After ur antivurs detected and removed the virus( both "winupdate86.exe" and "winlogon86.exe") ur windows continues to look for "winlogon86.exe", couse it is on current place in registry,and its all it knowsto look for, when it try to login.
So, ur computer actualy loged on via virus, all time until ur antivirus deleted it (after that u couldnt be able to login).
Let me explain what happen with ur computer (why u cant login into ur windows account).Ģ) it copied itslef, or it made a copy simmilar name to itself into ur WINDOWS/system32ģ) it cahnged the registry key: HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ WindowsNT \ CurrentVersion \ Winlogon, and instead "Userinit.exe", it wrote its nameġ) u got a virus, for an example, "winupdate86.exe"Ģ) it made a copy inside system32 as "winlogon86.exe"ģ) changed registry key, and in entry putted "winlogon86.exe" reading is good for you (at least they say it is) so read as much as you can about how others solved this issue as well, I have only given details of my latest effort, its different everytime. If you don't have "winternals erd commander" cd you could use somthing else like a PE cd such as BartsPE or even a Linux live cd like ubuntu.įor more information use google search and try not to read Microsoft's "official" help they are confusing. I tried the expand command from recovery console:Įxpand d:\i386\userinit.ex_ c:\windows\system32\userinit.exeīut in my case I got the "file could not be created" error so I expanded the file to another directory (the root of c:\) and used "winternals erd commander 2005" and moved the file to the system32 folder, that solved that issue more clear instructions on how to replace it would be helpful so here's what happened to me last night. Now on a more serious note if the registry entries he mentioned are intact(ie the way they are supposed to be) the issue could be a missing userinit.exe file. In my case c:\ is my hdd with windows on it and d:\ is my dvdrom but I have other setups where its completely different Actually you are supposed to replace the "x" with the letter that is relevant to your particular setup, its like in algebra "x" can be anything.
0 kommentar(er)
