Member Avatar for skyman111

Hello,

I have a Dell 1.80 Ghz running Windows 2000 NT Professional. The main problem is that I cant get to the desktop anymore when I start my computer. The computer boots and gets to the screen where I type in my username and password to get to my desktop. It accepts my user and password, starting loading the desktop, gets as far as loading my background wall paper, and then the "saving user settings" dialog comes up and I am taken back to the initial user/password screen again automatically. The computer does this same thing in safe mode.

I was using the computer today and started having the "Auto Protect" application window come up frequently telling me I might have some sort of spyware. It was coming up more frequently than ever in the last day or two, and I'm not sure what triggered it. I also noticed that some of my program aliases would not work anymore. I would get an error if I tried to open certain programs telling me that the application could not be found any more. Very strange. Then I tried rebooting, and now I have the problem I described above.

All of this makes me think I have some sort of virus. Seeing as I can't even get to my desktop or pretty much do anything on the computer, I don't know what to do!

Can somebody please help!??!

  • 5 Contributors
  • 7 Replies
  • 314 Views
  • 1 Year Discussion Span
  • Latest Post Latest Post by Firegiant

Dani AI

Generated

The symptoms describes (login accepts credentials, desktop starts to load, then "saving user settings" and a return to the logon screen; safe mode also fails) are classic signs that Winlogon is not completing the user session — often because the Winlogon/Userinit sequence is broken (missing or replaced userinit.exe) or the Userinit / Shell registry values have been altered (malware or a bad removal can cause this). (apprize.best)

Quick triage (non-destructive)

  • Try the built-in Administrator account as suggested. If Administrator can reach a desktop, the problem is most likely a per-profile corruption; if Administrator also fails, the problem is at the system/Winlogon level.
  • Before any repair, rescue irreplaceable data by booting a rescue/live environment and copying user documents off the drive (this avoids losing files if a reinstall becomes necessary).

What to fix without reinstalling

  • Use a bootable PE/BartPE or another Windows machine to edit the offline registry hive (select HKEY_LOCAL_MACHINE then File -> Load Hive) and inspect:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
    Check the Userinit string and the Shell string — Userinit should point to the OS system32 userinit.exe and Shell should be explorer.exe. Use an offline registry edit so the live broken OS is not executing. (petri.com)

Additional notes and cautions

  • On Windows 2000 the system root is commonly C:\WINNT (not C:\Windows), so confirm %SystemRoot% before changing paths or copying files. (userswww.pd.infn.it)
  • Back up the registry hives before changing them (export the hive or follow Microsoft guidance). If the userinit.exe binary is missing or infected, restore a clean copy from the original Windows 2000 media or from a trusted same-version machine, then reboot and re-check the Winlogon values. If an offline AV scan finds persistent rootkits or the registry is badly damaged, rescue data and reinstall as / recommended. Always back up first. (support.microsoft.com)

References: Windows Internals / Winlogon behavior, Microsoft community guidance on Userinit fixes, offline hive editing (Load Hive), and Windows 2000 install defaults are the sources behind the recommendations above.

Recommended Answers

All 7 Replies

Member Avatar for DimaYasny

a live cd could get you into the system, but the way things look, I'd simply reformat

Member Avatar for DellOutreach

Hello,

This is Richard from Dell's Online Community Outreach group. It looks as though Windows itself has been compromised, or possibly the user account has become corrupted. The issue that you are experiencing, does it occur when trying to log in using the "Administrator" account? I ask this because I read that you were using your user name to login and the issue occurs in both normal and safe mode.

Please reply back after try to login as the administrator. Let’s see if that gets you into Windows.

Regards,
Richard B
Dell Online Community Outreach

Member Avatar for DimaYasny

Hey Richard, are you perchance in Dell Cherrywood?

Member Avatar for DellOutreach

Hey Richard, are you perchance in Dell Cherrywood?

My group, Online Community Outreach is located in Round Rock, Texas.

Regards,
Richard B
Dell Online Community Outreach

Member Avatar for DimaYasny

oh, sorry mate

anyhow, this outreach is a great idea, I'm impressed :)

Member Avatar for Temmu

sounds like malware.

if reload's for you...

boot to a linux live cd or barts pe and rescue your data files to and external disk.

drop the partition with microsoft's "delpart" (have to get it off the web as ms no longer gives it up...)
reload using your 2000 cd
(do the long (full) format to isolate any problems)
load your av software
i'd load spybot s&d
and lavasoft's adaware (version 6 not the new one) also
before connecting to the internet.
patch patch & patch some more.

enjoy!

Member Avatar for Firegiant

Hello all,

Follow theses steps to correct the problem.

1. ) goto anyones machines using the same OS as yourself.

2. ) Explore the drive they have the os stored on usually as follows

a.) C:\windows\system32

3.) Copy the file in that directery called "Userinit.exe" to a CD (or 3.5 inch drive if you still use one)

4.) Now go back to your machine and do the following:

a:) Put both the OS cd and the Copy of "Userinit.exe" in your system via 2 cd drives ot a cd drive and 3.5 drive.

b:) You may have to connext a external CD Drive temp. if you only have one cd drive and no 3.5

c:) Now Boot to the OS cd and goto recovery mode.

5.) Once in recovery mode select the number of os you want to use ........ Usually "1" then for password just hit "Enter"

6. Now you should see the following "c:\windows"

7. ) Now you must access the drive the copy of "Userinit.exe" is on by typing the drive letter followed by a ":" and hitting enter for example to access your 3.5 driver type "A:" then hit enter

8.) to verify you are in the right drive type "dir" and hit enter .....if you are correct you should see the file name listed

9: Once you have the right drive selected they the following:

copy userinit.exe c:\windows\system32

then press enter


now you should recieve a message telling you one file copied


you are done reboot to windows and you should be able to log on


if there are further questions please post and i will answer

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.