1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

I want my Welcome Screen back!

Discussion in 'Windows XP' started by trant, Mar 4, 2010.

  1. trant

    trant Flightless Bird

    I am using Windows XP Pro SP 3

    I've had it setup for 4 users for the family members of my home and we use
    Fast Switching with the Welcome Screen (which conveniently allows you to see
    all 4 users, click on them to unveil a password field and then you can log in)

    Then two days ago I noticed some rogue "anti virus" software on there and
    quickly found instructions to remove it which including installing and using
    Malwarebytes Anti-Malware software.

    It scanned my PC, found dozens of problems, and I had it fix them.

    Then when I reboot my PC suddenly no longer has the Welcome Screen. It has
    some ugly NT style Logon screen where it is just a login prompt where you
    enter username manually.

    But worse than that is fast switching seems to be deactivated as well. When
    I press Start -> Log Off It asks me am I sure I want to log off and that my
    programs will be closed. Why? Where is my fast switching that allows users to
    stay logged on with programs open?

    Now I did try and resolve this problem myself. I searched the web and I
    found some instructions on how you can switch between the Welcome Screen and
    the Logon Screen.

    I went to Start -> Control Panel -> User Accounts
    I found two check boxes one for use Welcome Screen the other for using Fast
    Switching. They were both checked OFF - as in disabled. I thought BINGO here
    is where I fix my problem.

    But No no no, said my computer. You didn't think it would be that easy it
    taunted - as I rebooted only to find that Logon screen still active and no
    fast switching features. I went back into User Accounts to verify I had
    checked those boxes on and sure enough they were ON.

    So something else seems to be overriding this, perhaps I need to make a
    registry change.

    Please help! I really dont want to format and reinstall Windows again - its
    running so nicely despite this...
     
  2. Peter Foldes

    Peter Foldes Flightless Bird

    I think you will have no choice but to format and re-install. You are still infected
    and from what you described in your post about (found dozens) you have no other
    avenue

    --
    Peter

    Please Reply to Newsgroup for the benefit of others
    Requests for assistance by email can not and will not be acknowledged.

    "trant" <trant@discussions.microsoft.com> wrote in message
    news:D171797A-DCFC-4150-90BD-7240263A5187@microsoft.com...
    >I am using Windows XP Pro SP 3
    >
    > I've had it setup for 4 users for the family members of my home and we use
    > Fast Switching with the Welcome Screen (which conveniently allows you to see
    > all 4 users, click on them to unveil a password field and then you can log in)
    >
    > Then two days ago I noticed some rogue "anti virus" software on there and
    > quickly found instructions to remove it which including installing and using
    > Malwarebytes Anti-Malware software.
    >
    > It scanned my PC, found dozens of problems, and I had it fix them.
    >
    > Then when I reboot my PC suddenly no longer has the Welcome Screen. It has
    > some ugly NT style Logon screen where it is just a login prompt where you
    > enter username manually.
    >
    > But worse than that is fast switching seems to be deactivated as well. When
    > I press Start -> Log Off It asks me am I sure I want to log off and that my
    > programs will be closed. Why? Where is my fast switching that allows users to
    > stay logged on with programs open?
    >
    > Now I did try and resolve this problem myself. I searched the web and I
    > found some instructions on how you can switch between the Welcome Screen and
    > the Logon Screen.
    >
    > I went to Start -> Control Panel -> User Accounts
    > I found two check boxes one for use Welcome Screen the other for using Fast
    > Switching. They were both checked OFF - as in disabled. I thought BINGO here
    > is where I fix my problem.
    >
    > But No no no, said my computer. You didn't think it would be that easy it
    > taunted - as I rebooted only to find that Logon screen still active and no
    > fast switching features. I went back into User Accounts to verify I had
    > checked those boxes on and sure enough they were ON.
    >
    > So something else seems to be overriding this, perhaps I need to make a
    > registry change.
    >
    > Please help! I really dont want to format and reinstall Windows again - its
    > running so nicely despite this...
     
  3. NA

    NA Flightless Bird

  4. PA Bear [MS MVP]

    PA Bear [MS MVP] Flightless Bird

    > ...two days ago I noticed some rogue "anti virus" software on there and
    > quickly found instructions to remove it which including installing and
    > using
    > Malwarebytes Anti-Malware software.


    I suspect you've got much more work to do!

    NB: If you had no anti-virus application installed or the subscription had
    expired *when the machine first got infected* and/or your subscription has
    since expired and/or the machine's not been kept fully-patched at Windows
    Update, don't waste your time with any of the below: Format & reinstall
    Windows. A Repair Install will NOT help!

    Microsoft PCSafety provides home users (only) with no-charge support in
    dealing with malware infections such as viruses, spyware (including unwanted
    software), and adware.
    https://support.microsoft.com/oas/default.aspx?&prid=7552&st=1

    Also available via the Consumer Security Support home page:
    https://consumersecuritysupport.microsoft.com/

    Otherwise...

    1. See if you can download/run the MSRT manually:
    http://www.microsoft.com/security/malwareremove/default.mspx

    NB: Run the FULL scan, not the QUICK scan! You may need to download the
    MSRT on a non-infected machine, then transfer MRT.EXE to the infected
    machine and rename it to SCAN.EXE before running it.

    2a. WinXP => Run the Windows Live Safety Center's 'Protection' scan (only!)
    in Safe Mode with Networking, if need be:
    http://onecare.live.com/site/en-us/center/howsafe.htm

    2b. Vista or Win7=> Run this scan instead:
    http://onecare.live.com/site/en-us/center/whatsnew.htm

    3. Now run a thorough check for hijackware, including posting requested logs
    in an appropriate forum, not here. DO NOT SKIP THIS STEP!!

    Checking for/Help with Hijackware:
    • http://mvps.org/winhelp2002/unwanted.htm
    • http://inetexplorer.mvps.org/tshoot.html
    • http://www.mvps.org/sramesh2k/Malware_Defence.htm
    • http://www.elephantboycomputers.com/page2.html#Removing_Malware

    **Chances are you will need to seek expert assistance in
    http://spywarehammer.com/simplemachinesforum/index.php?board=10.0,
    http://www.spywarewarrior.com/viewforum.php?f=5,
    http://www.dslreports.com/forum/cleanup,
    http://www.bluetack.co.uk/forums/index.php,
    http://aumha.net/viewforum.php?f=30 or other appropriate forums.**

    If these procedures look too complex - and there is no shame in admitting
    this isn't your cup of tea - take the machine to a local, reputable and
    independent (i.e., not BigBoxStoreUSA or Geek Squad) computer repair shop.


    trant wrote:
    > I am using Windows XP Pro SP 3
    >
    > I've had it setup for 4 users for the family members of my home and we use
    > Fast Switching with the Welcome Screen (which conveniently allows you to
    > see
    > all 4 users, click on them to unveil a password field and then you can log
    > in)
    >
    > Then two days ago I noticed some rogue "anti virus" software on there and
    > quickly found instructions to remove it which including installing and
    > using
    > Malwarebytes Anti-Malware software.
    >
    > It scanned my PC, found dozens of problems, and I had it fix them.
    >
    > Then when I reboot my PC suddenly no longer has the Welcome Screen. It has
    > some ugly NT style Logon screen where it is just a login prompt where you
    > enter username manually.
    >
    > But worse than that is fast switching seems to be deactivated as well.
    > When
    > I press Start -> Log Off It asks me am I sure I want to log off and that
    > my
    > programs will be closed. Why? Where is my fast switching that allows users
    > to stay logged on with programs open?
    >
    > Now I did try and resolve this problem myself. I searched the web and I
    > found some instructions on how you can switch between the Welcome Screen
    > and
    > the Logon Screen.
    >
    > I went to Start -> Control Panel -> User Accounts
    > I found two check boxes one for use Welcome Screen the other for using
    > Fast
    > Switching. They were both checked OFF - as in disabled. I thought BINGO
    > here
    > is where I fix my problem.
    >
    > But No no no, said my computer. You didn't think it would be that easy it
    > taunted - as I rebooted only to find that Logon screen still active and no
    > fast switching features. I went back into User Accounts to verify I had
    > checked those boxes on and sure enough they were ON.
    >
    > So something else seems to be overriding this, perhaps I need to make a
    > registry change.
    >
    > Please help! I really dont want to format and reinstall Windows again -
    > its
    > running so nicely despite this...
     
  5. Jose

    Jose Flightless Bird

    On Mar 4, 10:01 am, trant <tr...@discussions.microsoft.com> wrote:
    > I am using Windows XP Pro SP 3
    >
    > I've had it setup for 4 users for the family members of my home and we use
    > Fast Switching with the Welcome Screen (which conveniently allows you to see
    > all 4 users, click on them to unveil a password field and then you can log in)
    >
    > Then two days ago I noticed some rogue "anti virus" software on there and
    > quickly found instructions to remove it which including installing and using
    > Malwarebytes Anti-Malware software.
    >
    > It scanned my PC, found dozens of problems, and I had it fix them.
    >
    > Then when I reboot my PC suddenly no longer has the Welcome Screen. It has
    > some ugly NT style Logon screen where it is just a login prompt where you
    > enter username manually.
    >
    > But worse than that is fast switching seems to be deactivated as well. When
    > I press Start -> Log Off It asks me am I sure I want to log off and that my
    > programs will be closed. Why? Where is my fast switching that allows users to
    > stay logged on with programs open?
    >
    > Now I did try and resolve this problem myself. I searched the web and I
    > found some instructions on how you can switch between the Welcome Screen and
    > the Logon Screen.
    >
    > I went to Start -> Control Panel -> User Accounts
    > I found two check boxes one for use Welcome Screen the other for using Fast
    > Switching. They were both checked OFF - as in disabled. I thought BINGO here
    > is where I fix my problem.
    >
    > But No no no, said my computer. You didn't think it would be that easy it
    > taunted - as I rebooted only to find that Logon screen still active and no
    > fast switching features. I went back into User Accounts to verify I had
    > checked those boxes on and sure enough they were ON.
    >
    > So something else seems to be overriding this, perhaps I need to make a
    > registry change.
    >
    > Please help! I really dont want to format and reinstall Windows again - its
    > running so nicely despite this...


    You should run MBAM and SAS:

    Download, install, update and do a full scan with these free malware
    detection programs:

    Malwarebytes (MBAM): http://malwarebytes.org/
    SUPERAntiSpyware: (SAS): http://www.superantispyware.com/

    They can be uninstalled later if desired.

    I know you already ran MBAM, but that is my standard copy/paste to get
    started.

    Can you recall if anything else been changed since the problem? New
    network software? New "other" scanning software?

    When MBAM and SAS run clean, they will do a good job of cleaning
    things up but sometimes they can't tell changes made to the system are
    "on purpose" by you or from the malware, so they will not change them
    back to what you think is normal. That means you have to find the
    changes and fix them by hand.

    The msgina.dll controls part of this logon process and it can
    sometimes get replaced or mis configured screwing up your logon
    process. Let's see what you have for gina dlls on your system boot
    drive

    Clcik Start, Run and in the box enter:

    cmd

    Click OK to open a command window.

    In the Command Window enter:

    cd \
    dir *gina*.dll /s > gina.txt

    That will put you in the root directory of your boot drive (usually
    C), search your drive and all subfolders for any dll file that has
    gina in the name and redirect the results to a file called gina.txt.

    Open gina.txt with a text editor (notepad, wordpad), select all, copy
    all the contents of the file and paste it back here. Your results may
    not look like exactly like mine - mine looks like this:

    Directory of C:/WINDOWS\system32

    04/14/2008 04:42 AM 997,376 msgina.dll
    04/14/2008 04:42 AM 68,096 shgina.dll
    2 File(s) 1,065,472 bytes

    Directory of C:/WINDOWS\system32\dllcache

    04/14/2008 04:42 AM 997,376 msgina.dll
    04/14/2008 04:42 AM 68,096 shgina.dll
    2 File(s) 1,065,472 bytes
     
  6. trant

    trant Flightless Bird

    Thanks for all the replies!!!


    "Jose" wrote:

    > Open gina.txt with a text editor (notepad, wordpad), select all, copy
    > all the contents of the file and paste it back here. Your results may
    > not look like exactly like mine - mine looks like this:
    >


    Here's my results:

    Directory of C:/WINDOWS\system32

    11/30/2007 06:25 PM 997,376 msgina.dll
    11/30/2007 06:25 PM 68,096 shgina.dll
    2 File(s) 1,065,472 bytes

    Directory of C:/WINDOWS\system32\dllcache

    11/30/2007 06:25 PM 997,376 msgina.dll
    11/30/2007 06:25 PM 68,096 shgina.dll
    2 File(s) 1,065,472 bytes

    I am running that SAS scan now



    NA wrote:
    > http://www.theeldergeek.com/welcome_screen_logon_versus_classic_logon.htm
    >
    > http://win-regedit.eitwebguru.com/2009/03/allow-fast-user-switching.html


    Ok, checked those registry values and they check out correct - both are set
    to 1. Yet still no Welcome screen. I actually got Fast Switching icon now but
    if I click it takes me to a Logon window and I need to logon twice (after
    logging on first time it thinks for a moment and comes back with a second
    prompt). Man this is bad...
     
  7. Jose

    Jose Flightless Bird

    On Mar 5, 5:56 pm, trant <tr...@discussions.microsoft.com> wrote:
    > Thanks for all the replies!!!
    >
    > "Jose" wrote:
    > > Open gina.txt with a text editor (notepad, wordpad), select all, copy
    > > all the contents of the file and paste it back here.  Your results may
    > > not look like exactly like mine - mine looks like this:

    >
    > Here's my results:
    >
    >  Directory of C:/WINDOWS\system32
    >
    > 11/30/2007  06:25 PM           997,376 msgina.dll
    > 11/30/2007  06:25 PM            68,096 shgina.dll
    >                2 File(s)      1,065,472 bytes
    >
    >  Directory of C:/WINDOWS\system32\dllcache
    >
    > 11/30/2007  06:25 PM           997,376 msgina.dll
    > 11/30/2007  06:25 PM            68,096 shgina.dll
    >                2 File(s)      1,065,472 bytes
    >
    > I am running that SAS scan now
    >
    > NA wrote:
    > >http://www.theeldergeek.com/welcome_screen_logon_versus_classic_logon...

    >
    > >http://win-regedit.eitwebguru.com/2009/03/allow-fast-user-switching.html

    >
    > Ok, checked those registry values and they check out correct - both are set
    > to 1. Yet still no Welcome screen. I actually got Fast Switching icon nowbut
    > if I click it takes me to a Logon window and I need to logon twice (after
    > logging on first time it thinks for a moment and comes back with a second
    > prompt). Man this is bad...


    Okay, that look familiar - let's see if SAS turns up anything...
     
  8. trant

    trant Flightless Bird

    "Jose" wrote:
    > Okay, that look familiar - let's see if SAS turns up anything...
    > .
    >


    Okay so I put SAS to do a complete scan and I went away - now I come back
    and looks like my brother logged into the PC and didn't realize that now when
    he logs in it logs me out so I lost the user interface for SAS.

    Then I thought I might get lucky and the program would have logged it's scan
    to file. I checked its folder in Program Files found nothing but then
    realized it is probably in my User Application Data area and I did find a
    log. Looks like it had 49 file threats detected - 46 of which are tracking
    cookies but 3 of them are this:

    Trojan.Agent/Gen-Nullo[Short]
    C:/SYSTEM VOLUME
    INFORMATION\_RESTORE{599884DF-EB4F-4AD4-A27F-CD4EB896256C}\RP431\A0013151.EXE
    C:/SYSTEM VOLUME
    INFORMATION\_RESTORE{599884DF-EB4F-4AD4-A27F-CD4EB896256C}\RP431\A0013152.EXE
    C:/SYSTEM VOLUME
    INFORMATION\_RESTORE{599884DF-EB4F-4AD4-A27F-CD4EB896256C}\RP431\A0013153.EXE

    But despite it being a Trojan I dont think its the problem, given its
    location. But I dont know if the scan actually completed or if it
    automatically fixed these so I am running another full scan now.


    Here are some details on my whacky log off process now...

    I click Start -> Log Off and see an option to Fast Switch. I click it.

    Instead of going to a Welcome Screen like I had before I get taken to a
    Logon prompt whose user name is pre-filled with the username of the user that
    was just logged in. So I change it to my username and then plug in my
    password and hit OK.

    I immediately get a prompt: "This will log off the current user. Any unsaved
    work will be lost". Guess that's so much for fast switching...

    I do it anyway and then I hear a few windows chimes and then the Logon
    prompt comes up again, and it is again pre-filled username with the user who
    was just logged in.

    So I replace my username again and type in password and this time I log in
    to my blank desktop as if a fresh reboot (all previously opened apps gone).
     
  9. trant

    trant Flightless Bird

    Ok so I finished the scan again, and left all items checked and hit next and
    it removed everything. But still messed up logon screen.

    Also tried something from this site
    http://www.kellys-korner-xp.com/xp_tweaks.htm
    next to item number 45 "Restore the Welcome Screen" which is some
    ginadll.vbs file based on the post of another person. Didn't help either.

    And all this time I still have in my User control panel Use Welcome Screen
    and Fast Switching checked ON.
     
  10. Jose

    Jose Flightless Bird

    On Mar 5, 10:37 pm, trant <tr...@discussions.microsoft.com> wrote:
    > Ok so I finished the scan again, and left all items checked and hit next and
    > it removed everything. But still messed up logon screen.
    >
    > Also tried something from this sitehttp://www.kellys-korner-xp.com/xp_tweaks.htm
    > next to item number 45 "Restore the Welcome Screen" which is some
    > ginadll.vbs file based on the post of another person. Didn't help either.
    >
    > And all this time I still have in my User control panel Use Welcome Screen
    > and Fast Switching checked ON.


    OK - I still think there is a gina.dll problem and the scanning
    software may not be able to distinguish it, so let's check in the
    registry.

    Before making any changes to your registry, back it up with this
    popular free tool:

    http://www.larshederer.homepage.t-online.de/erunt/

    Click Start, Run and in the box enter:

    regedit

    Click OK to open the registry editor and navigate to here:

    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion
    \WinLogon

    There should be no GinaDLL entry in WinLogon.

    In the right pane if there is a key called GinaDLL, right-click
    GinaDLL, and then click Delete. If you have the GinaDLL key, what
    is the contents?

    Respond in the affirmative when you are prompted to confirm the
    deletion.

    Click File, Exit to quit Registry Editor.

    Reboot and test.
     

Share This Page