Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

Another XP logs on then back off problem


  • Please log in to reply

#1
TenitaB

TenitaB

    Member

  • Member
  • PipPip
  • 11 posts
Hello Everyone!

I am working on an acer laptop (XP) that was infested with viruses and spyware. I installed Norton AV 2006 and it found the virus Infostealer. I had to boot the pc in safemode in order to remove it completely. It was after that, I began to experience the Log on/log off dance and the windows logon screen- yes EVEN in safemode as the Admin.

I used ERD to boot the pc, however can't go back to a restore point because I turned them off prior to cleaning off the virus. I used the registry editor in ERD to check the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\ and the value is already "C:\WINDOWS\System32\userinit.exe,"

All the documentation that I have found seem to suggest that checking the registry would be the panacea to my issue, however I am in need of a plan B. :whistling:

Any suggestions?

TIA,
Tenita

Edited by TenitaB, 11 July 2006 - 10:06 AM.

  • 0

Advertisements


#2
gerryf

gerryf

    Retired Staff

  • Retired Staff
  • 11,365 posts
hard to say...damaged SAM? Perhaps

Using ERD, is the c:\windows\repair folder still there

Using ERD should greatly simplify this process

http://support.micro...om/?kbid=307545
  • 0

#3
TenitaB

TenitaB

    Member

  • Topic Starter
  • Member
  • PipPip
  • 11 posts
I am reading the knowledge base link you posted now, but I did use ERD and checked the WINDOWS\repair folder - it is there. I will update soon. thanks


-Tenita
  • 0

#4
TenitaB

TenitaB

    Member

  • Topic Starter
  • Member
  • PipPip
  • 11 posts
Part One -

md tmp
copy c:\windows\system32\config\system c:\windows\tmp\system.bak
copy c:\windows\system32\config\software c:\windows\tmp\software.bak
copy c:\windows\system32\config\sam c:\windows\tmp\sam.bak
copy c:\windows\system32\config\security c:\windows\tmp\security.bak
copy c:\windows\system32\config\default c:\windows\tmp\default.bak

delete c:\windows\system32\config\system
delete c:\windows\system32\config\software
delete c:\windows\system32\config\sam
delete c:\windows\system32\config\security
delete c:\windows\system32\config\default

copy c:\windows\repair\system c:\windows\system32\config\system The system could not find the specified file
copy c:\windows\repair\software c:\windows\system32\config\software
copy c:\windows\repair\sam c:\windows\system32\config\sam
copy c:\windows\repair\security c:\windows\system32\config\security
copy c:\windows\repair\default c:\windows\system32\config\default

Other than that everything copied fine. Since I had deleted the file System, I moved the copy from the tmp folder back into the windows\system32\config folder so that the pc would boot. I now get this error:System error: Lsass.exe
When trying to update a password the return status indicates that the value provided as the current password is not correct.


If i undo everything and return files back to original location, pc boots to the log on/log off dance again.

What did I do wrong?

Thanks,
Tenita
  • 0

#5
gerryf

gerryf

    Retired Staff

  • Retired Staff
  • 11,365 posts
i don't know what you are doing wrong...it is peculiar that the file is not there.

When you say you are using ERD. where did you get it from? Can you access

C:\System Volume Information

using this?
  • 0

#6
TenitaB

TenitaB

    Member

  • Topic Starter
  • Member
  • PipPip
  • 11 posts
Gerryf,

Just wanted to post a quick update. Working on that article you posted for me, I wasn't able to get much further than my previous post. I did a repair of the windows installation, lo and behold the same dang thing happens!! :whistling:

I will post back when I finally get to the bottom of this dilemna.

THx
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP