Solved

XP virus -- login screen displaying no users to log in with?

Posted on 2004-07-30
40
13,144 Views
Last Modified: 2011-08-18
I have an HP Pavilion 6746C with XP Professional Installed, only upgrade is 192 MB RAM.  I cannot get a user name to display in the login screen.  All that shows up is the "Windows XP" logo, the blue background, and the 2 lines on top and bottom, nothing else, no other text at all!

I've tried:

  safe mode,
  last known good configuration,
  debugging mode,
  safe mode with command prompt..

all give the same result.  I read about a way to hit ctrl-alt-delete twice at the welcome screen to get a command line method of logging in, but I could not get that to work either.

Is there a file or files I can copy from another XP machine to the problem machine to get this thing to log in?  Is this a known virus, or what?

I had a similar case on XP Home Ed. where I got users listed in login screen, but clicking any of them and entering password never got you in.  I even did an OS repair on that one, thinking some system files were corrupt, but that didn't even work, I ended up with the same problem.  I had to reinstall that OS from scratch (format HD, then install XP) ... is it possible this case is as bad as that?

Thanks,
Mark
0
Comment
Question by:mark_at_acc
  • 7
  • 6
  • 6
  • +9
40 Comments
 
LVL 65

Expert Comment

by:SheharyaarSaahil
ID: 11679231
Hello mark_at_acc =)

Tell me before this all started, did u run some spywre\virus removal softwares ??
ot just one day it all started happening..... ??
0
 

Author Comment

by:mark_at_acc
ID: 11679359
Saahil, its a customer machine, I don't know if spyware/virus software was run before this happened or not.  It may a few hours before I here back from the owner to ask.
0
 
LVL 10

Expert Comment

by:timothyfryer
ID: 11679385
Try hitting ctrl-alt-del when you get to the logon screen-probably hit it twice and see if you get the classic logon dialog
0
 
LVL 65

Accepted Solution

by:
SheharyaarSaahil earned 250 total points
ID: 11679420
yeah coz u know its a known issue that after running Adaware for removal of wsaupdater.exe
users looses the ability to login,,,,, and there is a fix available on their site,,, but this site is, I dont know why, is DOWN :( >> http://www.lavahelp.com/articles/v6/04/06/0901.html

But still i copied this from another post which is the way to replace the userinit.exe back, thru Recovery Console...

==============================================================
Boot with XP CD, and press R to enter Recovery Console.....
choose ur os installtion and then enter ur Administrator password if ask and write the following lines....

C:\windows
type 'cd system32' the directory should now be
C:\windows\system32
type 'copy userinit.exe wsaupdater.exe'
1 file should be copied, now REBOOT!

Remember to spell "wsaupdater.exe" correctly.
===========================================================================

check if it can solve the issue for u or not ??
0
 

Author Comment

by:mark_at_acc
ID: 11679770
I ran those steps for wsaupdater.exe, and its still the same problem...I had hopes for that fix.

I also tried the ctrl-alt-delete trick yet again, and nothing happens.
0
 
LVL 65

Expert Comment

by:SheharyaarSaahil
ID: 11679830
hmmmmmmm i had too =\

tell me when u try this, it too doesn't work ??
HOW TO: Start the System Restore Tool from a Command Prompt in Windows XP:
http://support.microsoft.com/?kbid=304449

if NO then two other ways are replace regisry from Recvoery Console, or a Repair =\

How to recover from a corrupted registry that prevents Windows XP from starting
http://support.microsoft.com/?kbid=307545

How to Perform an In-Place Upgrade (Reinstallation) of Windows XP:
http://support.microsoft.com/?kbid=315341

Or this site explains Repair\Recovery Console with pics:
http://www.webtree.ca/windowsxp/repair_xp.htm
0
 

Author Comment

by:mark_at_acc
ID: 11681765
Those writeups appear to require that I have the XP product key, which the customer will look for in a few hours after getting home from work.  I have "given up", and I recommended a reinstall of the OS to the customer, and since they value the data on disk, I will recover that with my 3.5" drive enclosure....

Saahil, their doesn't appear to be a straight forward fix, eh?

Mark
0
 
LVL 65

Expert Comment

by:SheharyaarSaahil
ID: 11681798
hmmmmmmmm there can be a straight forward fix if we know abt the straght forward reason of the problem !!!!!!

u know problems dont occur without reasons,,,,, there is always a reason behind the problem,,,,, and believe me if we know the reason the chances of solving the problem become 80% !!!!

now we normally see this problem, most of them say we removed this spyware and now im unable to login,,,, so the solution which can be worked is replacing userinit.exe !!!!!

but if a person comes to u and will say,,, i dont know last night i turned off the system and this morning when i turned it on i was unable to login,,,,,, so how will u guess that what wud happen to it !!!!!!!
 
we can eliminate the problem only if we know where it lies,,,, but if u are given an unknown problem, u have to take an extreme step =\
0
 
LVL 10

Assisted Solution

by:timothyfryer
timothyfryer earned 150 total points
ID: 11682208
The way you were talking earlier, it sounded like the logon window was corrupt. That is probably the msgina.dll file that provides the dialog for that window.  if a virus got into msgina.dll, it might have corrupted it.  You might try sfc on msgina.dll in windows\system32.  In fact, the virus may still be in there if it was one.  Good place for a keylogger I would think, if thats possible.
0
 
LVL 1

Expert Comment

by:pcgandalf
ID: 11683211
is the RAM (new ram) set correctly in the bios and has the bios been altered to accomodate the new ram ?
0
 
LVL 1

Expert Comment

by:pcgandalf
ID: 11683216
Also, try using the clients XP CD, press R to to enter repair options page, press R again, and when a prompt appears for a repair option select M.Now hit the up arrow a couple of times to select Verify Windows System files....and enter.....

After the selection is amde move down to continue, press enter...you'll be prompted to enter emergency repair disk...if you dont have one press L so u can locate Windows on your HDD. Press enter to make the repairs.

Maybe as straight forward fix as you can get.
0
 
LVL 1

Expert Comment

by:pcgandalf
ID: 11683260
and that 192 mb of ram..XP really needs 256mb of ram.
0
 
LVL 1

Assisted Solution

by:pcgandalf
pcgandalf earned 100 total points
ID: 11683303
check also for boot sector virus .....also try re-seating your ram....or try new ram...
when all the above fails...reformat. Wipe it. But still check for boot sector viruses.
0
 

Author Comment

by:mark_at_acc
ID: 11684216
I figured out the RAM by looking in bios, odd was that 64 MB was in slot 0, and 128 MB was in slot 1.  I assumed (woops) that this was not the cause of this specific problem, that it must be OK.  I typically prefer the larger ram chip be in slot 0 in this configuration, but I left it alone, since behavior didn't indicate to me that that was the cause of the problem.  I never reseated memory either, again because if that were the problem, I believe problematic behavior would be erratic, not consistent like this.

I did find out that "nothing unusual was done to the computer before this problem occurred", but they did say it was running poorly (slow to come up, lots of popups, etc) for a while before this happened.

They could not find their product key for XP Professional, did not want to install Windows ME (that product key was on the sticker on the computer), and didn't want to purchase a new copy of XP.  So as of timothyfryer's post, I cannot try the new ideas.  She has picked up the machine and payed my my diagnostic fee.  Oh Well.  I'll assign points now.

Thanks for the excellent ideas,
Mark
0
 

Author Comment

by:mark_at_acc
ID: 11684247
Any good suggestions for checking for a boot sector viruses?  I know boot floppy's are good, but then I need a set for every OS?  Is there a good anti-virus vendor to use to create such a set?
0
 
LVL 10

Expert Comment

by:timothyfryer
ID: 11684285
AVG Free Edition has a boot sector scanner that works on windows, maybe others also but not sure.
http://free.grisoft.com/freeweb.php/doc/2/
0
 
LVL 10

Expert Comment

by:timothyfryer
ID: 11684294
Magical Jellybean KeyFinder can retrieve product key from existing installation but not from cd
http://www.magicaljellybean.com/keyfinder.shtml
0
 

Author Comment

by:mark_at_acc
ID: 11684330
I am a grisoft reseller...once a customer used AVG's boot disks, and somehow destroyed their Win98 install, it would not do anything, and I had to reinstall the OS.  So I'm now a little leary of it.  Since then I have also found that those boot disks are not very generic; I cannot just pop them into any windows machine (even if the OS is the same), and scan for viruses.

I already have the keyfinder mentioned by tim, but I could not run it in this case, since I could not log into Windows!!
0
 
LVL 10

Expert Comment

by:timothyfryer
ID: 11684362
Yeah, I lost some confidence in AVG after right click scanning some known virus files that AVG showed OK.  Actually, none of the virus apps will find all so best bet is scan with as many as you can tolerate.
On machines that have factory installed os'es or unattended install os'es, the product key can sometimes be found in a file called

C:\WINDOWS\SYSTEM32\$WINNT$.INF

http://personal-computer-tutor.com/abc2/v15/vic15.htm
0
 
LVL 65

Expert Comment

by:SheharyaarSaahil
ID: 11684558
>> She has picked up the machine and payed my my diagnostic fee

didn't u ask her,,,, now how wud she fix it,,, with a hammer ;-)

anywyazzzzzzzz for boot virus disks..... i always Trust Mcafee :)
http://vil.nai.com/vil/averttools.asp#003
0
What Should I Do With This Threat Intelligence?

Are you wondering if you actually need threat intelligence? The answer is yes. We explain the basics for creating useful threat intelligence.

 

Author Comment

by:mark_at_acc
ID: 11689804
Saahil, I accepted your early answer because it will probably help others even though it wasn't my solution, and thanks to timothy and pcgandalf for helping out, all those ideas help me for the next case..

Mark
0
 
LVL 10

Expert Comment

by:timothyfryer
ID: 11689921
Thank you for the points.  Good Luck.
0
 
LVL 65

Expert Comment

by:SheharyaarSaahil
ID: 11696586
thanx ^_^
0
 
LVL 1

Expert Comment

by:pcgandalf
ID: 11700881
seems very fair! Best of luck.
0
 

Expert Comment

by:xsgwiseman
ID: 12113760
This problem is NOT caused by wsaupdater.exe. They are two seperate problems. The user profiles are actually deleted in this case. Classic login will not help you. You need a way to add users to the XP installation. I'm still looking into this on my customers machine.. I'll keep you posted. This is just FYI. I'm sure your finished with that machine by now.
0
 

Expert Comment

by:teknowil
ID: 12481487
I have found a computer with this problem also. it happens to be an Hp too with xp home sp2.
0
 

Expert Comment

by:pcgurudenver
ID: 12789166
I have got to find a fix for this problem. I have a client whose machine I have re-built twice and just got this problem again. They're losing confidence in me and it's really got me stumped. I read all above but it doesn't look like it's really been fixed but I do share something in common (Ad Aware  and AVG)

Ad Aware I have been using religiously the same version (1.61) and have not had a problem whatsoever. What IS new is the latest AVG FREE program ver 7. And since it's one of the first things I put on a new system I have to believe this is it. On a new build no less.

What's getting corrupted? I have ERD and all those utilities to get to the registry if needed.

Anxiously looking forward to a reply

thanks all
0
 

Expert Comment

by:pantkowi
ID: 14322172
I have the same problem on a hp laptop.  The first time this happened I reghosted the machine.  It's running Norton internet security and adaware.  It just happened again.  Any help would be appreciated.
0
 
LVL 1

Expert Comment

by:beastwez
ID: 20735227
is anyone still struggling with this i have a solution. but noticed this thread from 2004/2005 so no point typing out my solution.
0
 

Expert Comment

by:eldec
ID: 20853453
Hi beastwez;
 I am interested in hearing your fix. I have a customer that is experiencing this very problem.
0
 

Expert Comment

by:andrej-k
ID: 20883436
beastwez, PLEASE share your solution!

I've come accross the same problem with my Windows XP setup and I'm in urgent need for help.
0
 
LVL 1

Expert Comment

by:beastwez
ID: 20884133
since janurary iv fixed tonnes of PC, and can't remember my solution. i will have a think and post back ASAP sorry guys.
0
 
LVL 1

Expert Comment

by:beastwez
ID: 20884170
OK im remember now.
Basically I have a utility on CD, I can upload it to the back end of my website if anyone needs it, it's called PC Anaylser I think. I ran the util, and there was an option to run a registry restore. (Bog standard windows restore wouldnt work as I couldnt log in). Loads of dates appeared so I went back a week, and 2mins later, PC absolutely bang on again! Sorted.
Let me know if you need the app or weblink and ill upload it.

cheers
wes
0
 

Expert Comment

by:eldec
ID: 20885708
Hi Beastwez ;
0
 

Expert Comment

by:eldec
ID: 20885721
Doh! Sorry for the double post- ZI have done some preliminary searching and cant find a working link for PC Analyzer. If you can provide either a link or or the app I would be greatful! Thanks again for your time.
0
 
LVL 1

Expert Comment

by:beastwez
ID: 20886376
Hi I will get it uploaded to my website and send you a link. Will upload it as a bootable iso.
bear with me as its wednesday night drinking session tonight so will do is soon as I get chance.

cheers
wes
0
 

Expert Comment

by:eldec
ID: 20886505
LOL- have a pint on me! Thanks again
0
 
LVL 1

Expert Comment

by:beastwez
ID: 20904365
OK everyone, PC Analyzer is uploading to my website now. Should take about an hour, it's about  250mb.
goto www.controlaltdeleteit.co.uk/pcanalyzer.iso
it is a bootbale CD and great for engineers like me.

hope that helps everyone.

wes
0
 

Expert Comment

by:eldec
ID: 20921725
Thanks Beastwez!
0
 

Expert Comment

by:tomtexas
ID: 23322469
Relating to the problem of no names on the windows xp login screen, can anyone add to this problem and/or point the correct version of PC anayzer and how to use it to go back in time and restore registry values which a user touched on a year ago.
I have seen a lot of people with this problem and a friend currently has it.  I tried all the usual things including a repair install and still there are no user names on the login screen and doing the cntl-alt-del twice will not let you log in.  Tom
0

Featured Post

6 Surprising Benefits of Threat Intelligence

All sorts of threat intelligence is available on the web. Intelligence you can learn from, and use to anticipate and prepare for future attacks.

Join & Write a Comment

Suggested Solutions

Most of the time we are in fix when all of sudden our systems behave weirdly.  Such problems cost time and effort... so it's best to take some preventive actions so that we can avoid such issues or overcome such problems more easily. Preventive M…
cPanel is a Unix based web hosting control panel that provides a graphical interface and automation tools designed to simplify the process of hosting a web site. cPanel utilizes a 3 tier structure that provides functionality for administrators, rese…
In this tutorial you'll learn about bandwidth monitoring with flows and packet sniffing with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're interested in additional methods for monitoring bandwidt…
This tutorial demonstrates a quick way of adding group price to multiple Magento products.

744 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

9 Experts available now in Live!

Get 1:1 Help Now