WinXPTalk.com

Rudlfax · Guest

We use xp home edition, based on SP 1. Due to having seemingly a trojan horse
on that comp, we changed stuff around, unfortunately in that way we also
changed the permit for the existing (only) user account. When we restart, we
log into from the password screen, but we are logged off right away again
(shall mean you cannot do anything, not one program has time to load). Now i
tried to start in save mode, but the same happens there, also when i try to
log in with the usually then existing administrator account. Login and right
away log out - back to the login screen.
Problem is furthermore, that this computer never got a XP cd (was
preinstalled), so i cannot use that one. Thus if anyone has a hint, how to
come around the loginscreen, or in any way to access windows, it would be
very kind of you to reply.

Greets,
Rudlfax

Michael Solomon (MS-MVP) · Guest

See section "Unable to logon to Windows after removing BlazeFind using a
spyware removal utility? " here:
http://www.winxptutor.com/wsaremove.htm

307654 - How to install and use the Recovery Console in Windows XP:
http://support.microsoft.com/default.aspx?scid=kb;EN-US;307654

--
Michael Solomon MS-MVP
Windows Shell/User
Backup is a PC User's Best Friend
DTS-L.Org: http://www.dts-l.org/

"Rudlfax" <Rudlfax@discussions.microsoft.com> wrote in message
news:0F52EFD9-D2F8-4132-B021-42B9FA1AAE55@microsoft.com...

Rudlfax · Guest

Well, i read that first page, but due to that i do not have n xp cd, i
created an boot cd with the help of the following site:
http://ubcd4win.com/howto.htm

With this CD i came into the dos prompt as well as into the regedit,
however, following the step i still face the same problems :(
But since i am in the registry edit, can i change the permit for the
accounts there, and if, how?

"Michael Solomon (MS-MVP)" wrote:

Ramesh [MVP] · Guest

Rudlfax,

Have you fixed the userinit.exe value, as stated in the article? Also, let us know how did you get access to the XP registry (load hive method, right?)

--
Ramesh, Microsoft MVP
Windows XP Shell/User
http://windowsxp.mvps.org

"Rudlfax" <Rudlfax@discussions.microsoft.com> wrote in message news:9DADD0CB-FF4E-4502-BF2A-FA6D1C59C77E@microsoft.com...
Well, i read that first page, but due to that i do not have n xp cd, i
created an boot cd with the help of the following site:
http://ubcd4win.com/howto.htm

With this CD i came into the dos prompt as well as into the regedit,
however, following the step i still face the same problems :(
But since i am in the registry edit, can i change the permit for the
accounts there, and if, how?

"Michael Solomon (MS-MVP)" wrote:

Rudlfax · Guest

Dear Ramesh,

yes i tried to fix it, but it did not work. To explain, i entered the comp
over the mentioned UBCD (Ultimate Boot CD), which brings a regedit with it.
There i went to the announced location and changed the adress. I tried to log
on afterwards, but it didnt work. Checked back to the regedit, and
userinit.exe was set back to d:, instead of c: where i changed it to.

On a side note, i managed to install the recovery platform, however, it asks
me for the admin password. Since we never changed anything on the hidden
admin, there shouldnt be one. It is said to just press enter for a blank
password, but it is refused, and i got no idea what it should be, i didnt
enter one.

So now i try to find out if it is possible to create a new account with
admin rights using regedit (or via copying a executable file from my working
comp), respectively doing right now a virus search on the not working comp.

"Ramesh [MVP]" wrote:

Ramesh [MVP] · Guest

Rudlfax,

Not used UBCD. But, try this:

Visit http://www.dougknox.com/xp/tips/xp_adv_reg_editing.htm and follow the steps there.

But, in the 4th step, select "SOFTWARE" file (instead of NTUSER.DAT). Then fix the Userinit value in the loaded hive.

-or-

Make a copy of userinit.exe and name it wsaupdater.exe in your Windows\system32 folder in the hard drive. This should allow you to logon into Windows.

--
Ramesh, Microsoft MVP
Windows XP Shell/User
http://windowsxp.mvps.org

"Rudlfax" <Rudlfax@discussions.microsoft.com> wrote in message news:785301C0-8DCE-4ADF-9D40-2C4DDB10BB9A@microsoft.com...
Dear Ramesh,

yes i tried to fix it, but it did not work. To explain, i entered the comp
over the mentioned UBCD (Ultimate Boot CD), which brings a regedit with it.
There i went to the announced location and changed the adress. I tried to log
on afterwards, but it didnt work. Checked back to the regedit, and
userinit.exe was set back to d:, instead of c: where i changed it to.

On a side note, i managed to install the recovery platform, however, it asks
me for the admin password. Since we never changed anything on the hidden
admin, there shouldnt be one. It is said to just press enter for a blank
password, but it is refused, and i got no idea what it should be, i didnt
enter one.

So now i try to find out if it is possible to create a new account with
admin rights using regedit (or via copying a executable file from my working
comp), respectively doing right now a virus search on the not working comp.

"Ramesh [MVP]" wrote:

Rudlfax · Guest

Dear Ramesh,

first of all thanks to you n Michael for the quick replys. Now, to the
second part of ur suggestion, i tried this already on Michaels suggestion,
and it didnt work. I even used the userinit.exe from the cd (which stems from
my working computer), copied in the place of the userinit.exe of the
corrupted comp and then named it wsaupdater.exe - with still no result.

For the first part, i went into the regedit again, found the path, but i do
not understand ur last suggestion, i find the ntuser.dat, but i dont find a
software file.

I tried something then myself, using dosprompt. with *net user **** /add* u
can create, it seems a new account. i tried, i told me created, but it
couldnt add it to the user group. Then i tried *net localgroup administrator
**** /add* and it told me account created, but could not be added to group.
thus i finally created the group and then the account, but still it doesnt
allow me to log on. Any idea how to proceed this, e.g. which groups do exist,
esp. which one is the admin group. Is this anyway a feasible way n how do i
assign rights to these thus created accounts?

Greets rudl

"Ramesh [MVP]" wrote:

Ramesh [MVP] · Guest

Hi Rudlfax,

The "Software" file will be present here:

c:\windows\system32\config\software

Load it and fix the Userinit value, then unload the hive.

--
Ramesh, Microsoft MVP
Windows XP Shell/User
http://windowsxp.mvps.org

"Rudlfax" <Rudlfax@discussions.microsoft.com> wrote in message news:903D3FA0-9859-4F67-8FC9-FC406213A4D6@microsoft.com...
Dear Ramesh,

first of all thanks to you n Michael for the quick replys. Now, to the
second part of ur suggestion, i tried this already on Michaels suggestion,
and it didnt work. I even used the userinit.exe from the cd (which stems from
my working computer), copied in the place of the userinit.exe of the
corrupted comp and then named it wsaupdater.exe - with still no result.

For the first part, i went into the regedit again, found the path, but i do
not understand ur last suggestion, i find the ntuser.dat, but i dont find a
software file.

I tried something then myself, using dosprompt. with *net user **** /add* u
can create, it seems a new account. i tried, i told me created, but it
couldnt add it to the user group. Then i tried *net localgroup administrator
**** /add* and it told me account created, but could not be added to group.
thus i finally created the group and then the account, but still it doesnt
allow me to log on. Any idea how to proceed this, e.g. which groups do exist,
esp. which one is the admin group. Is this anyway a feasible way n how do i
assign rights to these thus created accounts?

Greets rudl

"Ramesh [MVP]" wrote:

Rudlfax · Guest

Dear Ramesh,

i tried, but faced again some problems, it might be coz i dont open regedit
from inside windows, but from so to say outside. First question, it always
asks me when opening it, if i want to load the remote user accounts, i
usually say yes and load them up. However, if i do so, i´m not able to open
for instance the ntuser.dat, because its currently in use. The same happened
when i tried to open the software file, though it worked with software.dat.
Next i´m not too sure bout load hive, unload hive, i´m working with a german
xp. there i got import, export, load structure (guess u mean the latter one).
when i did load structure, it asked me for a key, i told it j, then a new
account (?) appeared, where i changed the userinit.exe to the
c:\windows\system32\userinit.exe
rebooted n faced still the same problem. I also tried meanwhile to restore
registry to the oldest available restore point, without success, still facing
the same problem.

"Ramesh [MVP]" wrote:

Ramesh [MVP] · Guest

Hi Rudlfax,

The Userinit entry should be:

c:\windows\system32\userinit.exe,
(note the comma at the end)

If that does not help, try a repair install:
http://www.michaelstevenstech.com/XPrepairinstall.htm

--
Ramesh, Microsoft MVP
Windows XP Shell/User
http://windowsxp.mvps.org

"Rudlfax" <Rudlfax@discussions.microsoft.com> wrote in message news:35241080-692F-4244-BC61-9DD2D1686D83@microsoft.com...
Dear Ramesh,

i tried, but faced again some problems, it might be coz i dont open regedit
from inside windows, but from so to say outside. First question, it always
asks me when opening it, if i want to load the remote user accounts, i
usually say yes and load them up. However, if i do so, i´m not able to open
for instance the ntuser.dat, because its currently in use. The same happened
when i tried to open the software file, though it worked with software.dat.
Next i´m not too sure bout load hive, unload hive, i´m working with a german
xp. there i got import, export, load structure (guess u mean the latter one).
when i did load structure, it asked me for a key, i told it j, then a new
account (?) appeared, where i changed the userinit.exe to the
c:\windows\system32\userinit.exe
rebooted n faced still the same problem. I also tried meanwhile to restore
registry to the oldest available restore point, without success, still facing
the same problem.

"Ramesh [MVP]" wrote:

Michael Solomon (MS-MVP) · Guest

I just want to state for the record, the information I posted was actually
purloined from one of Ramesh's past posts. The MVPs do tend to steal links
from each other and when the information is rather generic we don't usually
give credit but since you included me in your thanks, the gracious thing for
me to do is to give credit where it is due; I humbly bow to the wisdom of my
compatriot, Ramesh!:-)

--
Michael Solomon MS-MVP
Windows Shell/User
Backup is a PC User's Best Friend
DTS-L.Org: http://www.dts-l.org/

"Rudlfax" <Rudlfax@discussions.microsoft.com> wrote in message
news:903D3FA0-9859-4F67-8FC9-FC406213A4D6@microsoft.com...

Rudlfax · Guest

For the records:

Repair is difficult since i dun have a cd, however, i tried the trick with
replacing system, software, sam, security, default from
c:\windows\system32\config\ with the ones from c:\windows\repair\ - it didnt
let me log on still, coz the newly admin n owner account do not contain user
data, when copying them in from the old accounts, it still doesnt work.
However, this trick allowed me now to enter the recovery console, since
seemingly the admin password was set back to what it was - blank.
trying now to figure out, what to do with this achievment ;)
And still, on a beside note, thks to u both for caring bout this tricky
problem.
Btw had running another antivirus program (part of ubcd), it found another
virus runnin on that comp, also made sysclean, but without result. deleted
winssv.exe via dos prompt.

Ramesh [MVP] · Guest

Thank you very much for the compliments, Michael :-)

--
Ramesh, Microsoft MVP
Windows XP Shell/User
http://windowsxp.mvps.org

"Michael Solomon (MS-MVP)" <user@#notme.com> wrote in message news:Oi44$u%235EHA.3700@tk2msftngp13.phx.gbl...
I just want to state for the record, the information I posted was actually
purloined from one of Ramesh's past posts. The MVPs do tend to steal links
from each other and when the information is rather generic we don't usually
give credit but since you included me in your thanks, the gracious thing for
me to do is to give credit where it is due; I humbly bow to the wisdom of my
compatriot, Ramesh!:-)

--
Michael Solomon MS-MVP
Windows Shell/User
Backup is a PC User's Best Friend
DTS-L.Org: http://www.dts-l.org/

"Rudlfax" <Rudlfax@discussions.microsoft.com> wrote in message
news:903D3FA0-9859-4F67-8FC9-FC406213A4D6@microsoft.com...

Michael Solomon (MS-MVP) · Guest

You are welcome, Ramesh.

--
Michael Solomon MS-MVP
Windows Shell/User
Backup is a PC User's Best Friend
DTS-L.Org: http://www.dts-l.org/

"Ramesh [MVP]" <ramesh@ONLINE.mvps.org> wrote in message
news:uHpKDM$5EHA.3856@tk2msftngp13.phx.gbl...
Thank you very much for the compliments, Michael :-)

--
Ramesh, Microsoft MVP
Windows XP Shell/User
http://windowsxp.mvps.org

"Michael Solomon (MS-MVP)" <user@#notme.com> wrote in message
news:Oi44$u%235EHA.3700@tk2msftngp13.phx.gbl...
I just want to state for the record, the information I posted was actually
purloined from one of Ramesh's past posts. The MVPs do tend to steal links
from each other and when the information is rather generic we don't usually
give credit but since you included me in your thanks, the gracious thing for
me to do is to give credit where it is due; I humbly bow to the wisdom of my
compatriot, Ramesh!:-)

--
Michael Solomon MS-MVP
Windows Shell/User
Backup is a PC User's Best Friend
DTS-L.Org: http://www.dts-l.org/

"Rudlfax" <Rudlfax@discussions.microsoft.com> wrote in message
news:903D3FA0-9859-4F67-8FC9-FC406213A4D6@microsoft.com...

Michael Solomon (MS-MVP) · Guest

You might try using System Restore to take you back to a time prior to the
start of the problem. There is a means of invoking system restore from a
command line, see the following Knowledge Base Article:
http://support.microsoft.com/?kbid=304449

--
Michael Solomon MS-MVP
Windows Shell/User
Backup is a PC User's Best Friend
DTS-L.Org: http://www.dts-l.org/

"Rudlfax" <Rudlfax@discussions.microsoft.com> wrote in message
news:1C87CA42-074A-45E0-9D0A-A9D8F008C283@microsoft.com...

	WinXPTalk.com Forum Index -> Accessibility	All times are GMT Goto page 1, 2 Next
Page 1 of 2