| | |
|
|
|
Logging on to computer |
|---|
| message from =?Utf-8?B?TWlrZQ==?= on 10 Jun 2004 |
I cannot log on. After selecting user, system begins to log on then immediately logs off. I tried restarting in safe mode, but the same thing happened. How do I correct?
|
| roger replied to =?Utf-8?B?TWlrZQ==?= on 10 Jun 2004 |
Hi,
"Blazefind changes the following registry-key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Winlogon
"Userinit" = "C:\WINNT\system32\userinit.exe,"
in
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Winlogon
"Userinit" = "C:\WINNT\system32\wsaupdater.exe,"
Used Lavasoft Adaware to get rid of the pest ----> removed blazefind
and
with it the wsaupdater.exe
==> next time i tried to logon my computer the system tries to run
wsaupdater.exe which it couldn't find ! FAILED LOGON -> LOGOFF
I first tried to find ways to change the registry from within the
recovery console but i did not succeed (ERD commander will probably
work, but since i wasn't sure that this was the problem i thought it a
little bit too expensive)...
Then i thought of this:
just copy userinit.exe as wsaupdater.exe !! It's as simple as that....
YES!! it works again... and blazefind is gone (it seems.... :-) )"
Using the recovery console employ the command
copy C:\Windows\System32\userinit.exe
C:\Windows\System32\wsaupdater.exe
(this is one line separated by a space, supposing the partition where
windows is installed is C, and supposing blazefind caused this)
Good luck
|
| Gregg Cattanach replied to =?Utf-8?B?TWlrZQ==?= on 10 Jun 2004 |
You may have had some spyware ("blazefind") removed by Ad-aware and
Ad-aware doesn't fix a registry entry that points to a key file you
need to boot up. Try this:
Assuming the spyware 'blazefind' hosed your registry, the below is
the problem and how I fixed it.
Blazefind changes the following registry-key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
"Userinit" = "C:\WINNT\system32\userinit.exe,"
in
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
"Userinit" = "C:\WINNT\system32\wsaupdater.exe,"
Lavasoft Adaware was used to get rid of the pest. It removed all the
elements of blazefind and and with it the wsaupdater.exe file.
The next time I tried to reboot my computer the system tries to run
wsaupdater.exe which it can't find. FAILED LOGON -LOGOFF, and it is
stuck in this LOGON-attempt, LOGOFF loop. Now I can't reboot and
can't get to the registry to fix the entry in Winlogon.
Then i thought of this:
Just copy userinit.exe to wsaupdater.exe ! It's as simple as that.
YES!! it works again.
Using the Recovery Console (by rebooting with the WindowsXP CD) employ
this command:
copy C:\Windows\System32\userinit.exe C:\Windows\System32\wsaupdater.exe
(This is one line separated by a space, assuming the partition where
windows is installed is C).
You then should be able to reboot.
Summary: Get to the Recovery Console (looks like a DOS prompt) by booting
with the WindowsXP CD, and do:
copy C:\Windows\System32\userinit.exe C:\Windows\System32\wsaupdater.exe
After that you should be able to reboot.
Then use regedit to change:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
"Userinit" = "C:\Windows\system32\wsaupdater.exe,"
back to:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
"Userinit" = "C:\Windows\system32\userinit.exe,"
You then can delete wsaupdater.exe from C:\Windows\system32.
======================
Gregg C.
|
| Gregg Cattanach replied to Gregg Cattanach on 10 Jun 2004 |
Correction: Everything was right but the registry entries should read this
way for a WindowsXP system:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
"Userinit" = "C:\Windows\system32\userinit.exe,"
in
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
"Userinit" = "C:\Windows\system32\wsaupdater.exe,"
|
| =?Utf-8?B?bHZlZQ==?= replied to =?Utf-8?B?TWlrZQ==?= on 10 Jun 2004 |
"Mike" wrote:
|
|
Archived message: Logging on to computer (Microsoft XP)
