[Andy_Bee]

I tried to find the Bart PE thingy before but to no avail...
Have you perhaps got disc image or somethig I can grab?

[Advertisements]

you've got to roll your own

http://www.nu2.nu/pebuilder/

[gerryf]

you've got to roll your own

http://www.nu2.nu/pebuilder/

[gerryf]

...that way you can customize it with what you want....some folks make them very elaborate...

I just do regeditor, cd burning and all the network adapters you can shake a stick at....oh, and everest too

[Andy_Bee]

Ok, I managed to do a very basic image of BartPE, but if I try to include Nero Burning Rom and a few other useful things like the McAfee I end up with errors and no image is made... File not found etc... (even though the file it wants is blatantly not part of any Nero installation ever!)

How do I get Regeditor and do I 'need' the network adapters?

[nerium]

Hey Andy I'm going to throw in a small trick I managed while working through a family friend's comp a few pages back. This computer was so horribly infected that I couldn't get it clean through the usual channels, so I ended up deleting the malware directories and like you suggested I would get a "Cannot delete" because which ever *.exe was running, so I then ended the process tree (nothing should have been running at the time) of that troublesome EXE that was hiding in those malware directories and then immediately deleted the rest of the folders. A few times I had to kill more than on EXE before the dir would disappear quietly. Next I used Ace to clean up the registry keys for each directory I had killed.

I did a brief review of the System 32 directory to make sure no other legit *.exe-s had been modified lately, (in the cases where they shouldn't be changing) and did a few other linkage checks to make sure I wasn't going to end up with the Blazeware problem again.

After about two hours of this, I managed a clean logon without popups, no DLL errors and happily a much slimmer startup list. Then I updated AVG and AdAware, scanned and healed the remaining virus infections and booted each profile successfully without any popups and clean bills of health.

[gerryf]

Andy, could you start your own thread on this, just so we can retire this one....

nerium, you're more than welcome to come along for the ride...

[Andy_Bee]

Given up guys, I'm getting nowhere very, very quickly!

Somehow I don't think the customer will pay for my time after about £100...

Just gonna reformat and reinstall - tough sheot to them, their fault for knackering it to start with!

[Miquel]

I have this exactly same problem with a laptop that has some valuable information. I used the windows recovery tool to browse the system32-files and there was no wsaupdater.exe to be found. I still copied userinit to wsaupdater, but it didn't help.
Then i tried booting the comp with a tool that had registry editor. in Windows NT\CurrentVersion\Winlogon there is no such key as userinit at all. I compared it to my desktop comp and created the same key which u posted here, to the laptop. Still it doesn't help.
I have searched all over the net for a solution and found nothing in addition to the wsaupdater.exe thingy.
Only difference was that on my comp the userinit key was of type REG_SZ, but for some reason the commandpromt-editor would only make it of type REG_Extended_SZ, however that seems quite irrelevant to me.


If you have any ideas as what to try next, I would appreciate it greatly!

Edited by Miquel, 06 May 2005 - 03:26 AM.

[Miquel]

I got some new info on this problem by doing the repair install.
While activating windows xp again, I got to see an error report, that states "invalid backweb application id 4119343"
The problem is still the same as before, it logs out immediately after login.

However it's an Compaq laptop and i found this page that might explain why the problem has occurred.
http://h10025.www1.h...cname=c00061410
But I still havent been able to fix this problem. Guide on that Compaq page says that you should be able to uninstall the backweb-application by pressin F10 repetedly after logo, but nothing happens.
Only way to uninstall this prog, that I can think of is in windows, and I just can't get there!

Can someone Please help!

[Mac_Quazi]

I've had the same problem with logging into windows xp and it logs in and out again immediately.

I tried the userinit.exe and wsaupdater.exe solution, but that didnt work. Then I tried the microsofts soultion, but that didnt work.

I tried the Bart PE Disk and I know it should work, but because the microsofts solution failed its causing problems. this is what I did, I went into the recovery console and typed

md tmp
copy c:\windows\system32\config\system c:\windows\tmp\system.bak
copy c:\windows\system32\config\software c:\windows\tmp\software.bak
copy c:\windows\system32\config\sam c:\windows\tmp\sam.bak
copy c:\windows\system32\config\security c:\windows\tmp\security.bak
copy c:\windows\system32\config\default c:\windows\tmp\default.bak

delete c:\windows\system32\config\system
delete c:\windows\system32\config\software
delete c:\windows\system32\config\sam
delete c:\windows\system32\config\security
delete c:\windows\system32\config\default

copy c:\windows\repair\system c:\windows\system32\config\system
copy c:\windows\repair\software c:\windows\system32\config\software
copy c:\windows\repair\sam c:\windows\system32\config\sam
copy c:\windows\repair\security c:\windows\system32\config\security
copy c:\windows\repair\default c:\windows\system32\config\default

Now when I try running refix.cmd from the BartPE disk it keeps saying something like 'file path specified cannot be found'.

Now windows wont even boot

Im guessing its because i've deleted the system folder using micrsosofts solution, so I need to know a way where I can restore these folders again. Is there a way I can get these folders back from MDTMP? Im not good at DOS so if somebody can tell me exactly what to type in i'd be grateful. I need gerryf's help especially.

P.S. This is my 1st time on this forum, not sure how this all works, i've just added a reply, Should I have started a new thread?

[gerryf]

Yes, please start your own thread....and what Microsoft Solution did you use? (link to kb article)?

[Andy_Bee]

It may be because the Microsoft solution is a little out...
One fo the files (I think it is 'System') is actually called 'System.bak', so you have to alter the commands they have listed using your common sense...
If you get a message that the file was not found when you follow the Microsoft instructions then you will have to take a look in the "C:\Windows\System32\Repair" folder - you'll see which one it is...

Hope that helps, Icame across it during my probalme... if all 4 files are not there intact it doesn't boot atall! (

[dez93_2000]

Hi guys, was there ever any resolution to any of these not caused by malware? If there's a new thread bandwagon to be jumped on, well sign me up: i've just gotten exactly the same problem with few changes made recently (installed windows update: windows installer 3.1), everything working fine, shut winamp and things started freezing, couldn't make task manager run, it wouldn't shut down so i killed it and now i'm in the login/logout loop with normal & admin users, safe mode, cmd prompt, last known good, the works. I'm all ready with BartPE (its been a good month ) but can't think of anything that could have caused this. Progs seem to run fine when i'm in BartPE too, giving no indication of what's up. Supergrateful for any (more) ideas gents!
Si

[gerryf]

please start your own thread

[RayHawk]

Hi All,
I found when resolving this problem that the changed registry was the path.

Navigate to
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\

In the right pane, you should see

C:\WINDOWS\System32\wsaupdater.exe,

What I saw was:

C:\I386\System32\userinit.exe

No such file there!I did find it in the C:\WINDOWS\System32

I change it so that it reads:

C:\WINDOWS\System32\userinit.exe

And after a reboot this worked fine.

So instead of pointing to the C:\Windows\system32 directory it pointed to the C:\I386\System32 directory. I believe this is a mutation from orginal VIrus.

I would never have found that without reading this forum.

Thanks much.
RayHawk

Edited by RayHawk, 26 September 2012 - 09:58 AM.