Help, Removed Virus now I can't log in to Windows

FXGuy3369

Senior member
Dec 17, 2004
381
0
0
Ok I have 2 computers I am working on for friends with the exact same symptoms.
Both had different viruses that had hijacked desktop, homepage, etc.
Both PC's had Spybot S&D and MBAM ran on them.
Upon rebooting when you get to the Windows Logon Screen you can select any user and it will say "Loading Personal Settings" flash your desktop background for a split second then "Saving Personal Settings, Logging out etc"
I have done tons of internet research, and found the
Registry Key userinit.exe that everyone says usually gets hijacked and then removed by the spyware killing software. But on both these machines the reg key value is what it's supposed to be.
Any help would be greatly appreciated.
Sorry if I am missing any info that I should have listed, let me know and I will answer ASAP
 

raincityboy

Senior member
Dec 30, 2004
394
0
0
Most likely your userinit.exe is borked. Either the path in the registry or the file is removed or modified.
Best thing to do would boot from a live cd (I prefer UBCD4Win, but any will work,) and verify which is causing the problem.
It should be located in system32.
In the reg make sure the userinit under "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" is pointed at the correct file in system 32

If its missing you can try to copy the userinit file from %windir%servicepackfiles/i386

Edit: guess I should read your full post. Sounds like it's just missing
 

FXGuy3369

Senior member
Dec 17, 2004
381
0
0
Thanks, just got it actually. I had checked the registry path and the value was right but, userinit.exe itself was gone. I just copied the file from a working pc, inserted it and presto the pc boots now.
 

0roo0roo

No Lifer
Sep 21, 2002
64,795
84
91
if its that far gone i wouldn't trust the system anyways, thats only the virus you could find:p
format c+windows reinstall time regardless