[SOLVED]Computer Repair

[EMJDS]

Hey guys,
I know this isn't exactly our field here, but this has been distracting me from my modding for about two weeks now, and I just can't figure it out.
So, I was repairing my girlfriend's old laptop which had a virus on it. I removed the virus but stupidly forgot to check Userinit. Now I can't log in. I've tried fixing it over the network, but I can't seem too find it with my W7 system or my Android running Fing, and I don't know the name or IP. Any help?
OS: Windows XP Professional SP2

EDIT: Repair tut at end of thread

[whitetop]

yes load into safe mode and login to administration this will let you take the passwords off any account if you go into the account control panel

plus moved to pc section.

[EMJDS]

The problem isn't that I don't know the password, it's that I can't log in. It logs in and then logs right back out again. It's because that registry value has been changed to "virus.exe" or whatever, and now "virus.exe" is gone, it won't start the log in process.

[whitetop]

well if it logs you in and then back out do what i said but do a av scan in safemode or try a system restore from with in safemode to a date before the virus was downloaded

[FOOKz™]

Since you're using Windows XP professional... try this...


Find out how to open command prompt and type the following command:

net user username desired_password


for example you forget the password to the username administrator200 and you want to change the password to appl3s...
net user administrator200 appl3s


You might have to be administrator to do this... idk.
here is a few more things you can try http://www.hackernotcracker.com/2007-03/change-or-reset-any-windows-xp-password.html

[whitetop]

fookz please read he stated its not the password its just it logs him in then out if he does go into administrator he can do a good scan with the av then change the reg file as well

[EMJDS]

Thanks for your help guys.
Let me address a few things. First, I haven't forgotten the password, there is no password. Second, it is an admin account, it's the only one on there. Third, it boots up and I get to the log in screen, where it says username and password and whatnot, then I click "OK" and it logs in, but then immediately logs back out. Also I'm trying to boot to safe mode now but I don't think that'll work.
I've had this happen before, and it happens when a virus changes the registry value for the log in process. Last time I changed it using regedit, and going into "Connect network registry," but this time I don't know the actual name of the computer, and it's not showing up when I do IP scans.
Again, thanks for your help, this has been bugging me for ages.

[whitetop]

the easest way i can think of then is to just get into safe mode the change the reg files or get a windows live cd and edit the reg then but safe mode will allways work around your  problem and use as stable as xp can be don't forget its F8 while your pc is loading the bios screen

[PsychoticWolf]

Do you have a dock? Use an offline Registry editor Get Hirens Boot CD boot Mini XP and modify the entry you need. its quite easy actually.  Dock only needed if you can't get hirens. but just boot up Hirens select mini xp and your free to edit the offline XP Registry... if you don't Your gonna need a PC running XP dock it and get a Offline reg editor.

[EMJDS]

It doesn't have a CD tray, or a floppy.
I think the key here is finding it's IP or name.

[PsychoticWolf]

It doesn't have a CD tray, or a floppy.
I think the key here is finding it's IP or name.

lol? make Hirens a bootable on a Flashdrive. gotta keep your mind open. Been in this field for over 15 years.

http://www.hiren.info/pages/bootcd-on-usb-disk

[whitetop]

and yet you can still edit the reg in safemode instead of downloading stuff you don't really need

[EMJDS]

@white
Nope, safemode is having the same problem

@Psycotic
Oh, duh. Now I feel stupid lol.
Alright, I'll give that a try.

I better get a lot of thank you sex for this.

[whitetop]

ok then it always works 100% for me even with worser cases than yours

there are small live cd's than that crap software plus has lots of tools easy to use for you just pick what one will work for just your needs than download a big file just to change the reg

look on this site and get what you think you need

http://www.livecdlist.com/?pick=Linux_x86-64&showonly=All&sort=&sm=1

[PsychoticWolf]

ok then it always works 100% for me even with worser cases than yours

there are small live cd's than that crap software plus has lots of tools easy to use for you just pick what one will work for just your needs than download a big file just to change the reg

look on this site and get what you think you need

http://www.livecdlist.com/?pick=Linux_x86-64&showonly=All&sort=&sm=1

are you calling Hirens crap? Its a pretty beastly Live CD. its one of the Many Tools I use at my Computer shop. Hirens is packaged with pretty much anything you need to fix issues like this. I don't know about your background WhiteTop but I been working with computers since I Was 6.

[whitetop]

yep i call it crap as why get that when all he needs is a xp live then edit his reg files i call it crap due to too many people think its great yeah it has lots of stuff yet for just a simple thing there is no need for it with all i have done i have never needed any of that stuff and i update the software every time there is a update yet i still never need it.

plus dont for get you can go into the windows recovery

[PspKicks316]

are you calling Hirens crap? Its a pretty beastly Live CD. its one of the Many Tools I use at my Computer shop. Hirens is packaged with pretty much anything you need to fix issues like this. I don't know about your background WhiteTop but I been working with computers since I Was 6.

Hirens beats the crap out of any other live CD out there. Psycho is spot on.

EMJDS, if you can't get it through mini XP on Hirens, then try running a sfc /scannow on the OS drive.
If all else fails, go into CMD in mini XP and create a new user account on the drive. The new user will have correct reg values, because the winlogon value is per-user if I remember correctly.

Code: [Select]

net user <username> /add
net localgroup Administrator <username> /add
should work

yep i call it crap as why get that when all he needs is a xp live then edit his reg files i call it crap due to too many people think its great yeah it has lots of stuff yet for just a simple thing there is no need for it with all i have done i have never needed any of that stuff and i update the software every time there is a update yet i still never need it.

plus dont for get you can go into the windows recovery

Do you work in IT? I do, and Hirens is one of the most invaluable resources we have. If you knew an ounce of what you were talking about, you would think twice about calling Hirens crap.

[whitetop]

lol yep i know what im taking about and yes its still crap its only any good due to all the crap its got on it making it very easy for lazy people to sort there problems out and every were ive been says the same thing lazyness.

back to topic that fan boy wars starting hope you get it sorted as if live xp did not work which you did not state if you have a usb port do the new user as kicks said as you should never have the administration as the main account ever.

hope you do this and get it sorted

no replys off me due to fanboys lol

stay on topic if you reply

[EMJDS]

Right, so I've (almost) downloaded Hiren's. Can someone clear up the booting off of a flashdrive? I've booted off of other things before, but never a flashdrive, do I have to do anything special?

[PspKicks316]

Nope, just follow the instructions on setting up the flash drive and do the same thing you'd do to boot off of a CD. When you turn on the computer, open up the boot menu (usually F8, F9, F10, or F12. Most commonly F8,F10) and select USB drive/Flash drive/USB disk/whatever your flash drive is labeled.

[EMJDS]

Still having problems. I loaded up Mini XP, and I went into RegEdit. It's pointing to the backup entry at i980 or whatever it's called. MXP logs in fine, but when I switch back to XPP I'm still getting the same problem.

[PspKicks316]

What key did you check?
Take a pic/screenshot of

HKLM/Software/Microsoft/Windows NT/Winlogon/

and post it here, please.

[EMJDS]

Sure.
Here ya go
http://i.imgur.com/QgN2D.png

[PspKicks316]

That looks like the registry for mini XP. You have to load the registry hive and then access it via Remote_HKLM I believe.

[EMJDS]

Ohhhh, ok. Lemme give that a shot.

[EMJDS]

Ah! It worked! Thank you all kindly.
Tomorrow I will end this thread with a small tut to help anyone who finds this in the future.
Thank you, thank you and again, thank you! 

[PspKicks316]

No problem. I'm guessing the userinit key was pointing to the virus?

[EMJDS]

Yep.
It was pointing to a craftily named useriniit.exe, which was removed with the virus, so it was pointing at nothing.
I've only ever had this problem once before, and I fixed it over the network. I guess most modern AV fix registry components automatically upon removal now, because I hadn't had this problem in AGES. It's actually item No. 3 on my removal checklist, which I created after the first time this happened, which I also wasn't following, lol. Guess I learnt my lesson.

[PspKicks316]

Good to hear you got it at least, lol

[PsychoticWolf]

Very well. Happy you got that all sorted out. Problems like this happen a lot with Malware infections they like to Hook processes. Also Using a Tool that also requires you to think isn't being lazy. Remember tools are there to help you. Knowing which tools to use and when to use them. Looking forward to seeing your tut EMJDS.

-Off Topic

Good to see you back kicks 

[EMJDS]

Hello gents and stray Googlers
Well I meant to come back here and post a summary of how I fixed this, but unfortunately my computer had a head crash, and I was stuck with no way to get on the Internet for six months.
Now, lemme see if I can remember how I did this.

So basically my problem was this:
I removed a virus from my girlfriend's computer, but it had modified userinit.exe to point to the virus, and when the virus was removed, it was pointing to nothing. So it would boot up, and I would try to log in, it would say "logging in" and then immediately log me back out.

I fixed it by downloading Hiren's Boot CD from http://www.hirensbootcd.org/download/. I put it on a bootable flash drive, but a CD should work fine for most people.
Run MiniXP
Open RegEdit
Load your local hive from the Hard Drive (For a more detailed post on this view http://technet.microsoft.com/en-us/library/cc759303%28v=ws.10%29.aspx)
Find HKLM/Software/Microsoft/Windows NT/Winlogon/
Point it towards userinit.exe

If that doesn't work, you'll probably need to re-download unerinit.exe, which is beyond the scope of this post.
Also, if you have questions do NOT reply to this thread. Instead PM me.

Also I would keep Hirens's, it saved me $400 for a new computer.