CAUSE
You may not be able to log on to system using either Normal Mode or Safe Mode. This occur only when Winlogon service tries to load the Windows default shell (explorer.exe) and user shell (userinit.exe) from registry. This service searches for Explorer.exe and Userinit.exe in the following path of registry:
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
RESOLUTION
Edit these values and type the correct path of shell :
Shell = explorer.exe
Userinit=X:\windows\system32\userinit.exe
NOTE: These files may also be deleted by spywares. You may need to extract them using Windows CD.
Steps for rectifying this problem:
•Log on to a networked computer.
•Run Regedit.exe
•Point your cursor to HKEY_LOCAL_MACHINE
•Select File > Connect Remote Registry
•Type computer name (infected computer)
•Navigate to the following location in registry of destination or infected computer
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
•Edit these two values in right pane:
Shell
Userinit
•Change these two values to
Shell=explorer.exe
Userinit = x:\windows\system32\userinit.exe
•Exit from Registry
•Restart Infected computer.
•You should be able to log on to computer.
What's error when you attempt to logon using RDP? Please confirm if your account has administrator permission. – Waka – 2018-01-02T09:43:54.570
I've got no error, when I logon, I can see desktop for brief moment, but then, on the remote desktop screen, while full-screen, it displays login box. I have admin permission. – Andrew Smith – 2018-01-02T11:12:01.103