Logon Problem

From: Jason (anonymous_at_discussions.microsoft.com)
Date: 05/21/04 

Date: Fri, 21 May 2004 08:43:54 -0700

I had the same problem because of a virus having corrupted
EXPLORER.EXE (and a few DLLs) some time ago.

I replaced EXPLORER.EXE in HKLM\Software\Microsoft\Windows
 NT\CurrentVersion\Winlogon\Shell with CMD.EXE and used
the command line and a floppy disk (in safe mode) to
replace EXPLORER.EXE and several DLLs that had different
date stamps from a known good machine.

Once I rebooted and got in, I did an AV update and scan
and the results weren't pretty... We ended up
reinstalling the machine from scratch.

You might want to check WIN.INI (Load and Run), any of the
runs keys in the registry, and the local security policy
startup and logon scripts for the SHUTDOWN command. Could
be a prankster (not a virus) is having fun at your expense.

If you can access the data though, I'd say, copy off what
you need to keep run Microsoft's native Fix Disk utility
(FDISK.EXE). That almost always fixes whatever problem
you might be having with that pesky operating system...

:^)
>-----Original Message-----
>have a strange situation that i cannot resolve. I have
>looked for a few hours over all available news groups and
>support forums I could find. The problem is as follows:
>
>Windows boots cleanly, presents a log in screen
>
>the loging screen accepts the user name and password and
>seemingly proceeds to log in.
>
>After it says loading settings, it does not continue to
>explorer shell, but in the same window goes to saving
>settings then "logging off"
>
>after logging off it returns me to the press cntrl + alt
>+ delete box to login. Logging in again results in the
>same cyle I just described. The same cycle takes place in
>safe mode. More over I do not even have time between the
>login and log off to use cntrl + alt + delete to get to
>task manager and start explorer.
>
>>From another computer, this computer is completely
>accessable. All directories and files are viewable, but I
>cannot use remote desktop to start a session either.
>
>>From looking at other newsgroups I have also checked some
>other things in the registry. explorer.exe is listed as
>the shell registry key value
>(HKLM\Software\Microsoft\Windows
>NT\CurrentVersion\Winlogon\Shell). I have also looked at
>the run and the run once keys to ensure that no seemingly
>nefarious programs were running and did not see anything.
>Also checked to see if shutdown.exe was being invoked on
>startup and did not find that to be the case either.
>
>How do I proceed from here?
>.
>