| 9 waqar, on Dec 30, 2008 4:50:00 am GMTEdit these values and type the correct path of shell :
Shell = explorer.exe
Userinit=X:\windows\system32\userinit.exe
NOTE: These files may also be deleted by spywares. You may need to extract them using Windows CD.
Steps for rectifying this problem:
Log on to a networked computer.
Run Regedit.exe
Point your cursor to HKEY_LOCAL_MACHINE
Select File > Connect Remote Registry
Type computer name (infected computer)
Navigate to the following location in registry of destination or infected computer
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
Edit these two values in right pane:
Shell
Userinit
Change these two values to
Shell=explorer.exe
Userinit = x:\windows\system32\userinit.exe
Exit from Registry
Restart Infected computer.
You should be able to log on to computer.
if it not work then go to back steps and just copy orwrite the file userinit.exe
workded successfully tested 100 percent gauranted
WAQAR GILGITI | 10 Robes, on Jan 1, 2009 4:12:56 pm GMTDo not attempt this fix from WAQAR GILGITI.
by changing "c" into "x" it creates a loop right back to the "log on" page.
WAQAR GILGITI, your a jerk. | 11 the_apocalypse, on Jan 2, 2009 3:29:00 am GMTActually you are supposed to replace the "x" with the letter that is relevant to your particular setup, its like in algebra "x" can be anything.
in my case c:\ is my hdd with windows on it and d:\ is my dvdrom but i have other setups where its completely different
now on a more serious note if the registry entries he mentioned are intact(ie the way they are supposed to be) the issue could be a missing userinit.exe file. more clear instructions on how to replace it would be helpful so here's what happened to me last night.
i tried the expand command from recovery console:
expand d:\i386\userinit.ex_ c:\windows\system32\userinit.exe
but in my case i got the "file could not be created" error so i expanded the file to another directory (the root of c:\) and used "winternals erd commander 2005" and moved the file to the system32 folder, that solved that issue
if you don't have "winternals erd commander" cd you could use somthing else like a PE cd such as BartsPE or even a Linux live cd like ubuntu.
for more information use google search and try not to read Microsoft's "official" help they are confusing. reading is good for you (at least they say it is) so read as much as you can about how others solved this issue as well, i have only given details of my latest effort, its different everytime. | 145 joppe, on Jun 8, 2009 12:10:06 pm BSTGreat! I just expanded it to c:\ and than copied it to the right place using: copy c:\userinit.exe c:\windows\system32\ |
| 146 jfourtymm21, on Jun 14, 2009 4:13:11 pm BSTThanks,
I just copied the file from my cd right to my c:\Windows\system32\.
Under the Windows xp repair console,
type:
copy e:\i386\userinit.ex_ c:\windows\system32\ | 155 vijay.v, on Jul 29, 2009 6:27:19 am BSTThanks a lot, I was searching for this since 2 days, atlost I got, TYVM.... |
|
|
| 13 Joseph17, on Jan 2, 2009 10:23:36 am GMTHavent tried the fix yet.... just wanted to say that its a pity idiots like you exist....
Waqar took his time to post a fix and because you lack inteligence you insult him?
Really impressive | 14 Robes, on Jan 12, 2009 4:04:58 am GMTFor those that don't deal with computers day in and day out, one should comtimplate that and state what drive letter to use or at least refer to a note at the end of the reply. But i am sure that's what you would have done.
What are you; his mother? | 94 KP, on Mar 21, 2009 9:16:06 pm GMTYou're an idiot, Rodes. Why don't you try and find a solution instead of spewing your bullshit all over here and acting like a complete bafoon.
I'm having a similar problem - my computer logs in for about a minute or so then logs off and shuts down. What makes matters worse is that it is doing the same thing in safe mode and my computer won't stay logged on long enough to find a fix/solution.
Any help would be mucho appreciated. | 111 lolzors, on Apr 16, 2009 2:31:21 pm BSTIf you're going to waste your time calling someone a buffoon, at least spell it right numbnuts. |
|
| 112 Chuck, on Apr 16, 2009 4:34:10 pm BSTWhy should he have to explain something in so much detail? He is an advanced computer user obviously, and it is very hard to explain complex things to others in a friendly tone when you are used to other computer terminology. I have had trouble with these issues myself as I have tried to explain things in a way that an average user would understand. Take it easy on him, it's hard to explain something simply with advanced knowledge on a subject. Besides, if you can tell me any time that someone named their home drive X, let me know. |
|
|
| 152 It dude, on Jul 24, 2009 3:04:46 pm BSTDude - X means the location of where windows is installed. It could be either C or D most likely. You don't put x. I know this is IT lingo. if you don't understand you might want to take your damn PC to Geek Squad where they will be sure to screw it up for you some more. |
|
| 18 jZr, on Jan 20, 2009 8:52:40 pm GMTI cannot access the PC remotely (FW on I assume) nor the registry. Is there a different way to access/change the registry after removing the HD? |
| 19 SNoWDoGG, on Jan 22, 2009 1:20:29 am GMTThanks this worked for me.... Searched all over the Internet until I found this thread. One note:
do not specify the file name to be extracted to.... it will fail... ie:
expand d:\i386\userinit.ex_ c:\windows\system32\
or if you CD into \windows\system32
expand d:\i386\userinit.ex_ . will work.
Later!! | 28 Mackenzie, on Feb 3, 2009 7:53:17 pm GMTThis worked. I was getting the failed error, then I removed the filename.
Thanks man. What a pain in the nutsack |
| 29 Restorator, on Feb 5, 2009 12:46:45 pm GMTAfter file userinit.exe was replaced all work ok. I take off HDD and connect to other PC and copy file from c:\Windows\System32\userinit.exe to connected HDD. |
| 74 WileCau, on Mar 8, 2009 10:51:33 pm GMTMy userinit.exe got cleaned up by AVG after a Trojan infection. These posts got me out of trouble:
* waqar, on Tuesday December 30, 2008 04:50:00 AM
* the_apocalypse, on Friday January 2, 2009 03:29:00 AM
* SNoWDoGG, on Thursday January 22, 2009 01:20:29 AM
Thanks! | 103 anon, on Mar 26, 2009 7:30:43 pm GMTAgreed great post saved me hours of work. |
|
| 79 Edz, on Mar 10, 2009 4:07:36 am GMTThat worked, thanks alot. Atleast now i can get in to windows really quick and get my files and then reformat the drive.
this is the worst virus I ever saw. It stops you from getting to task manager, run, and by the time nortons or ad-aware new their was a virus it was already to late. the antivirus or virus tells you to reboot and when you do, you are now locked out of your computer. Whoever made this virus is very talented. Its a shame that much talent is used in such an evil way. | 128 Rik, on May 12, 2009 6:20:49 pm BSTTalented?
Oh please. It takes little talent to create a virus. It takes alot of talent to defeat a lonley low-lifes hard useless work. There not a virus created that hasnt been defeated in half the time it took to create it. |
|
| 91 Haroon, on Mar 21, 2009 5:20:26 am GMTI've tried the userinit.ex_ solution, bu the system shot back with no disk in d: drive and when I tried to open the d: drive it's not responding.....any thought? |
| 92 KB, on Mar 21, 2009 1:33:06 pm GMTDear friend: Your suggestion about replacing userinit.ex_ from installation CD did the trick! Thanks for being out there for source of knowledge and solution! Wish you all the best in all your present and future endeavours :)
~KB* |
| 98 octav, on Mar 24, 2009 12:11:57 am GMTI do this but it says access denied after having typed the EXPAND command and i'm pretty sure i never put a master password so i'm a bit stuck here :(
Any help would be greatly appreciated
Thank You |
| 105 Woody, on Mar 28, 2009 6:36:41 pm GMTWorked PERFECTLY!!! Thank you!!! |
| 107 wopmon, on Apr 2, 2009 3:23:24 pm BSTWorked like a charm. Thanks! Flippin MS! |
| 115 VISHNU, on Apr 27, 2009 5:57:04 pm BSTThanking you, i used this and i am sucCessful |
| 117 ledbeck, on Apr 30, 2009 7:54:45 pm BSTThis worked on the first try man!!! I left the file name off also. thanks, I was on the edge of a total reformat! |
| 121 Gary, on May 2, 2009 1:08:46 am BSTThankyou, thats the command/fix I was looking all over for. |
| 122 Aerogeist, on May 8, 2009 11:56:37 pm BSTThis solution worked for me as well. Working on a customer PC that would freeze on a regular boot, but safe mode boots logged off right away after login. Cleaned a large portion of the drive using an external USB adapter and another PC (NIS and Malwarebytes found several viruses/trojans, etc), then regular booting had the same issue. After using this (expand d:\i386\userinit.ex_ c:\windows\system32\) off an XP Pro disk Recovery Console boot, was able to boot into safe mode, now running scans to finish cleaning up his virus/malware issues. Thanks for the solution that got me past the login issue =) | 156 luvly, on Aug 1, 2009 5:20:00 am BSTThis worked for me. I was just about to reformat the disk and figured id try searching one more time for a fix im scanning right now saw a bunch of porn shortcuts on my screen when i logged in but at least im finally in my computer after two weeks of this logoff loop junk. Thanks alot. |
|
| 134 zee, on May 20, 2009 6:41:22 am BSTThanx allot, it woked for me. |
| 136 Nasrat, on May 24, 2009 3:29:56 pm BSTThis worked absoulutely more then fine for me :D
i just did what i copied the wininit file from C:/windows/system32 of another system and had it in a USB
and in the recovery console copied it to my own C:/windows/system32 folder
and it worked fine :D thank you
and yeah my computer doesnt have a CD rom its a Notebook soo i had my own Bootable usb to work on it
Thanks again |
| 137 nilan, on May 26, 2009 3:55:02 am BSTThanks soo much !
You saved me with your explanation how to expand a file from CD, you really made my day ...
nilan |
| 164 pappu, on Sep 18, 2009 1:49:58 pm BSTAfter copyed the file whem i reboot my machine
again saying that file is missing ie "windows\system32\config\system
can u help me out of this problem
plzz
asap
thnzzzzzzzz if u reply will come
ok |
| 165 Popeye, on Sep 22, 2009 7:21:52 am BSTThanx a billion Snowdogg it worked, u know i have been struggling for long long time to log in to the PC. |
|
| 62 Def.Confused, on Mar 2, 2009 8:23:02 pm GMTHey All!!
I'm having the similar problem, except it happened on my laptop ... I had a Trojan virus removed it with AVG and now I cannot log in at all. I've tried the Safe Mode and the Networking Mode, but it wouldn't log me into my admin account either. I have no idea how to remove the HD on a laptop. I have an Hp Laptop and its running Windows XP.
Can anyone help me out??
Def.Confused | 88 heather2810, on Mar 19, 2009 12:52:54 am GMTDef.Confused.....did you ever get a fix for your laptop? I am having the same problem and am not a computer tech....I have no clue as to how to get my laptop connected to my main PC and I don't have the XP CD.
Thanks,
Heather |
|
| 83 sandeep, on Mar 13, 2009 6:14:10 am GMTGood man..its very nice solution.....
thnax a lot |
| 95 infinity, on Mar 22, 2009 8:06:55 am GMTIf windows is not open,
then how to run regedit command
to rectify this problem |
| 97 shri, on Mar 23, 2009 6:25:03 pm GMTHi WAQAR GILGITI
Thank you so much, it is worked for me i resolved my same issue. thanks again |
| 100 WCwm, on Mar 25, 2009 3:20:09 pm GMTFor me, I just saw this infection again, as I have a few times before. This time, however, replacing the Userinit.exe file alone was not enough to get the system to log in. This time the virus not only removed Userinit.exe (under C:\Windows\System32), it removed the Registry String for it too.
Under,
HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ WindowsNT \ CurrentVersion \ Winlogon
as mentioned above, there's an entry/STRING showing up as "Userinit" with "C:\Windows\System32\Userinit.exe," as the Value Data (No Quotes are to be used obviously). Don't be dumb like me though, I was stressing out when I had put a ";" versus just the "," which will cause the same Log On/Log Off issue to happen.
To modify the registry, I used a combination of ERD Commander & Bart PE Boot discs.
If you're looking for a replacement Userinit.exe file, you can sometimes use the one under
C:\Windows\System32\Dllcache
but if it's infected, you can copy the Userinit.exe from C:\i386 (if it exists).
I normally replace the Userinit.exe from C:\i386 to:
C:\Windows\System32\Userinit.exe
C:\Windows\System32\Dllcache\Userinit.exe
My post is repetitive, I know, but at least it lets you know to be on the lookout for a missing Userinit String under Winlogon |
| 109 WillRodyers, on Apr 11, 2009 7:33:59 am BSTWaqar,
IT WORKED!!!!You are brilliant, I've been f^%king with this issue for the last 8 hours and came really close to swapping out my machine for another out of frustration. I don't care what Robes says, I would have your baby! Now I can finally get some GD work done. You da man, man. |
| 118 iceover, on Apr 30, 2009 10:31:12 pm BSTHello I know this was last year but if I can log in how to I get to these steps. u placed on waqar, on Tuesday December 30, 2008 04:50:00 AM
+11Edit these values and type the correct path of shell :
please help thanks |
| 125 jan, on May 10, 2009 5:27:51 am BSTI have win xp itt has befer no any passwod new it has make admin password how to delite it plz guide me
jan |
| 142 bmac, on Jun 2, 2009 4:51:45 am BSTI am having issues, I have a Vista PC and and XP sp2. the issue is on the XP. I cannot get the 2 machines to see each other to be able to edit the other one's registry. any suggestions? |
| 158 Bwdjai, on Aug 2, 2009 10:07:09 pm BSTI send hearty thanks for this nuggett.
God knows why but my machine decided it suddenly wanted a password and after digging around in /sys38 i found there was no userinit.exe.
This post gave me the rest.
Machine now fine. |
| 167 Shwapon, on Sep 24, 2009 8:55:20 am BSTDear sir,
in the Registry editor
file menu i can't see "connect remote registry" but there is "connect network registry"
After i connect network registry i use the advanced then find now to selct the network (infected) computer.
once i select the below key, there is an error shows as below :
hkey_local-machine: error while opening key.
please advise how to solve it?
thanks for ur support. |
|
"windows server" automatically log off