Announcement

Collapse
No announcement yet.

Deleted Registry Key disabling logon

Collapse
X
  • Filter
  • Time
  • Show
Clear All
new posts

  • Deleted Registry Key disabling logon

    Hello everyone.
    While combating a virus attack I made the big mistake of deleting the registry key Userinit located in "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"

    This unfortunate blunder has caused XP PRO (SP1) to block any access past the login screen. Safe mode or otherwise.
    After some research, I thought that I could use reg.exe to add the key back to the registry. The only way I can startup the system is with the XP CD in Recovery mode, and it seems that REG.EXE is not a valid command when in the Recovery Console.
    Microsoft's tech support's answer is to replace the hives with the WINDOWS\REPAIR version from a long time ago. This is not the solution I am looking for. I simply want to get the Userinit key back into the existing registry.
    Can someone out there help me? Maybe slave the drive, or is there some utility I just can't find?
    Any ideas would be greatly appreciated.

  • #2
    Re: Deleted Registry Key disabling logon

    Have you tried using Last Known Good Configuration?
    1 1 was a racehorse.
    2 2 was 1 2.
    1 1 1 1 race 1 day,
    2 2 1 1 2

    Comment


    • #3
      Re: Deleted Registry Key disabling logon

      Yes, I was able to logon with "Use Last Known Good...." but functionality was very old. Need to restore that key if possible...

      Comment


      • #4
        Re: Deleted Registry Key disabling logon

        I'm not sure if this will work but its probably worth a try.

        If the machine is on a network let it startup as far as it can then try and edit the registry remotely and add the missing keys back.
        Andrew

        ** Remember to give credit where credit is due and leave reputation points sigpic where appropriate **

        Comment


        • #5
          Re: Deleted Registry Key disabling logon

          What about the System Restore?
          Did you check if you have a convenient restore point?. If yes, you are saved
          More about System Restore:
          http://www.bleepingcomputer.com/tuto...utorial56.html
          Regards,
          Csaba Papp
          MCSA+messaging, MCSE, CCNA
          ...............................
          Remember to give credit where credit is due and leave reputation points where appropriate
          .................................

          Comment


          • #6
            Re: Deleted Registry Key disabling logon

            1- Machine will only boot to safe mode after restoring system hives to repair level
            2- No restore points to restore to [email protected]!

            I did find an article about using regedit to LOAD and edit a system hive. I am going to try to use a disk recovery program, or slave the drive, to get a copy of the bad registry hive to a working xp computer to see if this works. If so, I should be able to copy the repaired hive to a cd, boot my computer with the xp disk to get to the recovery console and then copy back the repaired hive from the cd.

            I got everything crossed....

            Comment

            Working...
            X