Cant login - Ctrl-Alt-Del doesnt work

  1. blandmc

    blandmc New Member Bronze Member

    Joined:
    Nov 14, 2009
    Posts:
    5
    Likes Received:
    0
    Local time:
    13:54
    My System
    Loading...

    I have seen many users complain about this, but I can't find any solutions online.

    Environment:
    - Dell Latitude D616 Notebook
    - WinXP SP3 OS
    - Running McAffee and SPyware doctor for protection
    - Always updated and always on protection

    ISSUE
    I was surfing a Chinese web site similar to ebay called TaoBao. They required I install something in order to view the no spam word confirmation - pretty common here.

    The next day when I booted up the Notebook PC, it would not respond to Ctrl-Alt-Del sequence.
    - mouse works
    - keyboard is lit up
    - both notebook keyboard and external keyboard have no effect
    - If you go into the boot/setup menu prior to windows login, you can confirm the keyboards work, but this is no help as far as I can see
    - I also tried the external keyboard on another PC and it worked there too, so keyboards are not the issue

    SAFE MODE
    - when booting into safe mode, same issue, it always starts with the login screen which requires Ctrl-Alt-Del, so you cannot boot into Safe Mode because you cannot login
    - Choosing Windows Safe mode with command prompt still just brings up the Crtl-Alt-Del required login... no help there since I cant hit Ctrl-Alt-Del to login

    BOOT CD
    - In trying to use the original Windows XP CD to boot, this is OK, but when you select the option to repair it just drops you into a DOS command and does nothing. And I can't seem to use any restore commands from here.
    - I tried to type in the Windows Restore command:
    c:\system32\restore\rstrui.exe but windows didnt recognize the command
    - I tried CDing to the directory and typing the command rstrui
    again windows did not recognize the command. I have been told that RSTRUI does not work from the restore consule.
    - I tried to use sfc / scannow, but apparently sfc can also not be used from here.
    - I tried to do a chkdsk / r, and it ran once, found and fixed 1 error. I ran it again, and found no errors. Upon reboot, the issue is the same - no change

    QUESTION
    - Does anyone know how I can get into a regular DOS prompt without logging in so I can try sfc /scannnow or rstrui?
    - Does anyone know how to fix this any other way besides reformatting my drive?

    Please help!

    Thanks!


    Any other ideas? I have FAR too many applications on this machine to have to re-format it.

    But if I have to reformat and lose all those Apps... anyone know a good way to grab the data from another machine?

    Please help anyone!

    Thanks!
     
  2. Wolfeymole

    Wolfeymole Elite PCHF Werewolf Tech Member Elite Member PCHF $Donator

    Joined:
    Nov 13, 2006
    Posts:
    23,155
    Likes Received:
    1,617
    Local time:
    05:54
    My System
    Loading...

    Hello Bland

    Welcome to PC Help Forum

    Well you look to be well and truly up the junction on this one and you look to have done all the options available.

    You obviously realise that some serious malware has hit the system so I really would recommend a format.

    You could however pull the drive and hook it to another box to pull the executables off and then format it.

    Others may have different opinions so hang around for a while.
     
  3. Sir Trews

    Sir Trews Well-Known Member Elite Member PCHF $Donator

    Joined:
    Mar 15, 2006
    Posts:
    2,433
    Likes Received:
    142
    Local time:
    00:54
    My System
    Loading...

    Blandpc, Welcome to the Forum!

    THE Best place for help!

    You having to 'install' something in order to view... whether or not it is 'pretty common'... you've been bugged. Period. The rest of your description confirms it...

    I thank you greatly, as will our great Techs, for all the great information and will I get this going to get you fixed up as soon as possible.

    Please click on the Prework link in my signature below and we shall look forward to your replies.

    Thanks for your patience :)




     
  4. blandmc

    blandmc New Member Bronze Member

    Joined:
    Nov 14, 2009
    Posts:
    5
    Likes Received:
    0
    Local time:
    13:54
    My System
    Loading...

    I can't do any of the pre-work, because I can't login to that machine...

    So, I hope someone can offer help without that step.

    I am happy to answer any questions about my system and provide as much info as I can.

    Please help!

    Thanks!
     
  5. Wolfeymole

    Wolfeymole Elite PCHF Werewolf Tech Member Elite Member PCHF $Donator

    Joined:
    Nov 13, 2006
    Posts:
    23,155
    Likes Received:
    1,617
    Local time:
    05:54
    My System
    Loading...

    I think perhaps Sir Trews may have misread your opening statement Bland.

    Be aware though that depending on the severity of this attack the .exe files may have been poisoned too.
     
    Sir Trews likes this.
  6. samuria

    samuria Network Specialist Tech Member Elite Member

    Joined:
    Aug 15, 2009
    Posts:
    21,984
    Likes Received:
    1,610
    Local time:
    05:54
    My System
    Loading...

    this may get you out of trouble download a live dc here
    You can get it free but have to register it will then boot a windows pe from the cd and it has a virus scanner built in. This may sort the virus out or at least you can get any files of the hd and make any changes to the hd. there are more live cd here.

    Have you tired a usb keyboard as opposed to a ps2 one it depends what its blocking. It strange it locks you out because if its malware it is useless as it cant do anything
     
  7. samuria

    samuria Network Specialist Tech Member Elite Member

    Joined:
    Aug 15, 2009
    Posts:
    21,984
    Likes Received:
    1,610
    Local time:
    05:54
    My System
    Loading...

    Right I have the solution but am out and about so cant fully research this can any other tech member research my answer to solve the problem.

    If its on a network you can goto anther pc and open regedit and then connect to the faulty pc's registery(unless its disabled remote reg as well) and change the registry to back to the welcome screen.

    Being out I cant look up what keys to change but if someone can find that and post it then this should solve the problem loads of people are having the problem and no one has come up with a solution to it PCHF may be the first since we are the best

    Marked as open for other to pick up
     
  8. Wolfeymole

    Wolfeymole Elite PCHF Werewolf Tech Member Elite Member PCHF $Donator

    Joined:
    Nov 13, 2006
    Posts:
    23,155
    Likes Received:
    1,617
    Local time:
    05:54
    My System
    Loading...

    First and foremost is this machine on a network Bland?
     
  9. samuria

    samuria Network Specialist Tech Member Elite Member

    Joined:
    Aug 15, 2009
    Posts:
    21,984
    Likes Received:
    1,610
    Local time:
    05:54
    My System
    Loading...

    There are lots of people on the net with this virus so here is a solution that should work so other can also find it

    If you have the pc on a network this may well work. if it normally connect via wireless plug a cable in as well on a network with a dhcp server (ie router)
    Then on anther pc open regedit
    Choose file connect network registery and choose the infected pc. then

    1. Locate the following registry key:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
    2. Using your account name and password, double-click the DefaultUserName entry, type your user name, and then click OK.
    3. Double-click the DefaultPassword entry, type your password under the value data box, and then click OK.

      If there is no DefaultPassword value, create the value. To do this, follow these steps:
      1. In Registry Editor, click Edit, click New, and then click String Value.
      2. Type DefaultPassword as the value name, and then press ENTER.
      3. Double-click the newly created key, and then type your password in the Value Data box.
      If no DefaultPassword string is specified, Windows XP automatically changes the value of the AutoAdminLogon registry key from 1 (true) to 0 (false) to turn off the AutoAdminLogon feature.
    4. Double-click the AutoAdminLogon entry, type 1 in the Value Data box, and then click OK.

      If there is no AutoAdminLogon entry, create the entry. To do this, follow these steps:
      1. In Registry Editor, click Edit, click New, and then click String Value.
      2. Type AutoAdminLogon as the value name, and then press ENTER.
      3. Double-click the newly created key, and then type 1 in the Value Data box.
    5. Quit Registry Editor
    6. reboot the pc and you should login automatically.
    7. There may then be other problems but our security team should be able to then help you
    Method 2
    Boot from Vista install disk, choose recovery, and command prompt.
    Open the registry editor: regedit
    This loads the registry editor with a temporary registry, not the windows registry from the hard disk.
    Select HKEY_LOCAL_MACHINE in the registry tree, and go to the File menu and choose "Load Hive".
    Open the registry hive file SOFTWARE from the location: C:\Windows\System32\Config
    Give it a random name different to any of the existing names (the name doesn't matter).

    Make the necessary changes to the registry hive.

    Select the registry hive you edited, go to File, and choose "Unload Hive".

    Then exit the recovery console and restart. The registry should have been changed.
     
    Sir Trews likes this.
  10. blandmc

    blandmc New Member Bronze Member

    Joined:
    Nov 14, 2009
    Posts:
    5
    Likes Received:
    0
    Local time:
    13:54
    My System
    Loading...

    Thanks for your replies and suggestions, Samuria.

    The PC is on my home network, but I am not able to access it from my other laptop. Windows networks are such a pain in the **** even when both PCs are up and running, that it does not surprise me that I can't access it when it is having problems.

    So, I am not able to do any fixes over a network though I tried that.

    I have purchased the Avast BART CD per your suggestion... now just waiting for that... no instant download apparently. I will let you know if that works or not.

    Thanks for all the ideas.
     
  11. samuria

    samuria Network Specialist Tech Member Elite Member

    Joined:
    Aug 15, 2009
    Posts:
    21,984
    Likes Received:
    1,610
    Local time:
    05:54
    My System
    Loading...

    I thought you could get the cd for free if you register. I would also download free Norman antimalware you dont have to install it so you could boot the cd and run it from a pendrive to see if it picks anything up.

    We still need to edit the registry as if it cures the virus it may not undo problems. Try this
    on the other pc create a user and a password the same as faulty pc(must be admin) then login as that user. I suspect it dint work before as it didnt have username password.
    When you login first try from a cmd prompt typing

    net use p: \\brokecomputername\c$
    change the broke computer name to the name or ip of the machine

    If you are lucky you will have a drive p so you can get your files off and scan it from your working pc.

    Then try the regedit as per the instruction before hopefully it will work this time
     
  12. blandmc

    blandmc New Member Bronze Member

    Joined:
    Nov 14, 2009
    Posts:
    5
    Likes Received:
    0
    Local time:
    13:54
    My System
    Loading...

    Still not working... Here's the update:

    1. I did not yet try the system restore as I did purchase the avast! BART CD for $160 and I decided to give what I purchased a try first.

    2. As for the avast! BART CD... here's what I did:
    A. Put the CD into the drive and booted from CD.

    B. I checked my entire system (several hours) with a thorough anti-virus check including archived files. avast! found 7 infections:
    I. 3 x mp3 / WMA audio files my wife had downloaded
    - Said the virus was "WMA:Wimad[Drp], COM & EXE infection"
    - I deleted all 3 files

    II. c:\hiberfil.sys
    - Said the virus was "Win32:VB-HOG[Trj], EXE infection"
    - avast! failed to repair.
    - I moved the file to c:\quarrantine\ for now since I assume avast! won't be able to delete it and I could do it manually later by turning off the function if I can get into my system, and then clean the machine fully, then re-enable hibernation.

    III. c:\pagefile.sys
    - Said the virus was "Win32:VB-GC[Wrm], EXE infection"
    - avast! failed to repair.
    - I moved the file to c:\quarrantine\ for now since I assume avast! won't be able to delete it and I could do it manually later by turning off the function if I can get into my system, and then clean the machine fully, then re-enable virtual memory.

    IV. C:\documents & settings\USERNAME\local settings\temp\install[1].exe
    - Said the virus was "Win32:Walpak[Cryp], COM & EXE infection"
    - I deleted the file

    C. I used the avast! registry cleaner:
    - It found 143 registry entries it wanted to clean. All were Shared DLLs or keys that it said were invlad as they pointed to nothing.
    - Only option was to "Process the keys" or "Cancel" So I processed. It said it was successful.

    D. I then used the avast BART CD's Regedit function to go into the registry
    - Went to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
    - Double clicked on DisableCAD
    - Set to 1 to disable the need for Ctrl-Alt-Del. Clicked OK.

    E. I also tried to have it auto-fill in my password in case the keyboard still had issues:
    - Went to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
    - Looked for the DefaultPassword value, but there was none
    - Tried to create the value by going to Edit->New
    - Unfortunately the avast! version of Regedit only contains "Find" and "Find Next" within the Edit menu. So, I could not do this.

    F. I closed the Registry editor and rebooted my machine.

    G. Machine rebooted into the Windows login
    - there was no need to hit Ctrl-Alt-Delete, so that worked
    - my user name was correctly populated
    - My USB mouse worked fine, as did the touchpad on my notebook, so I clicked into the password field
    - When I tried to type my password, I found the keyboard did not respond.
    - Both the laptop keyboard and the external USB keyboard do not work.
    [of course they both worked when using avast! and in the Boot Setup, etc... just don't work at the login screen]

    So... the issue remains.

    i can try to do the system restore from the control console next, but before I do that I wanted to check if anyone had any other ideas.
    Please let me know! Thanks!
     
  13. blandmc

    blandmc New Member Bronze Member

    Joined:
    Nov 14, 2009
    Posts:
    5
    Likes Received:
    0
    Local time:
    13:54
    My System
    Loading...

    I bought a PS2 keyboard on the way home from work.. only $7, so no big financial loss to confirm I was right - this was not the issue. Tried the external keyboard in the PS2 port. Exact same issue - works in the bootup and setup screens, does not work for Windows Login. No luck there.

    RESOLVED
    The good news is that in my own hunting around I did see a suggestion on a Microsoft Support forum of all places where some other user was complaining their logitech keyboard no longer worked.

    The suggestion from Microsoft was to use RegEdit and:
    1. navigate to:
    HKLM\System\Current Control Set\Control\Class\{4D36E96B-E325-11CE-BFC1-08002BE10318}

    2. Double click on UpperFilters value

    3. check if there is anything before or after "kbdclass" - if so, delete any data before or after that.

    So, I used my avast! BART CD and the registry edit tool on it to check that... in my case, there was a:
    HKLM\System\Current Control Set\Control 1\Class\{4D36E96B-E325-11CE-BFC1-08002BE10318}

    and a

    HKLM\System\Current Control Set\Control 3\Class\{4D36E96B-E325-11CE-BFC1-08002BE10318}

    So, I checked both.

    The UpperFilter value in one was:
    TfKbMon
    kbdclass
    alidvc

    The UpperFilter value in the other one was:
    TfKbMon
    kbdclass

    So, I did as the instructions said and deleted any data before or after the kbdclass.

    I closed out the registry edit feature from the avast! BART CD, and rebooted.

    Upon Windows login, my keyboards both worked. I have rebooted several times and it seems fixed. My PC is currently undergoing a lot of virsu scanning to try to clean up, but hopefully the situation is resolved.

    Thanks to everyone for their suggestions and advice. Hopefully if some other user finds this thread it will help them, too.
     
  14. samuria

    samuria Network Specialist Tech Member Elite Member

    Joined:
    Aug 15, 2009
    Posts:
    21,984
    Likes Received:
    1,610
    Local time:
    05:54
    My System
    Loading...

    Great news glad we got you into your pc its a first because on the net no one else has been able to fix it. But then pchf we are the best. I would now complete the prework in my signature and let the security team check your pc and give it a clean bill of health.
     
Similar Threads
Forum Title Date
Windows XP cant login to xp :S Oct 16, 2011
Windows XP cant find file associated with installed program Oct 29, 2013
Windows XP cant find plugin Jan 19, 2013
Windows XP Cant download videos Jan 10, 2013