• Welcome to Tux Reports: Where Penguins Fly. We hope you find the topics varied, interesting, and worthy of your time. Please become a member and join in the discussions.

I want my Welcome Screen back!

T

trant

Flightless Bird
I am using Windows XP Pro SP 3

I've had it setup for 4 users for the family members of my home and we use
Fast Switching with the Welcome Screen (which conveniently allows you to see
all 4 users, click on them to unveil a password field and then you can log in)

Then two days ago I noticed some rogue "anti virus" software on there and
quickly found instructions to remove it which including installing and using
Malwarebytes Anti-Malware software.

It scanned my PC, found dozens of problems, and I had it fix them.

Then when I reboot my PC suddenly no longer has the Welcome Screen. It has
some ugly NT style Logon screen where it is just a login prompt where you
enter username manually.

But worse than that is fast switching seems to be deactivated as well. When
I press Start -> Log Off It asks me am I sure I want to log off and that my
programs will be closed. Why? Where is my fast switching that allows users to
stay logged on with programs open?

Now I did try and resolve this problem myself. I searched the web and I
found some instructions on how you can switch between the Welcome Screen and
the Logon Screen.

I went to Start -> Control Panel -> User Accounts
I found two check boxes one for use Welcome Screen the other for using Fast
Switching. They were both checked OFF - as in disabled. I thought BINGO here
is where I fix my problem.

But No no no, said my computer. You didn't think it would be that easy it
taunted - as I rebooted only to find that Logon screen still active and no
fast switching features. I went back into User Accounts to verify I had
checked those boxes on and sure enough they were ON.

So something else seems to be overriding this, perhaps I need to make a
registry change.

Please help! I really dont want to format and reinstall Windows again - its
running so nicely despite this...
 
P

Peter Foldes

Flightless Bird
I think you will have no choice but to format and re-install. You are still infected
and from what you described in your post about (found dozens) you have no other
avenue

--
Peter

Please Reply to Newsgroup for the benefit of others
Requests for assistance by email can not and will not be acknowledged.

"trant" <trant@discussions.microsoft.com> wrote in message
news:D171797A-DCFC-4150-90BD-7240263A5187@microsoft.com...
>I am using Windows XP Pro SP 3
>
> I've had it setup for 4 users for the family members of my home and we use
> Fast Switching with the Welcome Screen (which conveniently allows you to see
> all 4 users, click on them to unveil a password field and then you can log in)
>
> Then two days ago I noticed some rogue "anti virus" software on there and
> quickly found instructions to remove it which including installing and using
> Malwarebytes Anti-Malware software.
>
> It scanned my PC, found dozens of problems, and I had it fix them.
>
> Then when I reboot my PC suddenly no longer has the Welcome Screen. It has
> some ugly NT style Logon screen where it is just a login prompt where you
> enter username manually.
>
> But worse than that is fast switching seems to be deactivated as well. When
> I press Start -> Log Off It asks me am I sure I want to log off and that my
> programs will be closed. Why? Where is my fast switching that allows users to
> stay logged on with programs open?
>
> Now I did try and resolve this problem myself. I searched the web and I
> found some instructions on how you can switch between the Welcome Screen and
> the Logon Screen.
>
> I went to Start -> Control Panel -> User Accounts
> I found two check boxes one for use Welcome Screen the other for using Fast
> Switching. They were both checked OFF - as in disabled. I thought BINGO here
> is where I fix my problem.
>
> But No no no, said my computer. You didn't think it would be that easy it
> taunted - as I rebooted only to find that Logon screen still active and no
> fast switching features. I went back into User Accounts to verify I had
> checked those boxes on and sure enough they were ON.
>
> So something else seems to be overriding this, perhaps I need to make a
> registry change.
>
> Please help! I really dont want to format and reinstall Windows again - its
> running so nicely despite this...
 
P

PA Bear [MS MVP]

Flightless Bird
> ...two days ago I noticed some rogue "anti virus" software on there and
> quickly found instructions to remove it which including installing and
> using
> Malwarebytes Anti-Malware software.


I suspect you've got much more work to do!

NB: If you had no anti-virus application installed or the subscription had
expired *when the machine first got infected* and/or your subscription has
since expired and/or the machine's not been kept fully-patched at Windows
Update, don't waste your time with any of the below: Format & reinstall
Windows. A Repair Install will NOT help!

Microsoft PCSafety provides home users (only) with no-charge support in
dealing with malware infections such as viruses, spyware (including unwanted
software), and adware.
https://support.microsoft.com/oas/default.aspx?&prid=7552&st=1

Also available via the Consumer Security Support home page:
https://consumersecuritysupport.microsoft.com/

Otherwise...

1. See if you can download/run the MSRT manually:
http://www.microsoft.com/security/malwareremove/default.mspx

NB: Run the FULL scan, not the QUICK scan! You may need to download the
MSRT on a non-infected machine, then transfer MRT.EXE to the infected
machine and rename it to SCAN.EXE before running it.

2a. WinXP => Run the Windows Live Safety Center's 'Protection' scan (only!)
in Safe Mode with Networking, if need be:
http://onecare.live.com/site/en-us/center/howsafe.htm

2b. Vista or Win7=> Run this scan instead:
http://onecare.live.com/site/en-us/center/whatsnew.htm

3. Now run a thorough check for hijackware, including posting requested logs
in an appropriate forum, not here. DO NOT SKIP THIS STEP!!

Checking for/Help with Hijackware:
• http://mvps.org/winhelp2002/unwanted.htm
• http://inetexplorer.mvps.org/tshoot.html
• http://www.mvps.org/sramesh2k/Malware_Defence.htm
• http://www.elephantboycomputers.com/page2.html#Removing_Malware

**Chances are you will need to seek expert assistance in
http://spywarehammer.com/simplemachinesforum/index.php?board=10.0,
http://www.spywarewarrior.com/viewforum.php?f=5,
http://www.dslreports.com/forum/cleanup,
http://www.bluetack.co.uk/forums/index.php,
http://aumha.net/viewforum.php?f=30 or other appropriate forums.**

If these procedures look too complex - and there is no shame in admitting
this isn't your cup of tea - take the machine to a local, reputable and
independent (i.e., not BigBoxStoreUSA or Geek Squad) computer repair shop.


trant wrote:
> I am using Windows XP Pro SP 3
>
> I've had it setup for 4 users for the family members of my home and we use
> Fast Switching with the Welcome Screen (which conveniently allows you to
> see
> all 4 users, click on them to unveil a password field and then you can log
> in)
>
> Then two days ago I noticed some rogue "anti virus" software on there and
> quickly found instructions to remove it which including installing and
> using
> Malwarebytes Anti-Malware software.
>
> It scanned my PC, found dozens of problems, and I had it fix them.
>
> Then when I reboot my PC suddenly no longer has the Welcome Screen. It has
> some ugly NT style Logon screen where it is just a login prompt where you
> enter username manually.
>
> But worse than that is fast switching seems to be deactivated as well.
> When
> I press Start -> Log Off It asks me am I sure I want to log off and that
> my
> programs will be closed. Why? Where is my fast switching that allows users
> to stay logged on with programs open?
>
> Now I did try and resolve this problem myself. I searched the web and I
> found some instructions on how you can switch between the Welcome Screen
> and
> the Logon Screen.
>
> I went to Start -> Control Panel -> User Accounts
> I found two check boxes one for use Welcome Screen the other for using
> Fast
> Switching. They were both checked OFF - as in disabled. I thought BINGO
> here
> is where I fix my problem.
>
> But No no no, said my computer. You didn't think it would be that easy it
> taunted - as I rebooted only to find that Logon screen still active and no
> fast switching features. I went back into User Accounts to verify I had
> checked those boxes on and sure enough they were ON.
>
> So something else seems to be overriding this, perhaps I need to make a
> registry change.
>
> Please help! I really dont want to format and reinstall Windows again -
> its
> running so nicely despite this...
 
J

Jose

Flightless Bird
On Mar 4, 10:01 am, trant <tr...@discussions.microsoft.com> wrote:
> I am using Windows XP Pro SP 3
>
> I've had it setup for 4 users for the family members of my home and we use
> Fast Switching with the Welcome Screen (which conveniently allows you to see
> all 4 users, click on them to unveil a password field and then you can log in)
>
> Then two days ago I noticed some rogue "anti virus" software on there and
> quickly found instructions to remove it which including installing and using
> Malwarebytes Anti-Malware software.
>
> It scanned my PC, found dozens of problems, and I had it fix them.
>
> Then when I reboot my PC suddenly no longer has the Welcome Screen. It has
> some ugly NT style Logon screen where it is just a login prompt where you
> enter username manually.
>
> But worse than that is fast switching seems to be deactivated as well. When
> I press Start -> Log Off It asks me am I sure I want to log off and that my
> programs will be closed. Why? Where is my fast switching that allows users to
> stay logged on with programs open?
>
> Now I did try and resolve this problem myself. I searched the web and I
> found some instructions on how you can switch between the Welcome Screen and
> the Logon Screen.
>
> I went to Start -> Control Panel -> User Accounts
> I found two check boxes one for use Welcome Screen the other for using Fast
> Switching. They were both checked OFF - as in disabled. I thought BINGO here
> is where I fix my problem.
>
> But No no no, said my computer. You didn't think it would be that easy it
> taunted - as I rebooted only to find that Logon screen still active and no
> fast switching features. I went back into User Accounts to verify I had
> checked those boxes on and sure enough they were ON.
>
> So something else seems to be overriding this, perhaps I need to make a
> registry change.
>
> Please help! I really dont want to format and reinstall Windows again - its
> running so nicely despite this...


You should run MBAM and SAS:

Download, install, update and do a full scan with these free malware
detection programs:

Malwarebytes (MBAM): http://malwarebytes.org/
SUPERAntiSpyware: (SAS): http://www.superantispyware.com/

They can be uninstalled later if desired.

I know you already ran MBAM, but that is my standard copy/paste to get
started.

Can you recall if anything else been changed since the problem? New
network software? New "other" scanning software?

When MBAM and SAS run clean, they will do a good job of cleaning
things up but sometimes they can't tell changes made to the system are
"on purpose" by you or from the malware, so they will not change them
back to what you think is normal. That means you have to find the
changes and fix them by hand.

The msgina.dll controls part of this logon process and it can
sometimes get replaced or mis configured screwing up your logon
process. Let's see what you have for gina dlls on your system boot
drive

Clcik Start, Run and in the box enter:

cmd

Click OK to open a command window.

In the Command Window enter:

cd \
dir *gina*.dll /s > gina.txt

That will put you in the root directory of your boot drive (usually
C), search your drive and all subfolders for any dll file that has
gina in the name and redirect the results to a file called gina.txt.

Open gina.txt with a text editor (notepad, wordpad), select all, copy
all the contents of the file and paste it back here. Your results may
not look like exactly like mine - mine looks like this:

Directory of C:/WINDOWS\system32

04/14/2008 04:42 AM 997,376 msgina.dll
04/14/2008 04:42 AM 68,096 shgina.dll
2 File(s) 1,065,472 bytes

Directory of C:/WINDOWS\system32\dllcache

04/14/2008 04:42 AM 997,376 msgina.dll
04/14/2008 04:42 AM 68,096 shgina.dll
2 File(s) 1,065,472 bytes
 
T

trant

Flightless Bird
Thanks for all the replies!!!


"Jose" wrote:

> Open gina.txt with a text editor (notepad, wordpad), select all, copy
> all the contents of the file and paste it back here. Your results may
> not look like exactly like mine - mine looks like this:
>


Here's my results:

Directory of C:/WINDOWS\system32

11/30/2007 06:25 PM 997,376 msgina.dll
11/30/2007 06:25 PM 68,096 shgina.dll
2 File(s) 1,065,472 bytes

Directory of C:/WINDOWS\system32\dllcache

11/30/2007 06:25 PM 997,376 msgina.dll
11/30/2007 06:25 PM 68,096 shgina.dll
2 File(s) 1,065,472 bytes

I am running that SAS scan now



NA wrote:
> http://www.theeldergeek.com/welcome_screen_logon_versus_classic_logon.htm
>
> http://win-regedit.eitwebguru.com/2009/03/allow-fast-user-switching.html


Ok, checked those registry values and they check out correct - both are set
to 1. Yet still no Welcome screen. I actually got Fast Switching icon now but
if I click it takes me to a Logon window and I need to logon twice (after
logging on first time it thinks for a moment and comes back with a second
prompt). Man this is bad...
 
J

Jose

Flightless Bird
On Mar 5, 5:56 pm, trant <tr...@discussions.microsoft.com> wrote:
> Thanks for all the replies!!!
>
> "Jose" wrote:
> > Open gina.txt with a text editor (notepad, wordpad), select all, copy
> > all the contents of the file and paste it back here.  Your results may
> > not look like exactly like mine - mine looks like this:

>
> Here's my results:
>
>  Directory of C:/WINDOWS\system32
>
> 11/30/2007  06:25 PM           997,376 msgina.dll
> 11/30/2007  06:25 PM            68,096 shgina.dll
>                2 File(s)      1,065,472 bytes
>
>  Directory of C:/WINDOWS\system32\dllcache
>
> 11/30/2007  06:25 PM           997,376 msgina.dll
> 11/30/2007  06:25 PM            68,096 shgina.dll
>                2 File(s)      1,065,472 bytes
>
> I am running that SAS scan now
>
> NA wrote:
> >http://www.theeldergeek.com/welcome_screen_logon_versus_classic_logon...

>
> >http://win-regedit.eitwebguru.com/2009/03/allow-fast-user-switching.html

>
> Ok, checked those registry values and they check out correct - both are set
> to 1. Yet still no Welcome screen. I actually got Fast Switching icon nowbut
> if I click it takes me to a Logon window and I need to logon twice (after
> logging on first time it thinks for a moment and comes back with a second
> prompt). Man this is bad...


Okay, that look familiar - let's see if SAS turns up anything...
 
T

trant

Flightless Bird
"Jose" wrote:
> Okay, that look familiar - let's see if SAS turns up anything...
> .
>


Okay so I put SAS to do a complete scan and I went away - now I come back
and looks like my brother logged into the PC and didn't realize that now when
he logs in it logs me out so I lost the user interface for SAS.

Then I thought I might get lucky and the program would have logged it's scan
to file. I checked its folder in Program Files found nothing but then
realized it is probably in my User Application Data area and I did find a
log. Looks like it had 49 file threats detected - 46 of which are tracking
cookies but 3 of them are this:

Trojan.Agent/Gen-Nullo[Short]
C:/SYSTEM VOLUME
INFORMATION\_RESTORE{599884DF-EB4F-4AD4-A27F-CD4EB896256C}\RP431\A0013151.EXE
C:/SYSTEM VOLUME
INFORMATION\_RESTORE{599884DF-EB4F-4AD4-A27F-CD4EB896256C}\RP431\A0013152.EXE
C:/SYSTEM VOLUME
INFORMATION\_RESTORE{599884DF-EB4F-4AD4-A27F-CD4EB896256C}\RP431\A0013153.EXE

But despite it being a Trojan I dont think its the problem, given its
location. But I dont know if the scan actually completed or if it
automatically fixed these so I am running another full scan now.


Here are some details on my whacky log off process now...

I click Start -> Log Off and see an option to Fast Switch. I click it.

Instead of going to a Welcome Screen like I had before I get taken to a
Logon prompt whose user name is pre-filled with the username of the user that
was just logged in. So I change it to my username and then plug in my
password and hit OK.

I immediately get a prompt: "This will log off the current user. Any unsaved
work will be lost". Guess that's so much for fast switching...

I do it anyway and then I hear a few windows chimes and then the Logon
prompt comes up again, and it is again pre-filled username with the user who
was just logged in.

So I replace my username again and type in password and this time I log in
to my blank desktop as if a fresh reboot (all previously opened apps gone).
 
T

trant

Flightless Bird
Ok so I finished the scan again, and left all items checked and hit next and
it removed everything. But still messed up logon screen.

Also tried something from this site
http://www.kellys-korner-xp.com/xp_tweaks.htm
next to item number 45 "Restore the Welcome Screen" which is some
ginadll.vbs file based on the post of another person. Didn't help either.

And all this time I still have in my User control panel Use Welcome Screen
and Fast Switching checked ON.
 
J

Jose

Flightless Bird
On Mar 5, 10:37 pm, trant <tr...@discussions.microsoft.com> wrote:
> Ok so I finished the scan again, and left all items checked and hit next and
> it removed everything. But still messed up logon screen.
>
> Also tried something from this sitehttp://www.kellys-korner-xp.com/xp_tweaks.htm
> next to item number 45 "Restore the Welcome Screen" which is some
> ginadll.vbs file based on the post of another person. Didn't help either.
>
> And all this time I still have in my User control panel Use Welcome Screen
> and Fast Switching checked ON.


OK - I still think there is a gina.dll problem and the scanning
software may not be able to distinguish it, so let's check in the
registry.

Before making any changes to your registry, back it up with this
popular free tool:

http://www.larshederer.homepage.t-online.de/erunt/

Click Start, Run and in the box enter:

regedit

Click OK to open the registry editor and navigate to here:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion
\WinLogon

There should be no GinaDLL entry in WinLogon.

In the right pane if there is a key called GinaDLL, right-click
GinaDLL, and then click Delete. If you have the GinaDLL key, what
is the contents?

Respond in the affirmative when you are prompted to confirm the
deletion.

Click File, Exit to quit Registry Editor.

Reboot and test.
 
Top