I was recently assisting a client with an XP machine that was infected and caused the user to no longer be able to login. They system boots to the login screen, and you can input your username/password, but after that the system instantly logged off. Turns out the virus had modified the registry and deleted the Userinit entry in the Winlogon key. Microsoft offers this KB article that details the process to fix this. I found that the process of connecting to the remote registry was tedious, so I just pulled the drive, mounted it in my USB adapter, and opened the Software Hive (C:\windows\systems32\config\SOFTWARE) on my working system.