Windows XP = Blank Welcome Screen with only Cursor

[Hack&Lube]

Yesterday I upgraded to Windows XP SP3 and changed the way users login to the computer and took off the welcome screen expecting the Ctrl-Alt-Del method of bringing up the login menu would work. I rebooted and Windows now boots only to a blank screen with a working cursor and nothing else. There is no administrator account, only my name but I have not set a password at all for myself either.

Ctrl-Alt-Del doesn't work, Alt-F4 doesn't work, I can't do anything at all. I've tried two different keyboards as well.

This is the same for regular windows, safe mode, safe mode with command prompt, vga mode, last known configuration, etc. There is no way to get any sort of access to anything I can actually use. It's just a blank screen with a cursor with no users, no login interface, keyboard commands do nothing, etc.

I am not going to do a windows repair from the CD (it's not going to work from experience) but I am willing to try recovery console for a chkdsk, fixmbr, or a bootcfg, but I doubt that will solve my issue.

I've gone into my dual boot that does work and replaced the lsass.exe from system32 because I recalled Malwarebytes detecting a trojan form of lsass.exe and I thought that perhaps it had deleted the genuine article but that wasn't the case and I still only get the blank, blue empty screen with only a cursor and nothing else.

I'm not going to format, I'm adamant about recovering this install of windows because there are literally thousands of programs and settings and tweaks and personal settings that are on this install and I've managed to save it many times before, even through moving it through various different computers. I cannot do a repair from CD because the only disc I have is a pre-SP1 disc and I've tried a repair once before and it doesn't work. Worse comes to worse I can do a raw drive image copy of a backup of this partition from a few months ago but I was wondering if anybody had any other ideas?

[Bobblehead]

It just sounds to me like the changes you did have buggered it.

Can you boot to the CLI?

And why not try the windows repair? Just because it hasn't worked before doesn't mean it won't work this time.

[Hack&Lube]

Originally Posted by Bobblehead

It just sounds to me like the changes you did have buggered it.

Can you boot to the CLI?

And why not try the windows repair? Just because it hasn't worked before doesn't mean it won't work this time.

No, safe mode with command prompt doesn't work, I still get the screen with cursor. I can probably get a CLI with recovery console.

I'm pretty certain a windows repair won't work. I get the message that a repair attempt has already been attepted on this installation. Also, all the working discs I have are enterprise or streamlined installs and don't offer a repair option in the first place.

[sclitheroe]

The welcome screen is driven by msgina.dll, not lsass.exe. It's also possible that the registry entry that specifies which gina interface the machine is using is set incorrectly. You should be able to determine what gina the system is using from an offline registry editor (boot CD), and googling for the correct reg entry to inspect.

Also consider uninstalling SP3 using method 4 here:
http://support.microsoft.com/kb/950249

In the hopes that it will put things back to a sane state....

[Hack&Lube]

Originally Posted by sclitheroe

The welcome screen is driven by msgina.dll, not lsass.exe. It's also possible that the registry entry that specifies which gina interface the machine is using is set incorrectly. You should be able to determine what gina the system is using from an offline registry editor (boot CD), and googling for the correct reg entry to inspect.

Also consider uninstalling SP3 using method 4 here:
http://support.microsoft.com/kb/950249

In the hopes that it will put things back to a sane state....

Thanks, I'll check out msgina.dll

I wasn't aware I was able to do offline registry editing, I will have to look into that. Probably need another boot disc made first though as I assume it's not part of recovery console?

[sclitheroe]

Originally Posted by Hack&Lube

Thanks, I'll check out msgina.dll

I wasn't aware I was able to do offline registry editing, I will have to look into that. Probably need another boot disc made first though as I assume it's not part of recovery console?

NTPasswd is a boot disk that will allow for offline password and registry edits.

[Hack&Lube]

Originally Posted by sclitheroe

NTPasswd is a boot disk that will allow for offline password and registry edits.

Hmm, I think I've used that before to recover an account password. I didn't know it had a registry editor. I will go make a bootable USB now. I still have to figure out what registry key affects the welcome screen or login method as well.

[Hack&Lube]

One big problem right now which is one of the reasons I don't want to wipe the partition and replace it is because I have some very important e-mails I need to recover from the Outlook inbox but unfortunately I cannot access that inbox at all because access is denied to me to my own documents and settings folder when I am using windows on another installation to play with my files due to ownership. I'll see what I can do to take control of it by playing with the ownership permissions.

[Hack&Lube]

Originally Posted by sclitheroe

NTPasswd is a boot disk that will allow for offline password and registry edits.

Unfortunately it seems that can't help me as it's registry editor is limited to the SAM and Security hives of the registry and I can't figure out how to get to HKEY_LOCAL_MACHINE\Software\Microsoft\WindowsNT\Cu rrentVersion\Winlogin which is where the problem may lay.

Arrgh, I'll just brutalize it and access that drive's System Volume Information folder directly from my dual boot and just copy over the registry from the hidden system restore folders.

[Hack&Lube]

SOLVED! Everything fixed. After googling for two days, I think that I'm the first one to post a solution for this issue on the entire internet. Turns out it's just another registry corruption.

Seeing as I didn't have a working CD with recovery console (many enterprise/streamline installs don't have that option) and I don't even have an optical drive, I just brute forced a manual replacement of the registry files through Windows Explorer

1. Boot from another OS on another drive or partition.
2. Turn off simple file sharing, show system and hidden folders.
3. Take full ownership of the System Volume Information folder of the drive that needs to be fixed (ensure that replace owner on subcontainers and objects is checked).*
3. Goto the proper GUID folder (since you are on another WinXP install, it will start making restores for that installation as well on this harddrive, make sure you find the right one). Open the restore folder and enter the snapshot folder and pick one of the RP folders with the desired restore date.
4. Copy the registry_machine_(DEFAULT/SAM/SECURITY/SOFTWARE/SYSTEM) files somewhere else and rename, removing "registry_machine" from each.
5. Move the files into the correct system32/config folder and write over all the existing DEFAULT/SAM/SECURITY/SOFTWARE/SYSTEM registry files.
6. Reboot and boot into the actual OS and it should be as if a system restore had occurred except that no files other than the registry hives have been restored.
7. Retake ownership (or grant them to your system) of the System Volume Information folder and any other folders you had previously taken ownership of while in the secondary OS.
8. Do an actual full system restore just in case.

* If you don't have any system restore backups available there should still be backups of each registry hive inside the system32/config folder as a last case scenario