I thought I had posted this but cannot find it, so I apologize if this
appears twice.

Anyway, I had a situation with Windows XP Professional that I have never
seen, and am trying to find out if anyone else has.

My customer reported that he was browsing the internet when his computer
locked up. He rebooted, and when the computer came back up, the Ctl-Alt-Del
prompt did not show up - only a blank desktop and a mouse arrow.

I tried booting the machine in safe mode. It came up with the normal safe
mode screen - except no login screen. I could not find a startup mode that
would allow me to log in. I tried a reinstall repair and it copied the files
and rebooted - and came up to the same blank screen (with a bigger mouse
arrow because now we're in VGA).

Finally, finding nothing on the net about it, I did a fresh install of
Vista, which proceeded normally (which rules out hardware problems).

The whole episode acts like a virus except that I can't find anything about
it on the virus information sites, besides which the computer was protected
by antivirus firewall.

Any information about this would be appreciated.

Steve Jensen wrote:
> I thought I had posted this but cannot find it, so I apologize if this
> appears twice.
>
> Anyway, I had a situation with Windows XP Professional that I have
> never seen, and am trying to find out if anyone else has.
>
> My customer reported that he was browsing the internet when his
> computer locked up. He rebooted, and when the computer came back up,
> the Ctl-Alt-Del prompt did not show up - only a blank desktop and a
> mouse arrow.
>
> I tried booting the machine in safe mode. It came up with the normal
> safe mode screen - except no login screen. I could not find a
> startup mode that would allow me to log in. I tried a reinstall
> repair and it copied the files and rebooted - and came up to the same
> blank screen (with a bigger mouse arrow because now we're in VGA).
>
> Finally, finding nothing on the net about it, I did a fresh install of
> Vista, which proceeded normally (which rules out hardware problems).
>
> The whole episode acts like a virus except that I can't find anything
> about it on the virus information sites, besides which the computer
> was protected by antivirus firewall.
>
> Any information about this would be appreciated.

Although I don't have any specific information on the names of malware
that cause what you observed, I would imagine it is directly a result of
malware, especially since your "customer reported that he was browsing
the internet when his computer locked up."

Did you image or clone the drive before you started experimenting with
the XP repair install?

Was the Vista experiment on the customer's hard drive or one of yours
that you temporarily swapped?

If you still have the original drive with the borked XP installation,
why not scan it for malware (either by using an emergency boot CD like
Knoppix, Ubuntu, Bart's PE, or UBCD4Win ... or by removing it and
placing it in another PC as a slave or inside a USB enclosure)? That
really should have been the first thing you tried! Repair installs
should never be done in this type of situation, by the way. They should
only be done to address a specific OS issue that can't be addressed any
other way. But attempting a Repair Install on a compromised system is
just a recipe for disaster, IMO.

In the future, if you want to rule out hardware issues, simply boot off
a live Linux CD (like Knoppix or Ubuntu).

For dealing with malware issues, I think this page is a great resource:

http://www.elephantboycomputers.com/...moving_Malware

I JUST had this EXACT thing happen to me! Exactly. Person was broseing the web (our secretary), it locked up. I shut it down by holding the power button, and it comes back, with the default background blue, and a large mouse cursor, but no log in screen.

The mouse moves, and if you press print screen on the keyboard the mouse blinks, but that is it.

I scanned the harddrive with 3 virus and maleware scanners and it has found nothing.

I posted on expert exchange, if I figure out the problem, I will let you know.

They think it has to do with "gina" and the login screen.

Good luck, let me know if you figure it out too!

Also I did an XP repair install, and it did nothing. :(

Hi,

I have had this same problem. Has anyone found a solution to this as yet? I have an XP laptop with service pack 3 installed on to it. The screen loads the blue background and the mouse pointer works thats all. In safe mode its a black background and mouse pointer with safe mode in the corners and no logon screen.

I have tried a reinstall of XP with no luck. A copy of the sam security system files from the restore folders with no joy. A scan of the hard drive for viruses spyware or trojans and nothing found. Also can see the hard drive fine and all of the files and folders are intact using a live boot CD. Seems my only option is too wipe and reinstall after removing all the files but this won't answer why it happend?

Any help or advise would be much appreciated?

Yup, another one has bitten the dust! ^^

Same problem here, came home today and 1 machine displayed the exact same
symptons. OS is WinXP Professional SP3. After booting it displays the HP
wallpaper and mouse cursor. Same with safe mode (minus the wallpaper) and
safe mode with Prompt.

Someone mentioned the gina.dll....this makes sense. Most programs which
implement their own login (Novell Netware, Hard Disk Encryption) will replace
the gina.dll with their own versions in order to load their own login screens.
This is worth looking into...

Best of luck to all of you

zarniwoop

I got mine fixed, but it may not work for all. It had a virus, the uses got it from browsing the web. There was a trojan virus (something.h), I booted the computer up in a linux boot disk, mounted the drive, deleted the two files that were found in the virus scan, and it booted up just fine. You can just delete everything in the temp folder if you want if you cant fun a linux virus check. It didnt find it with the first scan, but then I mounted the drive onto the network with samba, and scanned it with our servers antivirus software.

PS. my user got it using firefox browser.

undisclosed wrote:
> There was a trojan virus (something.h),
>booted the computer up in a linux boot disk, mounted the drive, delete
>the two files that were found in the virus scan, and it booted up jus
>fine.

Do you by any chance remember which two files were infected? I also ran
multiple virus scans, from Knoppix Boot Disk to scans from network....nothing.
I tried replacing the shgina.dll, msgina.dll, userinit.exe, logon.exe,
kernel32.dll....nothing.

thanks in advance
zarniwoop

--
Message posted via WindowsKB.com
http://www.windowskb.com/Uwe/Forums....owsxp/200910/1

I had the same thing happen to me on Wednesday morning. A friend called with this exact problem. I tried repairs from the Windows XP media and it didn't help at all.

What tools did you use to boot from and scan the hard drive? Was it "Ultimate Boot CD for Windows" or something else?

Thanks for any assistance.

I used Knoppicillin, a variation of the Knoppix distribution with ClamAV for
virus scanning.

The only reaction I got from the computer was when I copied the registry
backups from \Windows\repair to Windows\system32\config (of course WITH
backing up the current registry).

The desktop showed, but since this backup is from the first installation of
WinXP, none of the programs or additional hardware was existent. Also, the
mouse and keyboard wouldn't work.

One more thing...my initial scan reported that my pagefile.sys was infected
with a virus. Since it will be created new on Windows startup if deleted, I
deleted it and hoped for the best but...nothing.

zarniwoop

--
Message posted via WindowsKB.com
http://www.windowskb.com/Uwe/Forums....owsxp/200910/1

Yo guys...don't know if anybody is still following this thread but I think I
made some progress.

After checking with yet another scanner, I ran across the infected file C:\
Windows\cfe.bak.

I deleted it and now Windows seems to continue the repair installation I
tried on the first day.

Could you guys check if this file exists on your machines?

Best of luck

zarniwoop

--
Message posted via WindowsKB.com
http://www.windowskb.com/Uwe/Forums....owsxp/200910/1

zarniwoop via WindowsKB.com wrote:
> Yo guys...don't know if anybody is still following this thread but I think I
> made some progress.
>
> After checking with yet another scanner, I ran across the infected file C:\
> Windows\cfe.bak.
>
> I deleted it and now Windows seems to continue the repair installation I
> tried on the first day.
>
> Could you guys check if this file exists on your machines?
>
> Best of luck
>
> zarniwoop

Mine doesn't have that file. And since it's probably a backup, with
that extension, it's surely not needed for the system to function.

--
Joe =o)

I pulled out the hard drive from the problem PC and hooked it up to another PC via a usb port. I ran a scan on the entire hard drive and found two different files infected by two different trojans. I don't remember the file names but the trojans were:

Generic Del.x!a
Lindo

Neither infected file appeared to be a remotely important or system file. I haven't found that much information about these two trojans but they did make it past Symantec Antivirus Corporate Edition with up-to-date virus definitions so I am a bit concerned about that. I guess I'll be scanning some other hard drives over the weekend too.

McAfee quarantined both files so I am going to attempt to boot the computer again over the weekend.

Thanks for the tip on the disk and tools you used to scan your computer. If I make any progress over the weekend I'll update this site again.

undisclosed wrote:
> I pulled out the hard drive from the problem PC and hooked it up to
> another PC via a usb port. I ran a scan on the entire hard drive and
> found two different files infected by two different trojans. I don't
> remember the file names but the trojans were:
>
> Generic Del.x!a
> Lindo
>
> Neither infected file appeared to be a remotely important or system
> file. I haven't found that much information about these two trojans but
> they did make it past Symantec Antivirus Corporate Edition with
> up-to-date virus definitions so I am a bit concerned about that. I
> guess I'll be scanning some other hard drives over the weekend too.
>
> McAfee quarantined both files so I am going to attempt to boot the
> computer again over the weekend.
>
> Thanks for the tip on the disk and tools you used to scan your
> computer. If I make any progress over the weekend I'll update this site
> again.

Rather than move hard drives around, it'd surely be less effort to
create a BitDefender CD and run it on any suspect system. The "Knoppix
Live" CD updates its malware definitions and does a scan.. you check
back later and manage anything it finds.

Burn BitDefender, or another program listed at the link below, to a CD
(using a working machine) and test the infected machine with it.
BitDefender also has a Rootkit checker on the Linux Desktop; run it if
you think that's the problem:

http://www.techmixer.com/free-bootab...download-list/

Download the executable rather than the .iso image, if one is
available.. it prompts you to insert a CD and burns the file, no problem.

--
Joe =o)

Joe,

I will look at the links you posted but I always carry my usb adapters with me and it is quite easy to yank a hard drive. Plus, I have already done it.

Now, when I put the hard drive back in the PC and try and boot I may need a Knoppix CD if it doesn't come up.

BTW, have you ever heard of "Generic Del.x!a" or "Lindo?" I have not turned up anything definitive on either one a this point.

Thanks again.

undisclosed wrote:
> Joe,
>
> I will look at the links you posted but I always carry my usb adapters
> with me and it is quite easy to yank a hard drive. Plus, I have already
> done it.
>
> Now, when I put the hard drive back in the PC and try and boot I may
> need a Knoppix CD if it doesn't come up.
>
> BTW, have you ever heard of "Generic Del.x!a" or "Lindo?" I have not
> turned up anything definitive on either one a this point.
>
> Thanks again.
>
> Elmo;1691804 Wrote:
>> undisclosed wrote:
>>
>> Rather than move hard drives around, it'd surely be less effort to
>> create a BitDefender CD and run it on any suspect system. The "Knoppix
>> Live" CD updates its malware definitions and does a scan.. you check
>> back later and manage anything it finds.
>>
>> Burn BitDefender, or another program listed at the link below, to a CD
>> (using a working machine) and test the infected machine with it.
>> BitDefender also has a Rootkit checker on the Linux Desktop; run it if
>> you think that's the problem:
>>
>> 'FREE Bootable AntiVirus Rescue CDs Download List'
>> (http://tinyurl.com/cvzmv8)
>>
>> Download the executable rather than the .iso image, if one is
>> available.. it prompts you to insert a CD and burns the file, no
>> problem.

No, but here's a Google search on each name:

http://www.google.com/#hl=en&source=...c9ea851cee2c5b

http://www.google.com/#hl=en&q=lindo...c9ea851cee2c5b

--
Joe =o)