Comments on: Windows XP Login Logout Loop (Virus)

By: Nathan

Nathan — Tue, 29 Jul 2008 23:23:19 +0000

I have loaded the hive and navigated to the correct area however the userinit.exe did not exist, anyone know what to do from here???

By: Troy Van Marter

Troy Van Marter — Fri, 04 Jul 2008 20:25:45 +0000

Dear Ian Luke Kane,

Thank you for this well written article. It was of tremendous help. Though in
my case the Easy Fix did not work, the Slightly Harder Fix did work
beautifully.

I sent a note of gratitude to Bart and made a donation for the software he
developed.

For anyone confused about which Windows folder to use when loading the HIVE
file found in the instruction for the Slightly Harder Fix (suggested name
MyXPHive), the folder is directory on your PC where Windows XP is installed -
not from the BartPE CD or from any other folder. i.e.
“c:\windows\system32\config\software” or if you upgraded from NT, it could be
“c:\winnt\system32\config\software” (do not type quotes when entering into the
BartPE field).

For some reason BartPE could not display the deeper folder structure of my
Windows Directory, but this was not a problem, I simple typed the path in the
field and it loaded the software HIVE.

Hope this helps.

Thanks again Ian,

Troy

By: Lynn

Lynn — Thu, 26 Jun 2008 14:59:49 +0000

You have to map to your PC from another PC. Then do the following: Run regedit and then click file, connect network registry, put in the PC name of the affected PC

For Windows XP:

Navigate in the registry on the infected PC to: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\
In the right pane look for Userinit and the path should point to: C:\WINDOWS\system32\userinit.exe,
Make sure you add the “ , “ at the end.

For Windows 2000:

Navigate in the registry in the infected PC to: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\
In the right pane look for Userinit and the path should point to: C:\WINNT\system32\userinit.exe,
Make sure you add the “ , “ at the end.

By: Dave

Dave — Mon, 02 Jun 2008 16:04:19 +0000

“X:\i386\SYSTEM32\CONFIG\SOFTWARE: Access is denied.

Did anyone solve this?

Thanks

Dave

By: Gore

Gore — Sat, 17 Nov 2007 07:33:00 +0000

Funny… I’m browsing your site from Southern Sudan where I’ve been trying to fix the same issues with a couple of PC’s here. I say funny ‘cos the background of this posting was an issue with one of our lost boys from the beloved Southern sudan.

Thnx..

By: trei9n1

trei9n1 — Sun, 30 Sep 2007 05:09:07 +0000

Must i use my windows folder under C:\ or the BartPE folder under X:\ when loading the MyXpHive file?

By: trei9n1

trei9n1 — Sun, 30 Sep 2007 04:54:42 +0000

“X:\i386\SYSTEM32\CONFIG\SOFTWARE: Access is denied.

Can some1 please help me with this problem?

By: kapuligo

kapuligo — Sun, 16 Sep 2007 03:47:08 +0000

Hi i did follow the step until KEY_USERS \ MyXPHive \ Microsoft \ Windows NT \ CurrentVersion \ Winlogon to edit userinit’s key but it doesn’t have userinit register in there. Please help me how i can do. thank you very much

By: vegnet

vegnet — Mon, 27 Aug 2007 08:34:21 +0000

Im having the same problem as Nath anyone have a solution

By: Mike

Mike — Thu, 16 Aug 2007 09:18:40 +0000

Oh dear got it I must be blind…

By: Mike

Mike — Thu, 16 Aug 2007 09:16:40 +0000

“You need your Windows XP install CD so that you can run an application called the Recovery Console. The link above should provide documentation on how to use the Recovery Console. ”
Sorry but I cant see that link above.
Thanks

By: Dominik

Dominik — Tue, 14 Aug 2007 17:11:19 +0000

Great solution!! Worked for me here too!! You’re great! Thanks for the information.

By: Yemane

Yemane — Mon, 23 Jul 2007 07:14:12 +0000

It is not clear the answer for Nath
“X:\i386\SYSTEM32\CONFIG\SOFTWARE: Access is denied.
Why this info and what could be the solution?:”

By: Ian Luke Kane

Ian Luke Kane — Thu, 28 Jun 2007 15:54:32 +0000

My first thought would be to make sure that you’re referencing the correct drive letter. Make sure that it’s X: on your system rather than something else. I vaguely remember this happening to me at first as well, but I realized that I was pointing at an incorrect location. You want to make sure that you’re searching for your Windows installation drive.

By: Nath

Nath — Mon, 25 Jun 2007 21:00:09 +0000

Hi,
I encountered a problem while loading hive; after typing MyXPHive as you suggested, I clicked OK button and this message showed up “Cannot Load X:\i386\SYSTEM32\CONFIG\SOFTWARE: Access is denied.
Why this info and what could be the solution?
Thank you.