How do I stop SpybotS&D from blocking userinit.exe?

[bugmento]

hey matt, chi-va, thanks for all the feedback. chi-va, the link you gave in your post seems to pretty accurately describe my problem, so i guess I have to network another computer to mine to fix it. To do this, would I just plug a network cable into my computer and the other end into another computer? because i can't create a network from "network connections" since I can't even log in.

thanks,
ryan

[chi-va]

In order to use method 1 you will need a network switch, or a router, or a hub or a crossover cable. Apart from that, it is probably necessary to configurate the network because your broken system doesn't seem to be in a network yet.

In this case, please modify method 1 by using a live operatings system like Windows PE( customised version BartPE).
http://windowsxp.mvps.org/peboot.htm

[bugmento]

Okay so I'm trying method 1, but when I get to "Connect Network Registry", i can detect my computer, named "Ryan", but when it asks for username/password for an account with administrator rights, I type in the username/password for my only account, "R" and the right password, and it says it "the following error occurred...blah blah..access is denied"

Im thinking this is because since my computer can't log in without immediately logging out, my account can't stay logged in so the 2nd computer I'm networked to can't detect it.

So basically, the only way for me to fix the registry is to create the Boot CD and stick that in my computer and start it up?

thanks

[chi-va]

It may be possible that there are some remote registry service restrictions or the service is not running. Like written, I suggest to use the BartPE boot CD.

Just create the CD, insert it in the broken system and change the boot sequence in your Bios if it is necessary. The provided link gives you a good instruction what you have to do step by step.

http://windowsxp.mvps.org/peboot.htm

If you have any problems with creating the BootCD e.g. if you don't have a Windows XP CD then please try method 2.

[chi-va]

Warning: Method 2 and similar methods are risky because they are only using command lines where you see less warning messages.
So it may be possible that you overwrite your original registry without beeing able to recover it. Unless you understand what
each command line is doing I highly recommend to prefer repair methods with a grafical user interface.

[bugmento]

Okay so I just tried to create a Boot CD from the instructions provided on the link you gave, but the thing is

1.) I don't have access to a computer with XP install files
and
2.) I don't have an XP install CD.

I tried to create the Boot CD from a computer with Vista, and obviously it didn't detect any XP install files, and I didnt have an XP install CD to put it for it to scan.

So basically, since I don't have any XP things for the PE Builder program to get the XP install files from, I can't make the Boot CD.

So, i'm back to method 1. But the thing about method 1, in the
http://forums.spybot.info/blog.php?b=14 example,
the screenshot shows that the IP address was typed, as opposed to the name of the computer, which I kept typing in that box that asked for the name of the object. Is there a way to find the IP address of the computer (with the userinit.exe registry problem) using the computer its connected to?
(I just connected the 2 computers with an ethernet crossover cable)


if this method doesn't work for me, then the only thing i can do is totally wipe my computer and restart it from when i bought it, so thats why i'm really trying to get this to work.

thanks for any feedback,

ryan

PS, would the CDs that rewrite my computer from when i bought it, the Toshiba Recovery and Applications CDs, have XP install files on them? if they did i guess i could try using those with the PE builder.

[chi-va]

As written, using method 1 could be difficult if the network is not properly configurated. There are networking tools for finding the IP address. E.g.: http://www.radmin.de/download/ipscan15.exe
(Advanced IP Scanner v1.5 from radmin)

Are there any reasons why you are ignoring the other methods from the blog?

2. Method : Offline registry tools and password resetter
Requirements:
This tool requires a 2nd computer to download and create a bootcd, there are no further requirements.

The download can be found here
Download size is about 3 MB, which is quite small and makes this method recomendable

OEM CDs and Recovery CDs are not suitable for creating Windows PE.
Once the CD is created the userinit affected computer needs to be started with this CD.

After the boot procedure has been completed, the system asks for the boot partition.
Usually the choice would be "1".
In my example it is "2".

Screenshot 1

After that the path to the registry is asked. By default the correct path is already given, so this can be accepted by pressing the enter key.

Screenshot 2

Next choose "2" : RecoveryConsole parameters [software]

Screenshot 3
On the next prompt choose "9" Registry editor

Screenshot 4
The system now enters a bash console like navigation for the Software key of the Registry.
Following commands may be helpful:
Code:

note that Names are case sensitive
ls - will list the current key contents
cd <$keyname> - will open the key given in <$keyname>
cd .. - will go up one layer of the key structure
ed <$valuename> - will open prompt to edit the value specified in <$valuename>

So entering:
Code:

cd Microsoft\Windows NT\CurrentVersion\Winlogon

Will lead you to the required location.
Screenshot 5
The command ls will list the contents.
Type
Code:

ed Userinit

Screenshot 6

Now enter the required Data for the Userinit Value:
Code:

for Windows XP
c:\windows\system32\userinit.exe,

for Windows 2000
c:\winnt\system32\userinit.exe,

Screenshot 7

With the following command the Data of the Userinint Value can be confirmed:
Code:

cat Userinit

Screenshot 8

If the data is correct you can now enter q to quit the registry editor mode.
Enter q again to exit the Software Hive.
You will now be prompted to save, enter y to save.

Screenshot 9

After that a prompt for a new run appears, enter n for no.
Screenshot 10
Reboot normally and log on to Windows.

It is quite safe as long as you don't have to use method 4 as well.

OEM CDs and Recovery CDs are not suitable for making a Windows PE CD.

[bugmento]

I looked over all the methods provided in the blog and only method 1 doesn't require a boot CD. methods 2 and 4 (i didn't see a 3) both require the boot CD, which i don't have the resources (ie Windows XP install CD) to create.

so pretty much i think method 1 is the only one that I can possibly do. I'll try that IP address finder program you provided to try to get the IP address of the problem computer with the 2nd computer its connected to.

thanks,
ryan

[chi-va]

There seem to be a misunderstanding.

This tool requires a 2nd computer to download and create a bootcd, there are no further requirements.

The download can be found here:
http://home.eunet.no/~pnordahl/ntpasswd/
Download size is about 3 MB, which is quite small and makes this method recomendable

Once the CD is created the userinit affected computer needs to be started with this CD.

As you can see it, it is not the same as Windows PE. Just download the tool and make a bootable cd with it. A Windows XP cd is not necessary for this procedure.

PS.: Excuse me for the wrong quotation. "OEM CDs and Recovery CDs are not suitable for creating Windows PE." It was mixup after editing the last post. This line was not in the original blog. Please follow the original instructions from the blog. There are also screenshots which could help you to fix the problem.

[bugmento]

YESSSSSS so i tried method 2, created the boot CD, and followed all the steps, and now I can log in without XP logging out immediately. When i first booted up, SpybotS&D asked me if i wanted to allow a whole bunch of changes, and I clicked "Allow change" for all of them. I just restarted again and it seems like my computers working just about fine now.

Thanks so much for all your help chi-va, the links and feedback really were great.

thanks again,
ryan