Vista login issue

[EX Admin]

Hello there,

I have strange issue with Vista Ultimate edition with SP1 and latest
patches. Once I reboot the PC, it looks fine with regular login Screen. Once
I choose a user to login, it give Windows explorer pointing to document
folder with black backgroud screen. If I close the explorer windows, all
screen will become black. If I hit CTRL +ALT+ Del choose task manager, from
process tab, kill explorer.exe, then click application Tab, new task, type
explorer, then click OK, everything is backing to normal. It happens to all
users on the PC. Even I delete a user profile, or create a new user with the
same issue. It seems the settings that applied to all users. open MSconfig
all serviceds are Microsoft services and Symantec services, start up are all
normal. Just cannot figure out what's going on. BTW, in XP there is settings
in C:\documents and Settings, there is default users settings folder, why I
cannot find in Vista? Is there any similar settings that can be changed in
Vista or there is ant registry settings I have to look at?

TIA

 

[BillD]

BTW, in XP there is settings
in C:\documents and Settings, there is default users settings folder, why I
cannot find in Vista?

open Windows Explorer, click on the address bar and just type
c:\users\userName\appdata and hit ENTER key.

 

[Synapse Syndrome]

open Windows Explorer, click on the address bar and just type
c:\users\userName\appdata and hit ENTER key.

It's a lot quicker to just type %appdata%

ss.

 

[Synapse Syndrome]

Hello there,

I have strange issue with Vista Ultimate edition with SP1 and latest
patches. Once I reboot the PC, it looks fine with regular login Screen.
Once
I choose a user to login, it give Windows explorer pointing to document
folder with black backgroud screen. If I close the explorer windows, all
screen will become black. If I hit CTRL +ALT+ Del choose task manager,
from
process tab, kill explorer.exe, then click application Tab, new task, type
explorer, then click OK, everything is backing to normal. It happens to
all
users on the PC. Even I delete a user profile, or create a new user with
the
same issue. It seems the settings that applied to all users. open
MSconfig
all serviceds are Microsoft services and Symantec services, start up are
all
normal. Just cannot figure out what's going on. BTW, in XP there is
settings
in C:\documents and Settings, there is default users settings folder, why
I
cannot find in Vista? Is there any similar settings that can be changed in
Vista or there is ant registry settings I have to look at?

I'd run Autoruns, and see what is loading at startup from All Users.

http://technet.microsoft.com/en-us/sysinternals/bb963902.aspx

ss.

 

[EX Admin]

Thanks for info. It seems everything is normal. Here is output. any suggestion:

Microsoft - ATI- Nero - Symantec - adobe

Auto Run - Logon

HKLM\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon\Userinit C:\Windows\system32\userinit.exeUserinit
Logon Application Microsoft Corporation c:\windows\system32\userinit.exe

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell
Explorer.exeWindows Explorer Microsoft Corporation c:\windows\explorer.exe


Is it Normal to startup with explorer.exe automatically? If not, How to
disable it?

Thanks again

 

[EX Admin]

I unchecked the explorer.exe from autoruns, it's getting worse. Once I
login, it just gives me a black screen. I cannot get back to normal screen by
doing task manger trick.

 

[Synapse Syndrome]

Thanks for info. It seems everything is normal. Here is output. any
suggestion:

Microsoft - ATI- Nero - Symantec - adobe

Auto Run - Logon

HKLM\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon\Userinit
C:\Windows\system32\userinit.exeUserinit
Logon Application Microsoft Corporation c:\windows\system32\userinit.exe

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell
Explorer.exeWindows Explorer Microsoft Corporation c:\windows\explorer.exe


Is it Normal to startup with explorer.exe automatically? If not, How to
disable it?

That second entry looks a bit fishy to me, but I do not have a Vista machine
to hand to confirm. You should be able to disable it by unticking the box.
If it is that which is causing this, you can try deleting the registry key.

Let someone else here, that uses Vista, confirm whether that should be
there, first.

ss.

 

[Synapse Syndrome]

I unchecked the explorer.exe from autoruns, it's getting worse. Once I
login, it just gives me a black screen. I cannot get back to normal screen
by
doing task manger trick.

On reboot, after post, try pressing F8 every one or two seconds, and choose
Last Known Good Configuration. (I can't actually remember if Vista has
this, but try anyway).

Other than what I have already suggested, I cannot think of place to look.
If Safe Mode works ok, it should be something in your startup list. I doubt
it could be a driver or service issue.

ss.

 

[Hobbes]

That second entry looks a bit fishy to me, but I do not have a Vista
machine to hand to confirm. You should be able to disable it by unticking
the box. If it is that which is causing this, you can try deleting the
registry key.

Let someone else here, that uses Vista, confirm whether that should be
there, first.

ss.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon\AutoLogonChecked
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon\GPExtensions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon\Notify

This is all I got in Vista Home 32bit

 

[EX Admin]

I unchecked the explorer.exe from autoruns, it's getting worse. Once I
login, it just gives me a black screen. I cannot get back to normal screen by
doing task manger trick.

I checked the explorer.exe again. I saw registry entry is gone (autoruns
disabled subkey). However, it only gives me black screen now. the trick
doesn't work anymore.

 

[EX Admin]

do you see

C:\WINDOWS\Config\csrss.exe Explorer.exe

by double clicking shell?

 

[EX Admin]

thanks for you all for help. and figure out and fix the problem by

changing C:\WINDOWS\Config\csrss.exe Explorer.exe

to Explorer.exe

by double clicking shell?

 

[EX Admin]

thanks for you all for help. and figure out and fix the problem by

changing C:\WINDOWS\Config\csrss.exe Explorer.exe

to Explorer.exe

by double clicking shell?

 

[Hobbes]

do you see

C:\WINDOWS\Config\csrss.exe Explorer.exe

by double clicking shell?

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon\AutoLogonChecked
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon\GPExtensions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon\Notify

This is all I got in Vista Home 32bit

just explorer.exe

 

[Frank Saunders MS-MVP IE,OE/WM]

thanks for you all for help. and figure out and fix the problem by

changing C:\WINDOWS\Config\csrss.exe Explorer.exe

to Explorer.exe

You are infected.

Do a thorough check for malware, following all of the steps at one of these
Web pages.
Help with malware:
All MS-MVP Sites.
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://www.elephantboycomputers.com/page2.html#Removing_Malware
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/darnit.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm

Unexplained computer behavior may be caused by deceptive software.
http://support.microsoft.com/kb/827315

So How Did I Get Infected Anyway?
For quite a few people it's by installing programs like Messenger Plus,
whose ads for malware don't identify the malware as such and try to convince
you that you owe it to the author. See also:
http://www.wilderssecurity.com/showthread.php?t=27971
Don't ever do a "default" install of anything. Always choose Custom and see
what else is being carried along. Don't install any extras you're not sure
of.