maschine.
Knoppix can be found here http://www.knoppix.org/
I was able to get the Knoppix boot disc. How EXACTLY do I do all of this (use USB stick to copy userinit.exe)?
And how do I get userinit.exe? Do I still put it on a usb stick when using Knoppix? Step-by-step instructions is what I need. I know it's a lot to ask, but like most here, i'm having trouble.
I'm having the same problems as everyone else. I get to the xp logon screen, insert my password and it logs right off. I don't have the XP boot disc, but I do have Knoppix and it's my first time using it (go easy on me please).
Havent tried the fix yet.... just wanted to say that its a pity idiots like you exist....
Waqar took his time to post a fix and because you lack inteligence you insult him?
Really impressive
For those that don't deal with computers day in and day out, one should comtimplate that and state what drive letter to use or at least refer to a note at the end of the reply. But I am sure that's what you would have done.
What are you; his mother?
You're an idiot, Rodes. Why don't you try and find a solution instead of spewing your bullshit all over here and acting like a complete bafoon.
I'm having a similar problem - my computer logs in for about a minute or so then logs off and shuts down. What makes matters worse is that it is doing the same thing in safe mode and my computer won't stay logged on long enough to find a fix/solution.
Why should he have to explain something in so much detail? He is an advanced computer user obviously, and it is very hard to explain complex things to others in a friendly tone when you are used to other computer terminology. I have had trouble with these issues myself as I have tried to explain things in a way that an average user would understand. Take it easy on him, it's hard to explain something simply with advanced knowledge on a subject. Besides, if you can tell me any time that someone named their home drive X, let me know.
Dude - X means the location of where windows is installed. It could be either C or D most likely. You don't put x. I know this is IT lingo. if you don't understand you might want to take your damn PC to Geek Squad where they will be sure to screw it up for you some more.
After file userinit.exe was replaced all work ok. I take off HDD and connect to other PC and copy file from c:\Windows\System32\userinit.exe to connected HDD.
My userinit.exe got cleaned up by AVG after a Trojan infection. These posts got me out of trouble:
* waqar, on Tuesday December 30, 2008 04:50:00 AM
* the_apocalypse, on Friday January 2, 2009 03:29:00 AM
* SNoWDoGG, on Thursday January 22, 2009 01:20:29 AM
that worked, thanks alot. Atleast now I can get in to windows really quick and get my files and then reformat the drive.
this is the worst virus I ever saw. It stops you from getting to task manager, run, and by the time nortons or ad-aware new their was a virus it was already to late. the antivirus or virus tells you to reboot and when you do, you are now locked out of your computer. Whoever made this virus is very talented. Its a shame that much talent is used in such an evil way.
Oh please. It takes little talent to create a virus. It takes alot of talent to defeat a lonley low-lifes hard useless work. There not a virus created that hasnt been defeated in half the time it took to create it.
I've tried the userinit.ex_ solution, bu the system shot back with no disk in d: drive and when I tried to open the d: drive it's not responding.....any thought?
Dear friend: Your suggestion about replacing userinit.ex_ from installation CD did the trick! Thanks for being out there for source of knowledge and solution! Wish you all the best in all your present and future endeavours :)
~KB*
I do this but it says access denied after having typed the EXPAND command and i'm pretty sure I never put a master password so i'm a bit stuck here :(
Any help would be greatly appreciated
Thank You
This solution worked for me as well. Working on a customer PC that would freeze on a regular boot, but safe mode boots logged off right away after login. Cleaned a large portion of the drive using an external USB adapter and another PC (NIS and Malwarebytes found several viruses/trojans, etc), then regular booting had the same issue. After using this (expand d:\i386\userinit.ex_ c:\windows\system32\) off an XP Pro disk Recovery Console boot, was able to boot into safe mode, now running scans to finish cleaning up his virus/malware issues. Thanks for the solution that got me past the login issue =)
This worked for me. I was just about to reformat the disk and figured id try searching one more time for a fix im scanning right now saw a bunch of porn shortcuts on my screen when I logged in but at least im finally in my computer after two weeks of this logoff loop junk. Thanks alot.
i just did what I copied the wininit file from C:/windows/system32 of another system and had it in a USB
and in the recovery console copied it to my own C:/windows/system32 folder
and it worked fine :D thank you
and yeah my computer doesnt have a CD rom its a Notebook soo I had my own Bootable usb to work on it
Thanks again
Hi, I have tried your method, but didnt work for me. What I did was I copied c:\windows\system32 to the infected pc from another pc. Problem remain the same. Any advise?
when putting in your fix (expand d:\i386\userinit.ex_ c:\windows\system32\ , I get the message (there is no floppy disk or cd in the drive) and I have win xp install cd in. could you please help me on this.
Thanks
Hi,
Just been looking at posts by you regarding the auto log off when starting up windows XP. I see everyone thinks your post works but I don't understand wher you put this propt into? I'm useless when it comes to computers. Would you be kind enough to give me a step by step guide or know where I can get one.
Also I don't have the original CD etc.
I'm having the similar problem, except it happened on my laptop ... I had a Trojan virus removed it with AVG and now I cannot log in at all. I've tried the Safe Mode and the Networking Mode, but it wouldn't log me into my admin account either. I have no idea how to remove the HD on a laptop. I have an Hp Laptop and its running Windows XP.
Def.Confused.....did you ever get a fix for your laptop? I am having the same problem and am not a computer tech....I have no clue as to how to get my laptop connected to my main PC and I don't have the XP CD.
For me, I just saw this infection again, as I have a few times before. This time, however, replacing the Userinit.exe file alone was not enough to get the system to log in. This time the virus not only removed Userinit.exe (under C:\Windows\System32), it removed the Registry String for it too.
as mentioned above, there's an entry/STRING showing up as "Userinit" with "C:\Windows\System32\Userinit.exe," as the Value Data (No Quotes are to be used obviously). Don't be dumb like me though, I was stressing out when I had put a ";" versus just the "," which will cause the same Log On/Log Off issue to happen.
To modify the registry, I used a combination of ERD Commander & Bart PE Boot discs.
If you're looking for a replacement Userinit.exe file, you can sometimes use the one under
C:\Windows\System32\Dllcache
but if it's infected, you can copy the Userinit.exe from C:\i386 (if it exists).
I normally replace the Userinit.exe from C:\i386 to:
C:\Windows\System32\Userinit.exe
C:\Windows\System32\Dllcache\Userinit.exe
My post is repetitive, I know, but at least it lets you know to be on the lookout for a missing Userinit String under Winlogon
Just wanted to say thanks a lot for the tip. After hours of searching I realised the userinit.exe had been removed somehow and I just replaced it with one from here
https://www.cyren.com/f-prot-eol-announcement
Waqar,
IT WORKED!!!!You are brilliant, I've been f^%king with this issue for the last 8 hours and came really close to swapping out my machine for another out of frustration. I don't care what Robes says, I would have your baby! Now I can finally get some GD work done. You da man, man.
hello I know this was last year but if I can log in how to I get to these steps. u placed on waqar, on Tuesday December 30, 2008 04:50:00 AM
+11Edit these values and type the correct path of shell :
please help thanks
I am having issues, I have a Vista PC and and XP sp2. the issue is on the XP. I cannot get the 2 machines to see each other to be able to edit the other one's registry. any suggestions?
in the Registry editor
file menu I can't see "connect remote registry" but there is "connect network registry"
After I connect network registry I use the advanced then find now to selct the network (infected) computer.
once I select the below key, there is an error shows as below :
Hi, I dont know if you use this anymore, but I cant find my system recovery disc, is there any other way to fix the log off? It will not log in as administrator /safe mode either. Please Help
sorry to bother about this, but I have hit a wall trying to fix this problem.
I am running XP sp2 and I got a virus Internet SEcurity 2010..pop ups. So I updated my norton and tried to fix it but now I have the auto log off. So I have tried copying, deleting etc the userinit and wsaupdater files with no success so I thought I needed to fix the registry. I am trying to use Hirens CD to do that with no luck. I have alread spent a day & half on it.
Hirens - if I boot to mini xp and edit the reg. it doesn't seem to work.
if I try to run the reg edit tool I get a memory error
I tried to type in the name of my infected computer.. but I dont know it.. and also even if I did it wont let me type in the computer name box! plz help!!!
Hi Waqar,
I have similar prob of not able to log in in system (immidiatley logs out). I tried to change the values in REGEDIT (both values) but still problem remains.
I didn't understand the option of copy it frm other system. Do I need to connect other laptop (desktop) using network cable ?
Or if both machine machine connection to same wireless internet connection ?
Please help me.... I am in really bad shape.
I have copied the userinit file from the cd drive to me system root foler successfully, even promted me to overwrite. Unfortunately I came back to the same problem after I restarted. I think that relacing userinit is not the final solution as there may be other steps needed. Changing the resgistry was no option as you need to have 2 computers logged in to network eachother. Any suggestions?
What if I donl't have a networked computer? My personal computer will not let me logon, and keeps auto logging off after I failed to remove a trojan virus.
Hi There
You can try one of two things to start with.
Try booting into safe mode
On starting your pc hold down the F8 key you should be taken to a menu to boot in safe mode.
When you get to the logon screen select the Administrator account.
If you cant do that take you Hard drive out and put it in your mates pc or another pc if you have one and transfer the files that way.
These will only work If your hard drive is not faulty.
Hi,
Bassically I have a server 2003
but 15 users assign on server
but all users are automatically
logoff after several minutes
how to solve this problame
Hi there I noticed you helped a guy with his log in problems. Well unfortunatey I have a similar issue. I had a Trojan Horse virus on my PC so I managed to download AVG 8.0 antivirus. I ran the software which detected and removed the virus however when I log in now the system automatically log me back out. To make matters worst I cant remember the administrators password.
This is due to some virus.when you reach the welcome screen of XP press "Alt+Ctrl+Delete" or "Ctrl+Shift+Esc".
The popup logon window open and prompt you for Username and Password.
In that type "administrator" in the name field and leave blank password field press "OK".
Now you logon into the administrator account which is defaultly present in the XP.
Ok, I pretty much had the same problem....trojans, removed with AVG and now the auto log off problem. I tried to get in the administrator but I am getting a login message of Unable to log you on because of an account restriction.....can you help me???? Anyone????
what did you do to solve this issue My wifes pc is doing the same thing and am trying to get into it to pull a major term paper for her for college off and as you stated it logs off instantly
you could use a live cd to access to data she need I found puppy to be fast and easy to learn and it's only 100mb and you can fix every thing you could ever break
4 days ago a friend of mine reported the same problem, after log on windows automatically logs off again.
I read the solutions here and were sure it will take only some minutes to fix this.
But finally it took me 1 whole day to fix the problem.
Why? Let me explain my steps and how I finally solved this problem.
First I used knoppix to check whether userinit.exe exists in C:/windows/system32, it was there. Then I checked explorer.exe to be there in C:/windows. Then I tried to copy an userinit.exe / explorer.exe of my pc to this pc but this did not solve the problem.
Then I tried to logon remotely to the registry without success.
Finally I used an unix regedit tool to check the registry (used 2nd option under https://www.raymond.cc/blog/how-to-edit-windows-registry-key-values-without-booting-in-windows/ In the registry everything was fine, pointing to "C:/Windows/system32/userinit.exe,".
I also checked permissions on these files with knoppix, everything fine.
Finally I got it working by doing the following:
1) copying C:/Windows/system32/userinit.exe to C:/Windows/system32/userinitnew.exe
2) using tool from above to edit registry and set the winlogon value to point to userinitnew.exe
I am happy that the PC starts right now, but does anybody have an idea why this works with exactly the same userinit.exe from before when renaming it and changing the registry entry?
Thanks for your advice. I sucsess to repair my friend computer. I used mini PE, copy userinit.exe from my computer and copy to my friend computer as userinitnew.exe. After that I used Avast registry editor on miniPE, and edited registry of windows, find pointer of userinit.exe and changed to userinitnew.exe
After that, reboot the computer..... and...... sucsess....
how come you change the registry value of your friend computer? did you remove the HDD of your friend and put it on your computer to replace the userinit.exe to userinitnew.exe.
how to edit the registry value using avast ? did you used your friend computer to edit the registry?
Yeah, the only problem is that I have a Gateway laptop which doesnt have a CD driver, so I cant use repair/boot cd's... ive tried safe mode and my Administrator logs off too, is there any other way I can repair the log on log off virus without a CD or something?
1) Using a WinXP cd, I chose the Recovery Console option. Then I copied userinit.exe to a new file called userinitnew.exe. (this step isn't necessary in my case).
2) I downloaded a linux bootup cd that included a registry editor and proceeded to boot up the computer (with the linux cd).
3) When I navigated to the registry location I found that the Userinit key was pointing to c:\WINDOWS\system32\winlogon.exe instead of c:\WINDOWS\system32\userinit.exe.
4) I updated Userinit key to point to the proper file (e.g. c:\WINDOWS\system32\userinit.exe)
5) Also Pink Floyd helped!
after a virus attack and removing the malware from my PC,
Windows XP showed the logon-logoff-loop problem exactly
as Daniel reported it.
Now I did exactly the same as Daniel (renaming the unserinit.exe to
userinitnew.exe and changing the registry entry accordingly)
and the problem disappeared.
I am happy but I don't have any explanation for that simple solution.
HI, Daniel, I have the log-on, log-off problem after my computer got infected by trojan and run google antivirus tool, which I believe it alters the userinitnew.exe or winlogon file. My laptop is dual boot with ubuntu, so I have access to xp partition.
In the text, you wrote "unix regedit tool as above", I just can not find it from your hyperlink. So, what's the tool to edit regedit?
The solution proposed by waqar has worked perfectly for me. There was a bad reference for the userinit (twex.exe, spyware, of course). The file was deleted by the antivirus, but the registry key wasn't fixed: hence the autologoff behaviour...
Thanks a lot :-)
hi there..
i had a problem with my laptop keep logged off itself..it just show my wallpaper and then it just log off itself..i'ved tried the safe mode but it didn't work either..what should I do..
Hi,
basically I have a problame in my system
when start our pc after sever time automatically log off my pc
how to solve this problame please let me know soon
1. login to XP recovery console (after booting off XP CD)
2. from the c:\windows> prompt, type:
expand d:\i386\userinit.ex_ system32
Change d: to the drive letter of your CD-ROM.
Note that you must be in the c:\windows directory to type this command (this is the default directory in the Recovery Console)
The second parameter on the expand commandline tells it to write the expanded file into the system32 directory. (type expand /? for more info on the expand utility)
so after you type in those prompts and get back into windows, how do you restore all your original settings instead of it looking like you've just reinstalled windows?
hi, im having the same logon problems but userinit also cannot be found on my system. So instead of complaining how bad this guy is, why not try to help us who still cant login??? Im using a phone to write this! Someone must know something!
well I didnt have any password so I pressed enter and it worked but I did the command thin when its was on C:\windows> then I typed the expand d:\i386\userinit.ex_ system32
but it said the "the command is not recognized type help for a list of supported commands please help
Hey ALL
I found the Solution of the problem.
When I lost my Userinit.exe file it may cause automatic logoff when we try to log on with any user.
Don`t try enything else.
Just bring a windows xp Bootable Cd Then Boot form that Disk
And Follow these Steps.
Start Recovery Console ( Press R in the First Screen)\
Choose your windows 1/2/3 or Other
provide password
Command Prompt will appears
type
copy g:\I386\USERINIT.EX_ C:\WINDOWS\system32\USERINIT.EXE
(G is the CD Rom Drive Replace it with your CD Rome Drive alphabet)
if 1 files coppied massege appears
You have done all well
type exit : The system will rebooted
You have done well Enjoy
Let me explain what happen with ur computer (why u cant login into ur windows account).
1) u got a virus
2) it copied itslef, or it made a copy simmilar name to itself into ur WINDOWS/system32
3) it cahnged the registry key: HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ WindowsNT \ CurrentVersion \ Winlogon, and instead "Userinit.exe", it wrote its name
So, heres an example:
1) u got a virus, for an example, "winupdate86.exe"
2) it made a copy inside system32 as "winlogon86.exe"
3) changed registry key, and in entry putted "winlogon86.exe"
So, ur computer actualy loged on via virus, all time until ur antivirus deleted it (after that u couldnt be able to login). After ur antivurs detected and removed the virus( both "winupdate86.exe" and "winlogon86.exe") ur windows continues to look for "winlogon86.exe", couse it is on current place in registry,and its all it knowsto look for, when it try to login.
So, to solve the problem u need to (SOLUTION!!!)
1) only way to recover ur login is to find a copy of "userinit.exe" file (from XP DVD, from another computer...)
2) rename it to be as name of virus u had (u maybe dont know it, couse ur antivirus deleted it, but if u know u llbe able to fix ur login). So, sopy of "userinit.exe" rename to "winlogon86.exe"
3) put new renamed copy into ur system32 (Ofc, u dont have windows on ur computer, couse u cant login, but ucan plug off hard disk and plugin it to another computer. Other solution is if u can make bottable USB or Floppy disk DOS, and use simple copy function. 3th solution is if u have another operative system on ur computer, and manage coping there)
4) login ur windows normaly (now after u tricked ur regystry key, it still looks for same entry when it login, which was name of virus. But trick is u made a copy of real userinit.exe, and renamed to trick registry)
5) find via regedit HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ WindowsNT \ , and instead name of virus, put "userinit.exe"
Thats all, ofc if u still have virus would be great if u write its name before ur Antivirus delete.. If u still know it, just do steps. If u dont know actual name of virus u can do steps, but not gonna help u. Couse u need to know whats written in entry HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ WindowsNT \ . I found alctual name of my antivirus in way I go to search files inside my WINDOWS folder. And after it finished, I sorted all files with Modified Date, and Created Date... I found all files of virus in my system32... Deleted them and I had this problem... but after I saw all u people worte here I knew how to fix. Ofc I was lucky cuz I before deleting them, made a carantine. So I knew names. And with another comuter fixed.
@BokiSergy ....Your post is SPOT ON. Thank you!!!!
Yes, I did delete a bunch of viruses right before this happened to me. Only problem now is my virus was the deadly, ignorantly evil Win32 Virut. Soooo I'm going to cry now.
Reformatting is never an option, it's failure!
Fight Virut and put your results on YouTube.com so everyone can learn!!!!!!!!!!!!!!!
Manual steps to recover a corrupted registry that prevents Windows XP from starting
The procedure that this article describes uses Recovery Console and System Restore. This article also lists all the required steps in specific order to make sure that the process is fully completed. When you finish this procedure, the system returns to a state very close to the state before the problem occurred. If you have ever run NTBackup and completed a system state backup, you do not have to follow the procedures in parts two and three. You can go to part four.
Part one
In part one, you start the Recovery Console, create a temporary folder, back up the existing registry files to a new location, delete the registry files at their existing location, and then copy the registry files from the repair folder to the System32\Config folder. When you have finished this procedure, a registry is created that you can use to start Windows XP. This registry was created and saved during the initial setup of Windows XP. Therefore any changes and settings that occurred after the Setup program was finished are lost.
To complete part one, follow these steps:
1. Insert the Windows XP startup disk into the floppy disk drive, or insert the Windows XP CD-ROM into the CD-ROM drive, and then restart the computer.
Click to select any options that are required to start the computer from the CD-ROM drive if you are prompted to do so.
2. When the "Welcome to Setup" screen appears, press R to start the Recovery Console.
3. If you have a dual-boot or multiple-boot computer, select the installation that you want to access from the Recovery Console.
4. When you are prompted to do so, type the Administrator password. If the administrator password is blank, just press ENTER.
5. At the Recovery Console command prompt, type the following lines, pressing ENTER after you type each line:
md tmp
copy c:\windows\system32\config\system c:\windows\tmp\system.bak
copy c:\windows\system32\config\software c:\windows\tmp\software.bak
copy c:\windows\system32\config\sam c:\windows\tmp\sam.bak
copy c:\windows\system32\config\security c:\windows\tmp\security.bak
copy c:\windows\system32\config\default c:\windows\tmp\default.bak
6. Type exit to quit Recovery Console. Your computer will restart.
Note This procedure assumes that Windows XP is installed to the C:\Windows folder. Make sure to change C:\Windows to the appropriate windows_folder if it is a different location.
This is the Best of the Best But with One Problem I am Not responsible For Lost Data if You Lose data Just Get a Recovery data Software For your Pictures and Music Files...
I followed your instructions, but it wouldn't boot back up it said a password had been changed. I tried to go back into the recovery console but now it says I need a admin password even though I didn't have one before. How do I find this new password?
I followed your instructions, but it wouldn't boot back up it said a password had been changed. I tried to go back into the recovery console but now it says I need a admin password even though I didn't have one before. How do I find this new password?
I am tempted to try your solution, since it doesn't seem to involve the Bart PE CD (which I cannot burn, since we only have one PC, and we can't log on to it), but....you say there are four 'parts' to the procedure but there is only Part One listed, and this makes me think I'm going to get to the end of what you describe and find that there are more steps to follow.
Is what you have here the whole procedure? If not, any chance you've got the time and energy to write out the rest of the steps for us poor schlubs for whom the other solutions posted have not worked? (I've got the xp install cd, and can get into the recovery window, so that's not a problem).
And: is typing:
md tmp
part of the process? What does 'md tmp' do?
I am mostly a mac user trying to help my partner fix his pc, so I really need the step by step handholding, thanks for your patience!
So let me get this clear I download PE to a working computer, run it, then use my Windows disc for it to extract whatever files it needs then burn them to a disc. Then do I just put the disc in my "bad" computer, start it up and it will let me fix it by adding the strings discussed here? Do I just put it in or have to shut it down and put it in at start up? Will I still have all my original programs and files on my computey? Sorry to ask dumb questions when you all sound you know what you are doing and I am bumbling around like an idiot.
I tried creating another user going through safe mode,but that also didn't worked,So if u can log in through safe mode,then you can try restoring to early date.Its worked for me
I tried creating another user going through safe mode,but that also didn't worked,So if u can log in through safe mode,then you can try restoring to early date.Its worked for me
I had the same problem and you guys pointed me in the right direction.
I had neither of these files so I copied userinit.exe from another machine in my house to the laptop and that fixed it.
OK, I see many people still have this problem.. and some of them didnt have their own computer for Christmas/NewYear, spent vacations tring to find solution, whats sad...
1) To know whats written in registry key: HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ WindowsNT \ CurrentVersion \ Winlogon
Should be written userini.exe, if isnt change it to be using some software which can change registry of instalaion of windows in another operative system other, computer, or from MSdos. Somehow, try to find one good program for changing registry from DOS... I dont know any, but u try.
2) make a copy of original userinit.exe in ur WINDOWS\system32
3) Login regulary, should works!
Or
II' ) If u know the name of virus which was deleted from antivirus:
1) Copy userinit.exe from other computer into ur WIDNOWS\system32
2) Rename it to be like name of virus u had (if ur virus was updaterServer.exe, rename userinit.exe to be updaterServer.exe. Why? Because its written in HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ WindowsNT \ CurrentVersion \ Winlogon, and ur computer try to login on virus. But virus is deleted, and ur comp dont have with what to init a user. )
3) Login regulary, should works!
FAQ: How to copy file into system, or cahnge the registry when I cant login? Use any DOS, or plug hard disk to another computer...
Thank you so much for the information. This was a nasty virus/trojan. The following worked for me...
1) I was able to remove the hard drive and install it on a clean computer as a slave drive. I used Norton 360 to scan and rescan the drive until it was clean of virus.
2) I copied userinit.exe and winlogon.exe from the clean computer to the 2nd HD and replaced the existing files. And reinstalled the HD in the computer. Still had problems.
3) Created a BartPE recovery disk - best thing! Used BartPE to get access to the computer and used regedit to update the required information. (http://www.nu2.nu/pebuilder/ 4) This link was extremely valuable on how to load and edit the registry once BartPE had worked, as loading registries is not easy. https://www.winhelponline.com/xp/peboot.htm 5) Added Shell and Winlogon information to Registry keys (as the antivirus had removed them altogether)
Under HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
Shell=explorer.exe
Userinit = C:\windows\system32\userinit.exe,
(don't forget the , at the end)
Here's an easy fix if you have the XP install disk.
Enter the Recovery Console
Boot the system using the Windows XP CD-ROM. In the first screen when the Setup begins, read the instructions press "R" (in the first screen) enter the Recovery Console. Type-in the built-in Administrator password to enter the Console. You'll see the prompt reading C:\Windows (Or any other drive-letter where you've installed XP)
Type the following command and press Enter.
CD SYSTEM32
(If that does not work, try CHDIR SYSTEM32)
COPY USERINIT.EXE WSAUPDATER.EXE
Quit Recovery Console by typing EXIT and restart Windows.
You'll be able to login successfully as you've created the wsaupdater.exe file (now, a copy of userinit.exe)
Now, change the USERINIT value in the registry and change it accordingly.
Click Start, Run and type REGEDIT. Navigate to:
HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ WindowsNT \ CurrentVersion \ Winlogon
In the right-pane, change the value of Userinit to "C:\WINDOWS\system32\userinit.exe,"
Type the above value exactly as given, including the comma - exclude the quotes. Also, change the path to userinit.exe appropriately if Windows is installed in a different drive.
Close Registry Editor and restart Windows. The Quick Launch settings should be retained now.
I'm having these same logon/logoff loop issues but because I can't access the system files (or any part of the drive) by any of the methods listed in this thread I can't make the suggested changes. Recovery console doesn't find any files or system to use. I can slave the drive to another pc and see all the files using explorer so something must be blocking or hiding the hard drive. However, the system will boot up to the XP logon screen but logs out after attempting to log in.
Any suggestions on how to make the file and registry changes noted? I also cannot remotely access the drive.
Now what if you don't have the disks? or a Disk Drive? and can't access the HDD? and the Recoverything isn't working? and if he company can't solve it?
Please answer these questions??!! anyone????
If you find a GOOD solution: turtlemantrav@hotmail.com
i dont know the console password... but if I just push enter... then it takes me to c:/windows and then I get to system32 and then I type COPY USERINIT.EXE WSAUPDATER.EXE and it does nothing... it says it cant find the file... why???
Ain't work for me, I'm trying to enter CD SYSTEM32 (to start Recovery console) and does not allow me to enter except first C letter. It allows me to enter only one letter, any suggestions.
Ain't work for me, I'm trying to enter CD SYSTEM32 (to start Recovery console) and does not allow me to enter except first C letter. It allows me to enter only one letter, any suggestions.
IveTriedEnter the Recovery Console
Boot the system using the Windows XP CD-ROM. In the first screen when the Setup begins, read the instructions press "R" (in the first screen) enter the Recovery Console. Type-in the built-in Administrator password to enter the Console. You'll see the prompt reading C:\Windows (Or any other drive-letter where you've installed XP)
Type the following command and press Enter.
CD SYSTEM32
(If that does not work, try CHDIR SYSTEM32)
COPY USERINIT.EXE WSAUPDATER.EXE
Quit Recovery Console by typing EXIT and restart Windows.
You'll be able to login successfully as you've created the wsaupdater.exe file (now, a copy of userinit.exe)
Now, change the USERINIT value in the registry and change it accordingly.
ive tried all the ones listed above actually not a single one worked anyone know anotherfix
hi to every one I have the same problem as what you have guys and it really pizz me off, I tried most of the procedures posted in this forum and it ends up on nothing..i tried to download PE builder and created a BARTPE, yes batrPE will boot on CD and you can edit registry but it is none sense, I tried to load a hive namely SOFTWARE and try to modify it, I restart my PC and it doesn't do anything or any progress. I also tried to repair it using windows xp but it doesn't do anything. Guys don't waste your on doing this procedure, the best thing to do is take out your hard drive connect it to other computer scan the hard drive, and back up your important files, then reformat you hard drive. For those who cannot remove their drive try to use BARTPE or ERD commander to back up your files.. ..
heya's, my gf's comp has this same problem, cannot log in through safe mode iether
i understand that a virus or something has changes the "shell" and "userinit" files so that u cannot log in
we never had our comps networked and am unsure how to, so I connected her HD to my PC
but i'm not sure how to edit her
Shell
or Userinit
files.
i can edit my own though regedit.exe
so I know what to edit and i'm pretty sure I have to make them
i have read about making a BartPE bootable CD, but then I have to use some windows xp disc that I cannot find. I would rather not do this, is there any other easier solution?
A: Connect her PC and your PC to the same switch (or network)
B: Open Reged edit on YOUR PC
C: Right click File Connect Network Registry or right click computer and select connect network registry
D: Type in her PC name and then modify the registry settings you have stated above.
looks like a trojan file have installed itself without ur notice well as u said once u log in in few seconds the comp shuts itself down when it means that the file is interferring during startup by executing itself now do the following I mentined below
before u start the process please update ur antivirus with the latest patch files
unplug ur system from the net connection
restart ur system in safe mode
click>start menu>select run
type msconfig
press enter
by default the window will display the general tab properties among the various tabs
select the startup tab
lokk out for any file that doesnt belong to the system the exe
deslect it
then select the services tab
check the same here
deselect the unwanted ones
after u done
click apply
then ok
restart ur system
now again restart ur system in safe mode and scan all ur drives for virus delete them
my laptop logs off few seconds after I log in (it DOESN'T SHUT DOWN)
This happens with my login, guest login and this happens even with Administrator in SAFE MODE
I booted it using XP CD and tried doing the procedure
TO YOU AND THE OTHER GUYS WHO FELL VICTIM TO "BALL_LICKER";
HE SUGGESTED HAVING THE USERINIT.EXE FILE RENAMED, WHERE YOU ENDED UP LOSING THE FILE WHEN YOU RE-BOOTED. NOW THIS IS A MISLEADING POST!
MY ADVICE IS NOT TO BELIEVE EVERY COMMENT/SOLUTION IN THIS FORUM. JUST READ AND ANALYSE PROPERLY INSTEAD OF JUMPING STRAIGHT TO IT. SOME PIPS CANNOT BE TRUSTED.
I'D ADVISE YOU TO READ AND PRACTICE MORE IN THIS INTERESTING FIELD (I.T).
Iron Mask,
I have have been trying to fix this problem for over 2 weeks and nothing worked until I saw your post!! I can now get into my desktop!! I am SO RELIEVED and HAPPY! Thanks so much!!
Does anyone know how I can restore my active desktop? It flashes when I log on but then the screen turns blue. I've tried to go into properties and change it that way but it won't load the pictures.
I needed BartPE (god bless Bart!) to make it work, but it did. now to clean up some of the residual trojan / virus mess on the computer, but its working. Thank you.
Hey guys I have tried all of the solutions above. Successfully copied the userinit.exe file from the CD but still cant log in while in safe mode. It just automatically logs me out real quick.
I also tried all the solutions and discovered a version of userinit.exe in the i386 folder of the infected workstation. So I deleted the one in the c:\i386\userinit.exe when I had the hard drive attached to another workstation. And then:
1. Using the OEM CD, logged into the Recovery Console
2. Changed Directory (CD) to /windows/system32
3. Expand userinit.ex with "expand d:\i386\userinit.ex_" (without quotes)
what I dont get is that last night it was running fine about 3am when I got off. at noon today when I woak up to get on it it had restarted. this is after putting in a new power supply in it after the old one for dammaged by a storm last week it was running fine then and last night it showed it had just done a windows update before I got off I left it on and logged in as I do till the screen saver comes up but like I said between 3am and noon today it restarted its self and then I enterd my password to let it go from the bios screen to finish booting up and then loged into windows like normal and now its doing this over and over and over so as soon as my old man gets home im going to try the fixes and see what happens if not im roialy forked as my xp pro disk has been took by a crook as well as my fathers disks
I struggled for hours on this but finally got the solution.
The solution is
expand d:\i386\userinit.ex_ c:\windows\system32\
or if you CD into \windows\system32
expand d:\i386\userinit.ex_ . will work.
Do not just copy userinit.exe direct to system32 without first extracting. If you copy userinit from CD to system32 folder it will not work. extract first then copy the extracted userinit.exe.
I did as you instructed with the expand command. Problem is when I expand it , it st is still an "ex" fiule type instead of application. Do I rename it once I expand it? Thnx.
i edit the registry c:\windows\system32\userinit.exe to c:\windows\system32\explorer.exe
now after restart the laptop I can't log on when I am trying to login it go to window screen and comes again to login screen even I am tryoing to go task manager to edit the registry its not going through please if some one can help me
thanks
Also, I heard that an infection may have changed the registry to look at wsaupdater.exe instead of userinit.exe
So I did "copy userinit.exe wsaupdater.exe"
Then rebooted, still nothing.
Figuring the registry could have been modified to point somewhere else (besides userinit or wsaupdater), I setup a BartPE (preinstalled environment) disc, booted to that, and checked my registry. It was pointing to
Have the same problem, and maybe worse. Friends laptop has trojan, used Malwarebytes to remove, and then on reboot login resulted in immediate logoff. Will NOT boot in safe mode at all, and when I tried to use the Control Console route it asks for an administrative password (does not exist) and rejects blank password or any other form of admin password. Tried copying ALL the userinit files from another XP machine onto the hard drive hooked up via USB and no change in symptoms. Anyone know how to edit the registry on an external hard drive? That's the only thing I haven't tried that has been suggested, but I can't get there from here. When hooked up to the network, all logon attempts via regedit to the laptop are rejected as access denied.
The constant logging off just hit me, too.
I found a Windows XP CD.
How do I start ? I grab Windows in Safe Mode ? Put the CD in one ofd the drives (only my E: works) ?
I see everyone talking about your solution, but I can't get it straight.
Please help
boot to your winxp cd, press r to enter recovery console. from there you can do basic command line level stuff like copy the d:\i386\userinit.ex_ to your c:\windows\system32. I just tried this and it didn't work for me, ymmv.
At work one of are users got the Internet Security 2010 Virus. My first point of action was to install spybot S&D, which identified lots of spyware etc and registry changes, I cleared these then rebooted which brought me to the same issue as everyone else. In order to fix I used several of the posts here and successfully fixed the problem. Below is what I did (hope it helps)
Use the Windows XP disk, at the welcome screen press r for recovery
As the user had changed the drives it took a while to locate the dvd drive which in this case was h:\ just typed dir on each one I tried to display the files and eventually found it.
type
expand h:\i386\userinit.ex_ c:\windows\system32
exit
then reboot see if it logs on.
this didn't work so I connected the machine that wouldnt log on (leaving at the log on screen) and I working machine together via a switch. giving the working machine a static ip in the same range and subnet as the faulty one
on the working machine run regedit.exe
Select File> Connect Network registry
type in the ip of the machine to connect to it, then username and password (if no admin pasword is used you can't log on although I managed to bypass this issue by putting it back on the domain)
navigate to HKEY_LOCAL_MACHINE\software\microsoft\windows nt\current version\winlogon
Edit or make the following values the same as below
Dave, I connected my other PC to the problematic PC and ran RegEDIT. But I cannot access HKEY_LOCAL_MACHINE any further. The access is denied. What do you suggest next? Thanks.
Anyway now I can't log in to windows. If this missing piece of the registry is the problem then if I add the correct one into the registry via windows xp start up disc using the recovery function then it should work right? The only problem is I have to add it through dos and I'm not very code savvy.
I found this code online looking for answers but I don't want to try anything that I'm not sure about:
I'm a computer technician (Well trainee rather) but i've got a customer with the same problem, looked through tons of solutions and I just wanna summarise what i'm gonna have to do:
Basically, XP won't log on, cos it logs you straight back off
1st thing i'll try is a 'Repair' jobbie from the XP CD. If that doesn't work I guess i'll have to alter the registry yeah?
If I can boot in safe mode I need to check the registry key value 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\Something something'
If the registry key that I find is pointing to C:\windows\system32\winlogon.exe then I need to change it to C:\windows\system32\userinit.exe
HOWEVER; if the registry key already has 'userinit.exe' as it's value, then i'd have to rename the file manually to 'userinitnew.exe', then alter the registry key to point at that file yes?
OR I think I may have to replace the file completley with a new one, perhaps copying it from another machine? (Just trying to clarify all this so I don't screw the registry up)
I've got an Ultimate Boot CD for Windows, so if Safe mode fails I can always use that to access the machine, i'll let you know how it all goes!
I had a Windows XP home system that logged off a user immediatly after logging on.
Also the system rebooted when trying to run in safe mode.
As mentioned earlier the problem is caused by the userint key in the registry not pointing to Userinit.exe,
Boot up on an Installtion CD and select the repair option.
Change directories to the system32 directory and check whether there is a wsaupdater.exe or winlogon32.exe
If either exists then copy userinit.exe to them and pray.
Once the system can be rebooted reset the registry entry to point to "userinit.exe," and attempt to remove the malware - In my case probably "Antivirus plus"
I had this issue and here is what I did with just a Windows XP CD
1. Boot to recovery console
2. Go to C:\Windows\System32\Config
3. In this folder I found a file named Software.iobit
4. I renamed Software to Software.bak and renamed Software.iobit to Software
5. Rebooted computer and was able to log in fine
6. Ran Regedit, clicked on HKLM, then click File, Load Hive, browse to C:\Windows\System32\Config and select Software.bak. When asked, name it anything (I used banana) This will be the Software portion of HKLM
7. Went to \Microsoft\Windows NT\CurrentVersion\Winlogon and the key for Userinit was C:\Windows\System32\Winlogon32.exe
8. I then Changed this to C:\Windows\System32\Userinit.exe
9. Rebooted back to Windows XP CD recovery console
10. Went back to C:\Windows\System32\Config and renamed Software to Software.bak2 and renamed Software.bak to Software
11. Rebooted back to Windows normally and everything was fine, except for the Security Essentials 2010 Malware running, which I removed also.
I had this issue and here is what I did with just a Windows XP CD
1. Boot to recovery console
2. Go to C:\Windows\System32\Config
3. In this folder I found a file named Software.iobit
4. I renamed Software to Software.bak and renamed Software.iobit to Software
5. Rebooted computer and was able to log in fine
6. Ran Regedit, clicked on HKLM, then click File, Load Hive, browse to C:\Windows\System32\Config and select Software.bak. When asked, name it anything (I used banana) This will be the Software portion of HKLM
7. Went to \Microsoft\Windows NT\CurrentVersion\Winlogon and the key for Userinit was C:\Windows\System32\Winlogon32.exe
8. I then Changed this to C:\Windows\System32\Userinit.exe
9. Rebooted back to Windows XP CD recovery console
10. Went back to C:\Windows\System32\Config and renamed Software to Software.bak2 and renamed Software.bak to Software
11. Rebooted back to Windows normally and everything was fine, except for the Security Essentials 2010 Malware running, which I removed also.
Hello,
So I think I got the blazefind virus because my comp gets stuck in this logon-logoff loop. I googled this problem and found that other people have had the same problem. I booted in safe mode, ran avg virus scan which told me all files were "blocked" and "not able to analyze" so I turned the comp off. next day I googled again and found the BartPE thing which I downloaded and made a cd from. then I went into Bios menu, changed my boot sequence to cd rom first, tried to boot in safe mode again but two new problems occured. First of all I was unable to boot from cd rom, and second in safe mode, the logon-logoff loop thing happened again. So I went back into Bios, in the boot sequence I unchecked the "diskette and Hard drive" options completeley therefore leaving only the cd rom option checked and tried to reboot from cd rom again. this time it gave me a "strike F1 to reboot, F2 to got to settings" message. When I hit F1, it just beeps and shows the same message again. Is there anything I can do at this point to save my comp?
If you have OS CD you can repair the window That would be your best option.
Boot from OS CD then When first "R" option comes just hit Enter then it's going to scan for previous OS then it's going to give you options to repair choose "R" then and it will repair all windows files and that will fix your problem. Good Luck
What worked for me was to copy c:\windows\system32\userinit.exe from one user's computer to the others. The file was missing.
After I copied it and rebooted all is fine.
Can someone please reply to those of us who have followed these instructions and keep getting "The system cannot find the file or directory specified?"
Hi I have a mecer extreme when it boots up I am able to login then it would automatically shuts down and restart again. Sometime it takes 30 minutes after logging on to the internet that the same thing happens.
It fanatastic to my PC back working.