• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 837
  • Last Modified:

XP logs on then logs off

Hello,

I have been having some major issues as of late, and I'm hoping someone here can help me. I get alot of computers in with viruses. I usually have a process I go through that gets the virus removed about 90% of the time. I understand that sometimes viruses are too far gone and you must reformat. Lately, I have been having an issue that causes me to reformat every PC and this is time consuming.

When I get a PC in, one of the first programs I run is Combofix. This works great on most PC's, but not as of late. I run combofix, and then after I restart the PC, I'm in a world of hurt. It seems as if Combofix has magically deleted a little thing called userinit.exe. This results in me going through an endless loop of "logging on, logging off". I have tried a windows repair. I have tried to boot to recovery console. I have tried to change registry settings. Nothing has worked, so I was forced to backup all user data, reinstall the PC, and then set all of there settings back up. When i;m dealing with 7 PC's at one time, this is very stressful, and some data is bound to get lost/deleted.

If you have had this problem, or have some ideas, I would really appreciate it. This virus is starting to get the best of me, and we can't have that!
0
cschutte21
Asked:
cschutte21
  • 5
  • 2
1 Solution
 
Donald StewartNetwork AdministratorCommented:
0
 
cschutte21Author Commented:
OK, here is what I did.

Inserted Windows XP disc into disk drive and booted to recovery console.

Typed this command:

      Expand H:\i386\userinit.ex_ C:\windows\system32\userinit.exe
      (Note: My Disk Drive is H:)

This is what I get:

      Unable to create file userinit.exe
      0 Files expanded
0
 
Donald StewartNetwork AdministratorCommented:
0
A Cyber Security RX to Protect Your Organization

Join us on December 13th for a webinar to learn how medical providers can defend against malware with a cyber security "Rx" that supports a healthy technology adoption plan for every healthcare organization.

 
Donald StewartNetwork AdministratorCommented:

Enter the Recovery Console
Boot the system using the Windows XP CD-ROM. In the first screen when the Setup begins, read the instructions press "R" (in the first screen) enter the Recovery Console. Type-in the built-in Administrator password to enter the Console. You'll see the prompt reading C:\Windows (Or any other drive-letter where you've installed XP)  
Type the following command and press Enter.
CD SYSTEM32
(If that does not work, try CHDIR SYSTEM32)
COPY USERINIT.EXE WSAUPDATER.EXE
Quit Recovery Console by typing EXIT and restart Windows.
You'll be able to login successfully as you've created the wsaupdater.exe file (now, a copy of userinit.exe)
Now, change the USERINIT value in the registry (see Phase II in this page) and change it accordingly.
0
 
Donald StewartNetwork AdministratorCommented:
also the command should have been
 
expand H:\i386\userinit.ex_ c:\windows\system32\
 
0
 
happyhenrikCommented:
I had the same problem  tried the expand thingy, and then the pc froze. i had to kill it and now it can't read from the HD... Anything I can do ?
0
 
Donald StewartNetwork AdministratorCommented:
happyhenrik,
You should open up a question on this so that other experts can get involved as well.
0
 
happyhenrikCommented:
0

Featured Post

2017 Webroot Threat Report

MSPs: Get the facts you need to protect your clients.
The 2017 Webroot Threat Report provides a uniquely insightful global view into the analysis and discoveries made by the Webroot® Threat Intelligence Platform to provide insights on key trends and risks as seen by our users.

  • 5
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now