Windows logon screen
 

Thanks to Mart and Jack for the help.

This is in answer to both your post and Jack's.
In the section below, I copied text from the MS app note.
Was this a 'fresh' wizard, requesting a 'new user'?

see #5 below, I entered a new password. Is this what you mean?

So how are you getting past the logon screen?
Do you still have to give it a password (even your old one) and/or can you
only get past it by using the "Cancel" option?

Only supply username, no password, then cancel or as you suggested.

What is the time/date stamp on your .pwl file - very recent??

Today's date.

If you are using the "Cancel" option then you must still have another .pwl
file floating around on your PC. Delete it and go thru' the whole process
again.

Yes, first I hit cancel, so renamed the file, repeated with return.

Are you sure that there are no other .pwl files on your pc? And remember,
something like a 'rogue' space character in your password field could cause
this problem.

Not in the Windows folder, dunno where else.
------
1. Click Start, point to Settings, click Control Panel, and then
double-click Network.

There is no Network icon in my Control Panel, so can't do this or #2 below.

2. On the Configuration tab, click Windows Logon in the Primary Network
Logon box, and then click OK.
3. When you are prompted to restart your computer, click No.
4. In Control Panel, double-click Passwords.
5. On the Change Passwords tab, click Change Windows Password, select any
of the check boxes that you want, and then click OK.

NOTE: If you cancel the network logon dialog box when you start your
computer, the Change Passwords tab may not be available. You must log on so
that the Change Passwords tab is available.

*** Don't see this. I have not yet created a DUN logon icon. Is this
significant?

6. In the Change Windows Password dialog box, type your current Windows
password in the Old Password box. Leave the New Password and Confirm New
Password boxes blank, click OK, and then click OK.

Windows seems to act normally, I change the password, the file is today's
date, etc.

With the above, I still get the screen, supply username, return, still no luck.

Advice?

Mike S
--------

Mart wrote:
ms wrote :-


Thanks, Mart, but no luck. There was only one password file (mine), I
changed the extension to .pwa, rebooted, password screen, entered
username, RETURN. Rebooted, screen is back. ???


Was this a 'fresh' wizard, requesting a 'new user'?

So how are you getting past the logon screen?

Do you still have to give it a password (even your old one) and/or can you
only get past it by using the "Cancel" option?

What is the time/date stamp on your .pwl file - very recent??

If you are using the "Cancel" option then you must still have another .pwl
file floating around on your PC. Delete it and go thru' the whole process
again.

Are you sure that there are no other .pwl files on your pc? And remember,
something like a 'rogue' space character in your password field could cause
this problem.

Jack's post further explains the situation.

Mart


"ms" wrote in message ...

Mart wrote:

Regarding the password issue only!!

Rick suggested :-


Unless you're using M$ networking for something, delete it in Network
Properties. When you delete the .pwl files, next time it comes up
*don't* put a password in (press cancel).


DO NOT CANCEL!!

How to get rid of your Password? - 2 choices and both work:

1 - the Official way
"How to Prevent a Windows 95, Windows 98, or Windows Me Logon Prompt at
Startup"
http://support.microsoft.com/default...b;en-us;152104

2 - the Unofficial way:-
Search for files that end .pwl.
Rename each of the extension - one at a time - to .pwa, .pwb etc.
Re-boot and the offending one will now let you logon as a new user.
Enter your name (or whatever) BUT do not enter a password. Just press
Return. The important thing is to respond with Return (or Enter) and NOT
cancel.

Mart

Thanks, Mart, but no luck. There was only one password file (mine), I
changed the extension to .pwa, rebooted, password screen, entered
username, RETURN. Rebooted, screen is back. ???

Is there a registry key that effects this?

The password screen has always been a killer for me in W95/98 and now ME.
In 98SE, I tried about 5 conventional fixes, finally the screen just
flashes by on bootup, don't look a gift horse in the mouth.

Advice?

Mike

ms, just to re-cap in simple terms :-

Delete (or rename) ALL .pwl files on your pc - (Search for *.pwl)

Re-boot and when it (the wizard?) asks for a name, enter yourname or
whatever.

DO NOT put anything in the Password box.

Then Press Return - DO NOT CANCEL.

Shut down and Re-boot.

You should no longer be presented with a logon screen.

Mart


snip

ms, I concure with Mart.

If you follow Steve Winograd's instructions from my previous post, and
Mart's advice here and previously, you should be golden.

Be sure to search your entire computer, i.e., every folder on every drive,
for any "this file's name.pwl", and rename or delete them.
Rename to "this file's name.ms", if you are cautious.

--
Jack E. Martinelli 2002-05 MS MVP for Shell/User / DTS
Help us help you: http://www.dts-L.org/goodpost.htm
In Memorium: Alex Nichol
http://www.microsoft.com/windowsxp/e...ts/nichol.mspx
Your cooperation is very appreciated.
------
"Mart" wrote in message
...
ms, just to re-cap in simple terms :-

Delete (or rename) ALL .pwl files on your pc - (Search for *.pwl)

Re-boot and when it (the wizard?) asks for a name, enter yourname or
whatever.

DO NOT put anything in the Password box.

Then Press Return - DO NOT CANCEL.

Shut down and Re-boot.

You should no longer be presented with a logon screen.

Mart


snip

Mart wrote:
ms, just to re-cap in simple terms :-

Delete (or rename) ALL .pwl files on your pc - (Search for *.pwl)

Re-boot and when it (the wizard?) asks for a name, enter yourname or
whatever.

DO NOT put anything in the Password box.

Then Press Return - DO NOT CANCEL.

Shut down and Re-boot.

You should no longer be presented with a logon screen.

Mart

I've done the above before, but wanted to be sure to answer to you.

I searched for *.pwl, only found (now) the one "ms.pwl", deleted it, then
did as you described, rebooted twice as sometimes the second time catches it.

No luck. The screen keeps coming up.

Jack: in my last reply I mentioned that with no Network icon, I could not
do some of what was mentioned in that app note.

When I got the puter, no screen. It started when I used Tweakui for *other*
settings, nothing to do with password. The next reboot started the password
screen.

One thing always puzzled me, why is there no registry key to change to stop
the screen?

Below I posted my startup processes to see if that helps:

StartupList report, 5/17/2005, 8:40:57 AM
StartupList version: 1.52
Started from : C:\UTILITIES\CLEANUP\STARTUPLIST152.EXE
Detected: Windows ME (Win9x 4.90.3000)
Detected: Internet Explorer v5.50 (5.50.4134.0100)
* Using default options
==================================================

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\UTILITIES\DESKTOP\WHIZ LAUNCHER MINI\WLMINI.EXE
C:\UTILITIES\DESKTOP\2XEXPLORER14112.EXE
C:\UTILITIES\DESKTOP\CLIPTRAK\CLIPTRAK.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\UTILITIES\CLEANUP\STARTUPLIST152.EXE
--------------------------------------------------

Listing of startup folders:
Shell folders Startup:
[C:\WINDOWS\Start Menu\Programs\StartUp]
wlmini.exe.lnk = C:\UTILITIES\Desktop\Whiz Launcher Mini\wlmini.exe
2xExplorer14112.lnk = C:\UTILITIES\Desktop\2xExplorer14112.exe
ClipTrak.lnk = C:\UTILITIES\Desktop\Cliptrak\ClipTrak.exe
--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

ScanRegistry = C:\WINDOWS\scanregw.exe /autorun
TaskMonitor = C:\WINDOWS\taskmon.exe
SystemTray = SysTray.Exe
LoadPowerProfile = Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
DLLHOSTXP.EXE = DLLHOSTXP.EXE
Tweak UI = RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run Services

LoadPowerProfile = Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
SchedulingAgent = mstask.exe
--------------------------------------------------

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:
Shell=Explorer.exe
SCRNSAVE.EXE=
drivers=mmsystem.dll power.drv
--------------------------------------------------

C:\WINDOWS\WININIT.BAK listing:
(Created 16/5/2005, 10:5:10)

[Rename]
NUL=C:\WINDOWS\TEMPOR~1\CONTENT.IE5\INDEX.DAT
NUL=C:\WINDOWS\COOKIES\INDEX.DAT
--------------------------------------------------

C:\AUTOEXEC.BAT listing:
SET windir=C:\WINDOWS
SET winbootdir=C:\WINDOWS
SET COMSPEC=C:\WINDOWS\COMMAND.COM
SET PATH=C:\WINDOWS;C:\WINDOWS\COMMAND
SET PROMPT=$p$g
SET TEMP=C:\WINDOWS\TEMP
SET TMP=C:\WINDOWS\TEMP
--------------------------------------------------

Enumerating Browser Helper Objects:
NavErrRedir Class - (no file) - {00D6A7E7-4A97-456f-848A-3B75BF7554D7}
(no name) - C:\WINDOWS\SYSTEM\MSACMX.DLL -
{A5366673-E8CA-11D3-9CD9-0090271D075B}
--------------------------------------------------

Enumerating Download Program Files:
[{11212111-2121-1311-1141-115611111222}]
CODEBASE = ms-its:mhtml:file://d:
oo.mht!http://fastsearchweb.com/counter/new/x.chm::/update.exe
--------------------------------------------------

Enumerating ShellServiceObjectDelayLoad items:
WebCheck: C:\WINDOWS\SYSTEM\WEBCHECK.DLL
AUHook: C:\WINDOWS\SYSTEM\AUHOOK.DLL
Web Event Logger: C:\WINDOWS\SYSTEM\Lebane32.dll

One entry I don't relate to, is this normal for ME?
DLLHOSTXP.EXE = DLLHOSTXP.EXE

This has been the most helpful windows ng I've seen. And I remember Alex
Nichol from the old days, a very helpful fellow, sorry to hear (before) of
his passing.

Thanks,

Mike S

Mike, I'm stumped. My previous response is a 'potted' version of the MS KB
article 152104, which is effectively, the 'standard' fix.

However, there is a passing reference in your startup processes to
SCRNSAVE.EXE and just wonder if it might be affecting the problem. Try this
KB article and see if it helps :-
"How to Change Passwords in Windows Me/98/95"
http://support.microsoft.com/default...b;en-us;257485

Also, I notice that you have some other 'desktop utilities' - again, I
wonder if these are influencing/overriding the logon screen setting.

BTW - what operation to you need to make to get past the logon screen?
Cancel? Input a password? etc.,?

Otherwise - I'm stumped g

Mart



"ms" wrote in message ...
Mart wrote:
ms, just to re-cap in simple terms :-

Delete (or rename) ALL .pwl files on your pc - (Search for *.pwl)

Re-boot and when it (the wizard?) asks for a name, enter yourname or
whatever.

DO NOT put anything in the Password box.

Then Press Return - DO NOT CANCEL.

Shut down and Re-boot.

You should no longer be presented with a logon screen.

Mart

I've done the above before, but wanted to be sure to answer to you.

I searched for *.pwl, only found (now) the one "ms.pwl", deleted it, then
did as you described, rebooted twice as sometimes the second time catches
it.

No luck. The screen keeps coming up.

Jack: in my last reply I mentioned that with no Network icon, I could not
do some of what was mentioned in that app note.

When I got the puter, no screen. It started when I used Tweakui for
*other* settings, nothing to do with password. The next reboot started the
password screen.

One thing always puzzled me, why is there no registry key to change to
stop the screen?

Below I posted my startup processes to see if that helps:

StartupList report, 5/17/2005, 8:40:57 AM
StartupList version: 1.52
Started from : C:\UTILITIES\CLEANUP\STARTUPLIST152.EXE
Detected: Windows ME (Win9x 4.90.3000)
Detected: Internet Explorer v5.50 (5.50.4134.0100)
* Using default options
==================================================

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\UTILITIES\DESKTOP\WHIZ LAUNCHER MINI\WLMINI.EXE
C:\UTILITIES\DESKTOP\2XEXPLORER14112.EXE
C:\UTILITIES\DESKTOP\CLIPTRAK\CLIPTRAK.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\UTILITIES\CLEANUP\STARTUPLIST152.EXE
--------------------------------------------------

Listing of startup folders:
Shell folders Startup:
[C:\WINDOWS\Start Menu\Programs\StartUp]
wlmini.exe.lnk = C:\UTILITIES\Desktop\Whiz Launcher Mini\wlmini.exe
2xExplorer14112.lnk = C:\UTILITIES\Desktop\2xExplorer14112.exe
ClipTrak.lnk = C:\UTILITIES\Desktop\Cliptrak\ClipTrak.exe
--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

ScanRegistry = C:\WINDOWS\scanregw.exe /autorun
TaskMonitor = C:\WINDOWS\taskmon.exe
SystemTray = SysTray.Exe
LoadPowerProfile = Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
DLLHOSTXP.EXE = DLLHOSTXP.EXE
Tweak UI = RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run Services

LoadPowerProfile = Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
SchedulingAgent = mstask.exe
--------------------------------------------------

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:
Shell=Explorer.exe
SCRNSAVE.EXE=
drivers=mmsystem.dll power.drv
--------------------------------------------------

C:\WINDOWS\WININIT.BAK listing:
(Created 16/5/2005, 10:5:10)

[Rename]
NUL=C:\WINDOWS\TEMPOR~1\CONTENT.IE5\INDEX.DAT
NUL=C:\WINDOWS\COOKIES\INDEX.DAT
--------------------------------------------------

C:\AUTOEXEC.BAT listing:
SET windir=C:\WINDOWS
SET winbootdir=C:\WINDOWS
SET COMSPEC=C:\WINDOWS\COMMAND.COM
SET PATH=C:\WINDOWS;C:\WINDOWS\COMMAND
SET PROMPT=$p$g
SET TEMP=C:\WINDOWS\TEMP
SET TMP=C:\WINDOWS\TEMP
--------------------------------------------------

Enumerating Browser Helper Objects:
NavErrRedir Class - (no file) - {00D6A7E7-4A97-456f-848A-3B75BF7554D7}
(no name) - C:\WINDOWS\SYSTEM\MSACMX.DLL -
{A5366673-E8CA-11D3-9CD9-0090271D075B}
--------------------------------------------------

Enumerating Download Program Files:
[{11212111-2121-1311-1141-115611111222}]
CODEBASE = ms-its:mhtml:file://d:
oo.mht!http://fastsearchweb.com/counter/new/x.chm::/update.exe
--------------------------------------------------

Enumerating ShellServiceObjectDelayLoad items:
WebCheck: C:\WINDOWS\SYSTEM\WEBCHECK.DLL
AUHook: C:\WINDOWS\SYSTEM\AUHOOK.DLL
Web Event Logger: C:\WINDOWS\SYSTEM\Lebane32.dll

One entry I don't relate to, is this normal for ME?
DLLHOSTXP.EXE = DLLHOSTXP.EXE

This has been the most helpful windows ng I've seen. And I remember Alex
Nichol from the old days, a very helpful fellow, sorry to hear (before) of
his passing.

Thanks,

Mike S

Again, I concur with Mart, ms.

Your Startup list looks rather ordinary, with the exception of these items,
about which I am unawa

C:\UTILITIES\DESKTOP\WHIZ LAUNCHER MINI\WLMINI.EXE
C:\UTILITIES\DESKTOP\2XEXPLORER14112.EXE
C:\UTILITIES\DESKTOP\CLIPTRAK\CLIPTRAK.EXE
DLLHOSTXP.EXE = DLLHOSTXP.EXE

Enumerating ShellServiceObjectDelayLoad items:
WebCheck: C:\WINDOWS\SYSTEM\WEBCHECK.DLL
AUHook: C:\WINDOWS\SYSTEM\AUHOOK.DLL
Web Event Logger: C:\WINDOWS\SYSTEM\Lebane32.dll

The webcheck.dll is a MS OS file:
DLL File: webcheck or webcheck.dll
DLL Name: Web Site Monitor
http://www.liutilities.com/products/...rary/webcheck/

I recommend using msconfig/Startup to disable temporarily any of the others
as a test.

Furthermore, you might do well by using either SpyBot's Advanced Menu and/or
HiJackThis to review the BHO and LSP list for any bad actors.
-----
ms wrote: "One entry I don't relate to, is this normal for ME?
DLLHOSTXP.EXE = DLLHOSTXP.EXE"

Name dllhostxp.exe
Command dllhostxp.exe
Status X
Description: browser hijacker and adware downloader
http://castlecops.com/startuplist-6542.html

Certainly appears to be a bad actor! If CastleCops knows about it, I would
think Ad-aware SE and/or SpyBot 1.3 would offer to kill it!

Also, the "Lebane32.dll", and variations, returned no hits using Google.
This is highly suspicious!

For AUHOOK.DLL : O21 - ShellServiceObjectDelayLoad
What it looks like:
O21 - SSODL - AUHOOK - {11566B38-955B-4549-930F-7B7482668782} -
C:\WINDOWS\System\auhook.dll
What to do:
This is an undocumented autorun method, normally used by a few Windows
system components. Items listed at
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\ShellServiceObj
ectDelayLoad are loaded by Explorer when Windows starts. HijackThis uses a
whitelist of several very common SSODL items, so whenever an item is
displayed in the log it is unknown and possibly malicious. Treat with
extreme care.
http://aumha.org/a/hjttutor.php


So some anti-virus and anti-spyware cleanup is strongly rcommended before
proceeding.
I strongly urge you to post here for advice before permanently deleting
anything, other than the obvious bad actor.

HTH, and please keep us informed,
--
Jack E. Martinelli 2002-05 MS MVP for Shell/User / DTS
Help us help you: http://www.dts-L.org/goodpost.htm
In Memorium: Alex Nichol
http://www.microsoft.com/windowsxp/e...ts/nichol.mspx
Your cooperation is very appreciated.
------
"Mart" wrote in message
...
Mike, I'm stumped. My previous response is a 'potted' version of the MS KB
article 152104, which is effectively, the 'standard' fix.

However, there is a passing reference in your startup processes to
SCRNSAVE.EXE and just wonder if it might be affecting the problem. Try
this
KB article and see if it helps :-
"How to Change Passwords in Windows Me/98/95"
http://support.microsoft.com/default...b;en-us;257485

Also, I notice that you have some other 'desktop utilities' - again, I
wonder if these are influencing/overriding the logon screen setting.

BTW - what operation to you need to make to get past the logon screen?
Cancel? Input a password? etc.,?

Otherwise - I'm stumped g

Mart



"ms" wrote in message ...
Mart wrote:
ms, just to re-cap in simple terms :-

Delete (or rename) ALL .pwl files on your pc - (Search for *.pwl)

Re-boot and when it (the wizard?) asks for a name, enter yourname or
whatever.

DO NOT put anything in the Password box.

Then Press Return - DO NOT CANCEL.

Shut down and Re-boot.

You should no longer be presented with a logon screen.

Mart

I've done the above before, but wanted to be sure to answer to you.

I searched for *.pwl, only found (now) the one "ms.pwl", deleted it,
then
did as you described, rebooted twice as sometimes the second time
catches
it.

No luck. The screen keeps coming up.

Jack: in my last reply I mentioned that with no Network icon, I could
not
do some of what was mentioned in that app note.

When I got the puter, no screen. It started when I used Tweakui for
*other* settings, nothing to do with password. The next reboot started
the
password screen.

One thing always puzzled me, why is there no registry key to change to
stop the screen?

Below I posted my startup processes to see if that helps:

StartupList report, 5/17/2005, 8:40:57 AM
StartupList version: 1.52
Started from : C:\UTILITIES\CLEANUP\STARTUPLIST152.EXE
Detected: Windows ME (Win9x 4.90.3000)
Detected: Internet Explorer v5.50 (5.50.4134.0100)
* Using default options
==================================================

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\UTILITIES\DESKTOP\WHIZ LAUNCHER MINI\WLMINI.EXE
C:\UTILITIES\DESKTOP\2XEXPLORER14112.EXE
C:\UTILITIES\DESKTOP\CLIPTRAK\CLIPTRAK.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\UTILITIES\CLEANUP\STARTUPLIST152.EXE
--------------------------------------------------

Listing of startup folders:
Shell folders Startup:
[C:\WINDOWS\Start Menu\Programs\StartUp]
wlmini.exe.lnk = C:\UTILITIES\Desktop\Whiz Launcher Mini\wlmini.exe
2xExplorer14112.lnk = C:\UTILITIES\Desktop\2xExplorer14112.exe
ClipTrak.lnk = C:\UTILITIES\Desktop\Cliptrak\ClipTrak.exe
--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

ScanRegistry = C:\WINDOWS\scanregw.exe /autorun
TaskMonitor = C:\WINDOWS\taskmon.exe
SystemTray = SysTray.Exe
LoadPowerProfile = Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
DLLHOSTXP.EXE = DLLHOSTXP.EXE
Tweak UI = RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run Services

LoadPowerProfile = Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
SchedulingAgent = mstask.exe
--------------------------------------------------

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:
Shell=Explorer.exe
SCRNSAVE.EXE=
drivers=mmsystem.dll power.drv
--------------------------------------------------

C:\WINDOWS\WININIT.BAK listing:
(Created 16/5/2005, 10:5:10)

[Rename]
NUL=C:\WINDOWS\TEMPOR~1\CONTENT.IE5\INDEX.DAT
NUL=C:\WINDOWS\COOKIES\INDEX.DAT
--------------------------------------------------

C:\AUTOEXEC.BAT listing:
SET windir=C:\WINDOWS
SET winbootdir=C:\WINDOWS
SET COMSPEC=C:\WINDOWS\COMMAND.COM
SET PATH=C:\WINDOWS;C:\WINDOWS\COMMAND
SET PROMPT=$p$g
SET TEMP=C:\WINDOWS\TEMP
SET TMP=C:\WINDOWS\TEMP
--------------------------------------------------

Enumerating Browser Helper Objects:
NavErrRedir Class - (no file) - {00D6A7E7-4A97-456f-848A-3B75BF7554D7}
(no name) - C:\WINDOWS\SYSTEM\MSACMX.DLL -
{A5366673-E8CA-11D3-9CD9-0090271D075B}
--------------------------------------------------

Enumerating Download Program Files:
[{11212111-2121-1311-1141-115611111222}]
CODEBASE = ms-its:mhtml:file://d:
oo.mht!http://fastsearchweb.com/counter/new/x.chm::/update.exe
--------------------------------------------------

Enumerating ShellServiceObjectDelayLoad items:
WebCheck: C:\WINDOWS\SYSTEM\WEBCHECK.DLL
AUHook: C:\WINDOWS\SYSTEM\AUHOOK.DLL
Web Event Logger: C:\WINDOWS\SYSTEM\Lebane32.dll

One entry I don't relate to, is this normal for ME?
DLLHOSTXP.EXE = DLLHOSTXP.EXE

This has been the most helpful windows ng I've seen. And I remember
Alex
Nichol from the old days, a very helpful fellow, sorry to hear (before)
of
his passing.

Thanks,

Mike S

inline comments:
Mart wrote:
Mike, I'm stumped. My previous response is a 'potted' version of the MS KB
article 152104, which is effectively, the 'standard' fix.

However, there is a passing reference in your startup processes to
SCRNSAVE.EXE and just wonder if it might be affecting the problem. Try this
KB article and see if it helps :-
"How to Change Passwords in Windows Me/98/95"
http://support.microsoft.com/default...b;en-us;257485

Also, I notice that you have some other 'desktop utilities' - again, I
wonder if these are influencing/overriding the logon screen setting.

If you mean 2XExplorer, ClipTrak, Whizlauncher, etc., IMO they don't cause
problems, used them for years in W98SE, the logon screen (as you know)
happens early in loading process, those utils only load afterward.

BTW - what operation to you need to make to get past the logon screen?
Cancel? Input a password? etc.,?

I have to enter a username, then either return, or close, or cancel, all
work to close the screen.

Otherwise - I'm stumped g

Mart

Thanks again for all the help, I need to shut it down for several weeks and
maybe when I start playing with it again, if anything occurs, can post back.

I gather the answer was No, to a registry key for the password screen.

Mike S



"ms" wrote in message ...

Mart wrote:

ms, just to re-cap in simple terms :-

Delete (or rename) ALL .pwl files on your pc - (Search for *.pwl)

Re-boot and when it (the wizard?) asks for a name, enter yourname or
whatever.

DO NOT put anything in the Password box.

Then Press Return - DO NOT CANCEL.

Shut down and Re-boot.

You should no longer be presented with a logon screen.

Mart


I've done the above before, but wanted to be sure to answer to you.

I searched for *.pwl, only found (now) the one "ms.pwl", deleted it, then
did as you described, rebooted twice as sometimes the second time catches
it.

No luck. The screen keeps coming up.

Jack: in my last reply I mentioned that with no Network icon, I could not
do some of what was mentioned in that app note.

When I got the puter, no screen. It started when I used Tweakui for
*other* settings, nothing to do with password. The next reboot started the
password screen.

One thing always puzzled me, why is there no registry key to change to
stop the screen?

Below I posted my startup processes to see if that helps:

StartupList report, 5/17/2005, 8:40:57 AM
StartupList version: 1.52
Started from : C:\UTILITIES\CLEANUP\STARTUPLIST152.EXE
Detected: Windows ME (Win9x 4.90.3000)
Detected: Internet Explorer v5.50 (5.50.4134.0100)
* Using default options
================================================ ==

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\UTILITIES\DESKTOP\WHIZ LAUNCHER MINI\WLMINI.EXE
C:\UTILITIES\DESKTOP\2XEXPLORER14112.EXE
C:\UTILITIES\DESKTOP\CLIPTRAK\CLIPTRAK.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\UTILITIES\CLEANUP\STARTUPLIST152.EXE
--------------------------------------------------

Listing of startup folders:
Shell folders Startup:
[C:\WINDOWS\Start Menu\Programs\StartUp]
wlmini.exe.lnk = C:\UTILITIES\Desktop\Whiz Launcher Mini\wlmini.exe
2xExplorer14112.lnk = C:\UTILITIES\Desktop\2xExplorer14112.exe
ClipTrak.lnk = C:\UTILITIES\Desktop\Cliptrak\ClipTrak.exe
--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\R un

ScanRegistry = C:\WINDOWS\scanregw.exe /autorun
TaskMonitor = C:\WINDOWS\taskmon.exe
SystemTray = SysTray.Exe
LoadPowerProfile = Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
DLLHOSTXP.EXE = DLLHOSTXP.EXE
Tweak UI = RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\R unServices

LoadPowerProfile = Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
SchedulingAgent = mstask.exe
--------------------------------------------------

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:
Shell=Explorer.exe
SCRNSAVE.EXE=
drivers=mmsystem.dll power.drv
--------------------------------------------------

C:\WINDOWS\WININIT.BAK listing:
(Created 16/5/2005, 10:5:10)

[Rename]
NUL=C:\WINDOWS\TEMPOR~1\CONTENT.IE5\INDEX.DAT
NUL=C:\WINDOWS\COOKIES\INDEX.DAT
--------------------------------------------------

C:\AUTOEXEC.BAT listing:
SET windir=C:\WINDOWS
SET winbootdir=C:\WINDOWS
SET COMSPEC=C:\WINDOWS\COMMAND.COM
SET PATH=C:\WINDOWS;C:\WINDOWS\COMMAND
SET PROMPT=$p$g
SET TEMP=C:\WINDOWS\TEMP
SET TMP=C:\WINDOWS\TEMP
--------------------------------------------------

Enumerating Browser Helper Objects:
NavErrRedir Class - (no file) - {00D6A7E7-4A97-456f-848A-3B75BF7554D7}
(no name) - C:\WINDOWS\SYSTEM\MSACMX.DLL -
{A5366673-E8CA-11D3-9CD9-0090271D075B}
--------------------------------------------------

Enumerating Download Program Files:
[{11212111-2121-1311-1141-115611111222}]
CODEBASE = ms-its:mhtml:file://d:
oo.mht!http://fastsearchweb.com/counter/new/x.chm::/update.exe
--------------------------------------------------

Enumerating ShellServiceObjectDelayLoad items:
WebCheck: C:\WINDOWS\SYSTEM\WEBCHECK.DLL
AUHook: C:\WINDOWS\SYSTEM\AUHOOK.DLL
Web Event Logger: C:\WINDOWS\SYSTEM\Lebane32.dll

One entry I don't relate to, is this normal for ME?
DLLHOSTXP.EXE = DLLHOSTXP.EXE

This has been the most helpful windows ng I've seen. And I remember Alex
Nichol from the old days, a very helpful fellow, sorry to hear (before) of
his passing.

Thanks,

Mike S

I have to enter a username, then either return,

Mmm... I thought that there was a check-box to 'Remember' Logon Details.
(Not convenient to test here, sorry - perhaps Jack can confirm)

I gather the answer was No, to a registry key for the password screen.

None that I am aware of.

Otherwise, still stumped.

Mart


"ms" wrote in message ...
inline comments:
Mart wrote:
Mike, I'm stumped. My previous response is a 'potted' version of the MS
KB article 152104, which is effectively, the 'standard' fix.

However, there is a passing reference in your startup processes to
SCRNSAVE.EXE and just wonder if it might be affecting the problem. Try
this KB article and see if it helps :-
"How to Change Passwords in Windows Me/98/95"
http://support.microsoft.com/default...b;en-us;257485

Also, I notice that you have some other 'desktop utilities' - again, I
wonder if these are influencing/overriding the logon screen setting.

If you mean 2XExplorer, ClipTrak, Whizlauncher, etc., IMO they don't cause
problems, used them for years in W98SE, the logon screen (as you know)
happens early in loading process, those utils only load afterward.

BTW - what operation to you need to make to get past the logon screen?
Cancel? Input a password? etc.,?

I have to enter a username, then either return, or close, or cancel, all
work to close the screen.

Otherwise - I'm stumped g

Mart

Thanks again for all the help, I need to shut it down for several weeks
and maybe when I start playing with it again, if anything occurs, can
post back.

I gather the answer was No, to a registry key for the password screen.

Mike S



"ms" wrote in message
...

Mart wrote:

ms, just to re-cap in simple terms :-

Delete (or rename) ALL .pwl files on your pc - (Search for *.pwl)

Re-boot and when it (the wizard?) asks for a name, enter yourname or
whatever.

DO NOT put anything in the Password box.

Then Press Return - DO NOT CANCEL.

Shut down and Re-boot.

You should no longer be presented with a logon screen.

Mart


I've done the above before, but wanted to be sure to answer to you.

I searched for *.pwl, only found (now) the one "ms.pwl", deleted it, then
did as you described, rebooted twice as sometimes the second time catches
it.

No luck. The screen keeps coming up.

Jack: in my last reply I mentioned that with no Network icon, I could not
do some of what was mentioned in that app note.

When I got the puter, no screen. It started when I used Tweakui for
*other* settings, nothing to do with password. The next reboot started
the password screen.

One thing always puzzled me, why is there no registry key to change to
stop the screen?

Below I posted my startup processes to see if that helps:

StartupList report, 5/17/2005, 8:40:57 AM
StartupList version: 1.52
Started from : C:\UTILITIES\CLEANUP\STARTUPLIST152.EXE
Detected: Windows ME (Win9x 4.90.3000)
Detected: Internet Explorer v5.50 (5.50.4134.0100)
* Using default options
=============================================== ===

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\UTILITIES\DESKTOP\WHIZ LAUNCHER MINI\WLMINI.EXE
C:\UTILITIES\DESKTOP\2XEXPLORER14112.EXE
C:\UTILITIES\DESKTOP\CLIPTRAK\CLIPTRAK.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\UTILITIES\CLEANUP\STARTUPLIST152.EXE
--------------------------------------------------

Listing of startup folders:
Shell folders Startup:
[C:\WINDOWS\Start Menu\Programs\StartUp]
wlmini.exe.lnk = C:\UTILITIES\Desktop\Whiz Launcher Mini\wlmini.exe
2xExplorer14112.lnk = C:\UTILITIES\Desktop\2xExplorer14112.exe
ClipTrak.lnk = C:\UTILITIES\Desktop\Cliptrak\ClipTrak.exe
--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\ Run

ScanRegistry = C:\WINDOWS\scanregw.exe /autorun
TaskMonitor = C:\WINDOWS\taskmon.exe
SystemTray = SysTray.Exe
LoadPowerProfile = Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
DLLHOSTXP.EXE = DLLHOSTXP.EXE
Tweak UI = RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\ RunServices

LoadPowerProfile = Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
SchedulingAgent = mstask.exe
--------------------------------------------------

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:
Shell=Explorer.exe
SCRNSAVE.EXE=
drivers=mmsystem.dll power.drv
--------------------------------------------------

C:\WINDOWS\WININIT.BAK listing:
(Created 16/5/2005, 10:5:10)

[Rename]
NUL=C:\WINDOWS\TEMPOR~1\CONTENT.IE5\INDEX.DAT
NUL=C:\WINDOWS\COOKIES\INDEX.DAT
--------------------------------------------------

C:\AUTOEXEC.BAT listing:
SET windir=C:\WINDOWS
SET winbootdir=C:\WINDOWS
SET COMSPEC=C:\WINDOWS\COMMAND.COM
SET PATH=C:\WINDOWS;C:\WINDOWS\COMMAND
SET PROMPT=$p$g
SET TEMP=C:\WINDOWS\TEMP
SET TMP=C:\WINDOWS\TEMP
--------------------------------------------------

Enumerating Browser Helper Objects:
NavErrRedir Class - (no file) - {00D6A7E7-4A97-456f-848A-3B75BF7554D7}
(no name) - C:\WINDOWS\SYSTEM\MSACMX.DLL -
{A5366673-E8CA-11D3-9CD9-0090271D075B}
--------------------------------------------------

Enumerating Download Program Files:
[{11212111-2121-1311-1141-115611111222}]
CODEBASE = ms-its:mhtml:file://d:
oo.mht!http://fastsearchweb.com/counter/new/x.chm::/update.exe
--------------------------------------------------

Enumerating ShellServiceObjectDelayLoad items:
WebCheck: C:\WINDOWS\SYSTEM\WEBCHECK.DLL
AUHook: C:\WINDOWS\SYSTEM\AUHOOK.DLL
Web Event Logger: C:\WINDOWS\SYSTEM\Lebane32.dll

One entry I don't relate to, is this normal for ME?
DLLHOSTXP.EXE = DLLHOSTXP.EXE

This has been the most helpful windows ng I've seen. And I remember Alex
Nichol from the old days, a very helpful fellow, sorry to hear (before)
of his passing.

Thanks,

Mike S

OK, it looks as if a sledgehammer is going to be needed here.

Mike,

Try installing TweakUI v1.33 (see below) and using that to force
autologon. You will find this option on the logon tab. Alternatively
using regedit try adding the following three strings to the key
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Winlogon
AutoAdminLogon and set = 1
DefaultUserName and set = to your user name, for example Mike
DontDisplayLastUserName and set = 0

I can't guarantee this will work as I've never had to use this myself but
should at least be worth trying.

If you haven't got TweakUI the Win Me compatible version (1.33) can be
downloaded from Microsoft
(http://www.microsoft.com/ntworkstati.../nttweakui.asp)
and installed as follows:

Download to a folder with a short name (e.g. C:\Tweak), run to extract
components, right click on tweakui.inf and then install, close the help
window that comes up to allow install to finish. C:\Tweak can now be
deleted and TweakUI accessed via the Control Panel.

Just a few words of caution if you are new to using TweakUI on Win Me.
a) Do not change the first icon (My Documents) on the Desktop tab.
Doing this causes a number of script errors in Special Folders when using
either WebView or Active desktop.
b) Do not uncheck "Search Results" on the Desktop tab.
Doing this disables the Search in Explorer.
c) Do not hide the TweakUI icon on the Control Panel tab.
d) Do not uncheck "Show Control Panel on Start Menu" on the IE tab.
Doing this will prevent you from accessing the Control Panel including
TweakUI.
e) Do not uncheck "Shell Enhancements" on the IE tab.
This causes quite a few unexpected "problems".
--
Mike Maltby MS-MVP



Mart wrote:

I have to enter a username, then either return,

Mmm... I thought that there was a check-box to 'Remember' Logon
Details. (Not convenient to test here, sorry - perhaps Jack can
confirm)
I gather the answer was No, to a registry key for the password
screen.

None that I am aware of.

Otherwise, still stumped.

Jack E Martinelli wrote:
Again, I concur with Mart, ms.

Your Startup list looks rather ordinary, with the exception of these items,
about which I am unawa

C:\UTILITIES\DESKTOP\WHIZ LAUNCHER MINI\WLMINI.EXE
C:\UTILITIES\DESKTOP\2XEXPLORER14112.EXE
C:\UTILITIES\DESKTOP\CLIPTRAK\CLIPTRAK.EXE
DLLHOSTXP.EXE = DLLHOSTXP.EXE

Enumerating ShellServiceObjectDelayLoad items:
WebCheck: C:\WINDOWS\SYSTEM\WEBCHECK.DLL
AUHook: C:\WINDOWS\SYSTEM\AUHOOK.DLL
Web Event Logger: C:\WINDOWS\SYSTEM\Lebane32.dll

The webcheck.dll is a MS OS file:
DLL File: webcheck or webcheck.dll
DLL Name: Web Site Monitor
http://www.liutilities.com/products/...rary/webcheck/

I recommend using msconfig/Startup to disable temporarily any of the others
as a test.

Furthermore, you might do well by using either SpyBot's Advanced Menu and/or
HiJackThis to review the BHO and LSP list for any bad actors.
-----
ms wrote: "One entry I don't relate to, is this normal for ME?
DLLHOSTXP.EXE = DLLHOSTXP.EXE"

Name dllhostxp.exe
Command dllhostxp.exe
Status X
Description: browser hijacker and adware downloader
http://castlecops.com/startuplist-6542.html

Certainly appears to be a bad actor! If CastleCops knows about it, I would
think Ad-aware SE and/or SpyBot 1.3 would offer to kill it!

Also, the "Lebane32.dll", and variations, returned no hits using Google.
This is highly suspicious!

For AUHOOK.DLL : O21 - ShellServiceObjectDelayLoad
What it looks like:
O21 - SSODL - AUHOOK - {11566B38-955B-4549-930F-7B7482668782} -
C:\WINDOWS\System\auhook.dll
What to do:
This is an undocumented autorun method, normally used by a few Windows
system components. Items listed at
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\ShellServiceObj
ectDelayLoad are loaded by Explorer when Windows starts. HijackThis uses a
whitelist of several very common SSODL items, so whenever an item is
displayed in the log it is unknown and possibly malicious. Treat with
extreme care.
http://aumha.org/a/hjttutor.php


So some anti-virus and anti-spyware cleanup is strongly rcommended before
proceeding.
I strongly urge you to post here for advice before permanently deleting
anything, other than the obvious bad actor.

HTH, and please keep us informed,

Thanks to both of you. The reason for possible nasties on the hard drive is
this was a used puter, I already uninstalled lots of junk, but some still
in the woodwork. BTW, it was Tweakui 133 that started the password screen.
(can't explain).

I will work on this, but can't for several weeks as puter is packed away
temporarily. Will post back later.

Mike S