Windows XP Login then Logoff! (Solved)

Remember my last post about Windows XP login and immediately logged off?

Finally I solved it after 2 weeks of troubleshooting. *Sigh*
The solution is simple, just finding it was the hard part.

I've done all the advice given in most pages I've found.
That is creating/copying a new set of userinit.exe from the recovery CD to windows\system32\ folder.
Most people manage to solve their login/logout problem after doing this.

But I can't. I need an extra step which is editing my registry.
Caution!!!
Registry editing is dangerous. Make sure you backup first before doing any editing.

I used BartPE to boot and there I can edit the registry.
This site has a good explanation and screenshots on each step needed to be taken to edit the registry.

1. Insert the BartPE CD into the drive, and boot the system from the CD.

2. Type Regedit.exe in the prompt, and press Enter. Select the HKEY_USERS hive

3. From the File menu, choose the Load Hive option. Browse to your Windows installation drive, for example the following location:

C:\Windows\System32\Config\

4. Select the file named SOFTWARE (the file without any extensions), and click Open
5. Type a name for the hive that you've loaded now. (Example: MyXPHive)
6. Now the SOFTWARE hive is loaded, and present under the HKEY_USERS base hive.
7. In order to fix the Userinit value in the loaded hive, navigate to the following location:

HKEY_USERS \ MyXPHive \ Microsoft \ Windows NT \ CurrentVersion \ Winlogon

8. Double-click Userinit and set it's value correctly. Example: Set it's data as follows:

C:\Windows\System32\Userinit.exe,

(Include the trailing comma also. The above assumes that Windows is installed in C:\Windows, and Userinit.exe file is actually present in the System32 folder. You may want to verify that as well.)

9. After entering the correct data, you MUST unload the Hive. To do so, select MyXPHive branch, and then in the File menu, choose Unload Hive. It's important to note that you'll need to select the MyXPHive branch first, before unloading it.

10. Quit BartPE and restart Windows. See if you're able to logon to your profile.

My problem was that somehow my registry got corrupted. The value for the userinit is:
C:\windowsstem32\userinit.exe,\s So I changed it to the value given above.

Autochk not found

It was quite some time I had problem with my computer. Now it is solved.
Only after I added a line in the registry.

Yes!!!
Now I can defragment my drive.
Now I can scan my drive.
All after doing the autochk in the registry.
before that it was ???. ???

Here was the post that I found.

>I am running win2k sp3 and when I boot the computer I
>receive:
>
> \SystemRoot\Windows\System32\Autochk.exe program not
>found - skipping Autocheck
>
>This lasts for about 2 seconds and then the system boots
>normally and seems to run fine. I have tried chkdsk /r/f
>and it doesn't help. I have located the file autochk.exe
>in C:\winnt\system32 and have tried replacing the file
>from another similar machine with no change. If I rename
>the file it recreates itself. If I delete the file it
>recreates itself. I am not sure what else to try, any
>suggestions would be greatly appreciated.
>
What is in the registry at the
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute

It should be a REG_MULTI_SZ data type set to
autocheck autochk *

If not, set it to
autocheck autochk *

Windows XP Login then Logoff!

Have the problem stated in the title. Damn frustating when you can't get into windows to do some fixing. Found a few web pages. Here are some of the tips.
But it doesn't work for me. Need to find other ways!!!

Anyone has any idea????

http://www.logicnest.com/archives/90
- http://www.winxptutor.com/wsaremove.htm
http://en.kioskea.net/forum/affich-22087-xp-auto-log-off

Basically what they advice is that we need to have a Windows Setup CD.
Enter the Recovery Console

Boot the system using the Windows XP CD-ROM. In the first screen when the Setup begins, read the instructions press "R" (in the first screen) enter the Recovery Console. Type-in the built-in Administrator password to enter the Console. You'll see the prompt reading C:\Windows (Or any other drive-letter where you've installed XP)

Type the following command and press Enter.

CD SYSTEM32
(If that does not work, try CHDIR SYSTEM32)

COPY USERINIT.EXE WSAUPDATER.EXE

Quit Recovery Console by typing EXIT and restart Windows.

You'll be able to login successfully as you've created the wsaupdater.exe file (now, a copy of userinit.exe)

Now, change the USERINIT value in the registry (see Phase II in this page) and change it accordingly.

Seneka Rootkit

Just discovered that I have a rootkit installed in my system. Don't know how long it has been there. All I know is while I was watching my process in my system when suddenly I saw explorer.exe was trying to access seneka in the registry. I know what I installed in my computer and seneka was not one of them. I searched in my registry for the key but it couldnt be seen.

I scanned my pc for virus using NOD32 and there was none found. Searched in the net for seneka and there were not much info at all. Then I found out that seneka is a root kit. No wonder my AV cannot detect it. And no wonder lately I have a lot of problem with BSOD when I was shutting down my pc. Especially after using Media Player Classic.

The site ThreatExpert have the best explanation of what it does. But it is not enough.

I found this site that have a list of rootkits remover. http://blogs.techrepublic.com.com/networking/?p=736

I tried a few of them.
i)Trend cant detect at all.
ii)Sophos quite good.
iii)Gmer- yes.
iv) Ice-sword- dunno how to use.

I found that there are a few files in my system folder with seneka as the file name but I could not see them. I have enabled show hidden and system files but it was useless. Doesn't even show that it exists.

Only when I tried to name a file with the name seneka*, that I know that the file exists. Anyway any files that I named starting with seneka* will soon be hidden/deleted/moved/ or anything at all!!!

After I had used the rootkit remover only then my AV can detect the seneka files in the system folder and identify it as a trojan.

Deleting jwgkvsq.vmx

Just found out that the conficker worm creates an undeleteable autorun.inf in the root drive of the USB drive.

When I tried to delete it, the msg appears as follows:

Error deleting file or folder.

Cannot delete autorun: Access is denied.

Make sure the disk is not full or write-protected
and that the file is not currently in use.


So what I did was to go to the properties of the autorun file.
Click on the Security tab.
Click on the advanced button.
Change the owner to my user. Or add the current user (in my case here, admin) to allow permissions for the full control of the file.

Before I change it, the owner was the worm in the recycler folder.

After adding the owner and changing the permissions, I was able to delete the file.
Thank goodness....

Btw: remember my last post? about jwgkvsq.vmx? It is actually Conficker.

Disable USB Drive

Remember the previous post where my pc was infected by a virus/worm? It was the conficker!! Or downaup virus.. No wonder so difficult to remove. Got several variants...
And very virulent!!

How to test for it? Here is a simple test. Just go to this site: http://www.confickerworkinggroup.org/infection_test/cfeyechart.html

You should be able to see the pictures below if you are not infected.
If not you better go to the site. The explanation is there.

Anyway microsoft is offering USD$ 250 000 for information that leads to the arrest of the writer of the worm.


Here is something I got from the net. Forgot where I got it. This is used to disable USB storage device. There a few tweaks to completely disable USB but for me, storage device is the main culprit for trojan and virus to spread, so this is the way. Cos if you disable USB, devices such as keyboards, mouse and etc could not be used.

A more reasonable option for sysadmins is to disable write access to USB port so that data files cannot be written to the mass storage device. The USB thumb drive will be read-only.

Open the Windows Registry and open the following key
HKEY_LOCAL_MACHINE\System\CurrentControlSet\ Control\StorageDevicePolicies

Now add a new DWORD called WriteProtect and put the value as 0 to disable write privileges to the USB port. To reverse the step, either delete the WriteProtect REG_DWORD or toggle the value to 1 which will enable the port.

Remember that the above trick works only with Windows XP SP2.

If you like to go a step further and disable users from connecting USB storage devices to their computers, here's the trick:

Open registry and navigate to the following registry key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet \Services\UsbStor

Now in the right pane, double-click Start and type 4 in the Value data box (Hexadecimal) and quite the registry editor. To enable the USB storage devices, change the Start value back to 3.

As always - back your system up before messing around in the registry.

Just open regedit and browse to this key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\UsbStor

Notice the value 'Start'

Switch this value to 4, and USB storage devices are disabled.

Switch this value to 3, and USB storage devices are enabled.

Hope this helps.
Oh ya..
This few tools are a must if you are infected. Or not.
One is the windows update.
Then conficker remover.

Scandisk Error

Remember the day that I lost my partition while resizing my external HD?
I am able to recover it after trying a few recovery software.
One favourable review is by using Active Partition Recovery.

I have been able to get my partition back but there are a few files that are corrupted. Tried to scandisk but an error came out.

"Windows was unable to complete the disk check"

Damn it... Then I have to use chkdsk. Found a few errors and fixed it.
But still got problem. Right now I just leave it for a while. Until I have more time to backup my data and try repartition it again.

The type of the file system is NTFS.
Volume label is New Volume.

WARNING! F parameter not specified.
Running CHKDSK in read-only mode.

CHKDSK is verifying files (stage 1 of 3)...
0 percent completed.
1 percent completed.
2 percent completed.
3 percent completed.
4 percent completed.
5 percent completed.
6 percent completed.
7 percent completed.
8 percent completed.
9 percent completed.
10 percent completed.
11 percent completed.
12 percent completed.
13 percent completed.
14 percent completed.
15 percent completed.
16 percent completed.
17 percent completed.
18 percent completed.
19 percent completed.
20 percent completed.
21 percent completed.
22 percent completed.
23 percent completed.
24 percent completed.
25 percent completed.
26 percent completed.
27 percent completed.
28 percent completed.
29 percent completed.
30 percent completed.
31 percent completed.
32 percent completed.
33 percent completed.
34 percent completed.
35 percent completed.
36 percent completed.
37 percent completed.
38 percent completed.
39 percent completed.
40 percent completed.
41 percent completed.
42 percent completed.
43 percent completed.
44 percent completed.
45 percent completed.
46 percent completed.
47 percent completed.
48 percent completed.
49 percent completed.
50 percent completed.
51 percent completed.
52 percent completed.
53 percent completed.
54 percent completed.
55 percent completed.
56 percent completed.
57 percent completed.
58 percent completed.
59 percent completed.
60 percent completed.
61 percent completed.
62 percent completed.
63 percent completed.
64 percent completed.
65 percent completed.
66 percent completed.
67 percent completed.
68 percent completed.
69 percent completed.
70 percent completed.
71 percent completed.
72 percent completed.
73 percent completed.
74 percent completed.
75 percent completed.
76 percent completed.
77 percent completed.
78 percent completed.
79 percent completed.
80 percent completed.
81 percent completed.
82 percent completed.
83 percent completed.
84 percent completed.
85 percent completed.
86 percent completed.
87 percent completed.
88 percent completed.
89 percent completed.
90 percent completed.
91 percent completed.
92 percent completed.
93 percent completed.
94 percent completed.
95 percent completed.
96 percent completed.
97 percent completed.
98 percent completed.
99 percent completed.
100 percent completed.
File verification completed.
CHKDSK is verifying indexes (stage 2 of 3)...
0 percent completed.
1 percent completed.
2 percent completed.
3 percent completed.
4 percent completed.
5 percent completed.
6 percent completed.
7 percent completed.
8 percent completed.
9 percent completed.
10 percent completed.
11 percent completed.
12 percent completed.
13 percent completed.
14 percent completed.
15 percent completed.
16 percent completed.
17 percent completed.
18 percent completed.
19 percent completed.
20 percent completed.
21 percent completed.
22 percent completed.
23 percent completed.
24 percent completed.
25 percent completed.
26 percent completed.
27 percent completed.
28 percent completed.
29 percent completed.
30 percent completed.
31 percent completed.
32 percent completed.
33 percent completed.
34 percent completed.
35 percent completed.
36 percent completed.
37 percent completed.
38 percent completed.
39 percent completed.
40 percent completed.
41 percent completed.
42 percent completed.
43 percent completed.
44 percent completed.
45 percent completed.
46 percent completed.
47 percent completed.
48 percent completed.
49 percent completed.
50 percent completed.
51 percent completed.
52 percent completed.
53 percent completed.
54 percent completed.
55 percent completed.
56 percent completed.
57 percent completed.
58 percent completed.
59 percent completed.
60 percent completed.
61 percent completed.
62 percent completed.
63 percent completed.
64 percent completed.
65 percent completed.
66 percent completed.
67 percent completed.
68 percent completed.
69 percent completed.
70 percent completed.
71 percent completed.
72 percent completed.
73 percent completed.
74 percent completed.
75 percent completed.
76 percent completed.
77 percent completed.
78 percent completed.
79 percent completed.
80 percent completed.
81 percent completed.
82 percent completed.
83 percent completed.
84 percent completed.
85 percent completed.
86 percent completed.
87 percent completed.
88 percent completed.
89 percent completed.
90 percent completed.
91 percent completed.
92 percent completed.
93 percent completed.
94 percent completed.
95 percent completed.
96 percent completed.
97 percent completed.
98 percent completed.
99 percent completed.
100 percent completed.
Index verification completed.
CHKDSK is verifying security descriptors (stage 3 of 3)...
0 percent completed.
1 percent completed.
2 percent completed.
3 percent completed.
4 percent completed.
5 percent completed.
6 percent completed.
7 percent completed.
8 percent completed.
9 percent completed.
10 percent completed.
11 percent completed.
12 percent completed.
13 percent completed.
14 percent completed.
15 percent completed.
16 percent completed.
17 percent completed.
18 percent completed.
19 percent completed.
20 percent completed.
21 percent completed.
22 percent completed.
23 percent completed.
24 percent completed.
25 percent completed.
26 percent completed.
27 percent completed.
28 percent completed.
29 percent completed.
30 percent completed.
31 percent completed.
32 percent completed.
33 percent completed.
34 percent completed.
35 percent completed.
36 percent completed.
37 percent completed.
38 percent completed.
39 percent completed.
40 percent completed.
41 percent completed.
42 percent completed.
43 percent completed.
44 percent completed.
45 percent completed.
46 percent completed.
47 percent completed.
48 percent completed.
49 percent completed.
50 percent completed.
51 percent completed.
52 percent completed.
53 percent completed.
54 percent completed.
55 percent completed.
56 percent completed.
57 percent completed.
58 percent completed.
59 percent completed.
60 percent completed.
61 percent completed.
62 percent completed.
63 percent completed.
64 percent completed.
65 percent completed.
66 percent completed.
67 percent completed.
68 percent completed.
69 percent completed.
70 percent completed.
71 percent completed.
72 percent completed.
73 percent completed.
74 percent completed.
75 percent completed.
76 percent completed.
77 percent completed.
78 percent completed.
79 percent completed.
80 percent completed.
81 percent completed.
82 percent completed.
83 percent completed.
84 percent completed.
85 percent completed.
86 percent completed.
87 percent completed.
88 percent completed.
89 percent completed.
90 percent completed.
91 percent completed.
92 percent completed.
93 percent completed.
94 percent completed.
95 percent completed.
96 percent completed.
97 percent completed.
98 percent completed.
99 percent completed.
100 percent completed.
Security descriptor verification completed.
CHKDSK discovered free space marked as allocated in the volume bitmap.
Windows found problems with the file system.
Run CHKDSK with the /F (fix) option to correct these.

312568824 KB total disk space.
44312916 KB in 15892 files.
8988 KB in 902 indexes.
0 KB in bad sectors.
92372 KB in use by the system.
65536 KB occupied by the log file.
268154548 KB available on disk.

4096 bytes in each allocation unit.
78142206 total allocation units on disk.
67038637 allocation units available on disk.

System restore failed

Had this problem with my system restore after I restore it as a result of my deleting the user account on my pc last time.



System Restore is not able to create a restore point.
Please restart the computer, and then run System Restore again.

What am I going to do?
Here is a tip from the net. Want to try it later.


statemgr MUST be enabled in msconfig for system restore to
work.

To check:
Start>Run>(type) msconfig>Startup Tab>make sure statemgr is check>OK>restart if prompted to.

Then try this if it is still not working.

1. Restart your computer in Safe or DOS Mode.
2. Click Start, point to Search, and then click For Files or Folders.
3. In the Named box, type wininit.ini.
4. In the Look in box, click Local hard drives, and then click Find Now.
5. Right-click the Wininit.ini file, click Rename, type wininit.xxx, and then click OK.
6. Close the Find Files window, and then run System Restore again.
7. If the previous steps do not resolve the problem, run the following command to repair the damaged portions of your registry:
Start>Run>(type) scanreg /fix


UPDATED!!
I cant even do scandisk! I tried to scandisk in the tools tab.
Have to use the DOS based CHKDSK.
And found quite a lot of errors.
Fixed it and hope it will be ok

Recovering from a Partition Resize

Damn it!!! Just now was trying to resize my partition on my external hardisk. Suddenly my pc went kaput and now my hardisk is unformatted!!!!
Was using EASEUS Partition Manager. Trying to resize the partition. Then create a new one. 300 GB is too big for one partition.


How am I going to recover the data????
I have lots of file in my HD! :(
My ebooks, mv, animes, software, songs.. Aargh!!!!

ASP.NET Machine A...'s

Had a very itchy hand a few days ago. Saw in the user accounts an account with the name ASP.NET Machine A...'s. Since i never created the account I just thought that it was maybe a spyware or something like that.

So I just decided to remove the user account since I don't have the password for it. Then hell came...

My pc suddenly becomes slower, crawling even. Cant run any program. I can't use windows explorer or do anything at all. S***. What have I done?

Regretted my impulsive behaviour. I was thinking.. Oh no. I have to reinstall my windows! Then I decided to boot into safe mode and try to see if i can undo what I did.

Tried system restore. It was damn slow. Actually the msg "Not responding" is on the system restore window. Left it for half an hour and finally it managed to restore back my pc.

But to a state where lots of programs I installed cant be used anymore.
Regretted that i did not backup my registry. But then I'm glad that I don't need to reinstall windows.

After this I need to learn how to back up my registry.

Keyboard Problem

Had a problem with my keyboard. When I type in @ the char # will appear. Actually it not the problem with my keyboard. It is keyboard remapping. It is just that when I installed East Asian Language in my computer. At that time I set the keyboard setting to UK.

The solution? Just remove the UK keyboard from the Regional Settings and install US keyboard. Thats all.

Trouble with Internet

Want to connect to internet but having problem just now.
My DSL light is stable. Its just that I cant connect to the net.
After spending almost an hour with the support from TM doing this and that.
Finally found out the problem....

My DNS server. Should put it to streamyx's DNS.
The DNS are:
202.188.0.133
202.188.1.5

Before that I have to flush DNS.
The command is ipconfig /flushdns

Actually I have been using OpenDNS for quite some time without much problem.
Maybe its because of the undersea cable near Egypt. I don't know.
Later maybe I'll change again.

Windows Mobile

Just updated my blog template last night. Now everything is gone. Especially the links to many interesting blogs and sites. I guess I have to do it again.

Anyway since I'll be going to Bali this week, I need to update my PDA. I installed WorldMate Live. After installing it, I found that I have this popup each time i restart my PDA. The file 'WMScheduler' cannot be opened. blablabla....

I looked the installed directory, Storage Card/Program files/WorldMate and the file is there. After much searching, the solution is pretty simple. But I dont like it, cause I have to install it into the main device itself and I don't have much memory to support it.

While searching for the solution, I also looked at a few softwares that could edit the registry in Windows Mobile. Here are the two programs that I found. This is taken from:http://www.inspectmygadget.com/2007/07/17/how-to-hack-your-windows-mobile-registry/

Mobile Registry Editor: runs on your desktop and connects to your device using ActiveSync. Once you have this installed, connect your device via ActiveSync and click on one of the folder to the left. If the right side refreshes, you have a connection.

Being a desktop application, it is easy to navigate and make changes using your keyboard and mouse. As I don’t make many registry changes away from my desktop computer, I would generally use this.

PHM Registry Editor: runs on your device so you have free reign over where and when you make changes to the registry.

It has a nice interface and is quite easy to use on our little Windows Mobile screens. PHM Registry Editor works a little faster for me than Mobile Registry Editor did.

Back up and restore the registry in Windows

This is taken from MS support.

Manual steps to back up the registry in Windows Vista or in Windows XP

Windows Vista
1. Click StartStart button, type systempropertiesprotection in the Start Search box, and then press ENTER.
User Access Control permission If you are prompted for an administrator password or for a confirmation, type the password, or click Allow.
2. Wait for Windows to search for available disks and most recent restore points. In the System Properties dialog box, on the System Protection tab, click Create,
3. Type a name for the restore point and then click Create.
4. After the restore point has been created successfully, click OK two times.
Note If System Restore is turned off, click to select the local disk, click Apply and then click Create.

Windows XP
1. Click Start, click Run, type %SystemRoot%\system32\restore\rstrui.exe, and then click OK.
2. On the Welcome to System Restore page, click Create a restore point, and then click Next .
3. On the Create a Restore Point page, type a name for the restore point and then click Create
4. After the restore point has been created, click Close.
Note If System Restore is turned off, you receive a message that asks whether you want to turn on System Restore now. Click Yes. Then, in the System Properties dialog box, click to clear the Turn off System Restore check box, click OK, and then repeat this step.

Restore the registry
Manual steps to restore the registry in Windows Vista or Windows XP
Use System Restore to undo registry changes in Windows Vista or in Windows XP
Windows Vista
1. Click StartStart button, type systempropertiesprotection in the Start Search box, and then press ENTER.
User Access Control permission If you are prompted for an administrator password or for a confirmation, type the password, or click Allow.
2. In the System Properties dialog box, on the System Protection tab, click System Restore,
3. In the System Restore dialog box select Choose a different restore point, and then click Next
4. Select the restore point that you want to use, and then click Next.
5. Confirm your restore point, and then click Finish System restore restores the selected Windows Vista configuration and then restarts the computer.
6. Log on to the computer. When the System Restore confirmation page appears, click OK..

Windows XP
1. Click Start, click Run, type %SystemRoot%\System32\Restore\Rstrui.exe, and then click OK.
2. On the Welcome to System Restore page, click Restore my computer to an earlier time (if it is not already selected), and then click Next .
3. On the Select a Restore Point page, click the system checkpoint. In the On this list select the restore point area, click an entry that is named "Guided Help (Registry Backup)," and then click Next. If a System Restore message appears that lists configuration changes that System Restore will make, click OK.
4. On the Confirm Restore Point Selection page, click Next. System Restore restores the previous Windows XP configuration and then restarts the computer.
5. Log on to the computer. When the System Restore confirmation page appears, click OK..

Starcraft Multiplayer VPN Setup

Here I am assuming that
i) Starcraft is installed in your computer.
ii)IPX is installed.

First, install a VPN software first. Here I am using Hamachi. It seems that the latest version does not work with starcraft. I have to use Hamachi version -1.0.1.5-.

Note: Enable all the services. Disable the firewall. Don't update!

After that just play Starcraft as you normally do. If you encounter the problem of cannot join network, try this:




Goto Network connections and properties of the lan
card that your using to N/W. Goto IPX/SPX properties
and assign locator numbers. eg 000001 on computer
one, 000002 on the second.............. This resolves
the issue of cannot join network.

Computer keeps Rebooting / Ntdetect failed.

A friend just ask me for help with her laptop. It keeps on rebooting. And I mean that it doesnt even shows the windows loading. It just keeps on repeating the bios screen.

And then when I look carefully, just before it reboots, I saw for less than a second, the word Ntdetect failed. I googled it and found a solution. Simple. Took me less than 5 minutes to solve it.

Run XP repair.
Type in:
COPY X:\i386\NTLDR C\:
COPY X:\i386\NTDETECT.COM C:\
where X is the drive letter for your CD drive.
Remove the CD and type exit.