[Beeracuda]

Hi. Hopefully someone can help me with my problem(s). This is no doubt a virus problem, but I don't know how to fix it since I cannot access my computer.
Here's what happens:

When starting the computer (using Windows XP Home), Windows starts to load, then I get an error in "Userinit.exe". I click "OK" to continue, and windows continues to start up, but finishes with a blue screen with no desktop icons, nor any START button or taskbar. Just a blue screen. When I try to CTRL-ALT-DEL to get to task manager, I get another error in the task manager file. So at this point, there's basically nothing I can do.

So I tried to restart my computer in SAFE MODE. I was able to get to the start up menu choices, but after trying each of the SAFE MODE options, it tells me that "windows was unable to start in SAFE MODE", for whatever reason, and I'm back at the SAFE MODE choices menu. No matter which option I use to try to start windows, the same problem happens as listed in the above paragraph.

Any help would be greatly appreciated. I don't believe I have a Windows XP install disk, since I bought this computer used from Craigslist about a year ago.

Anything I can do?

[Advertisements]

Give this a try. Without knowing a little more about what caused the problem, I can't guarantee it will work...and it requires the machine you make the disk on AND the machine you are fixing are both running XP.

Please download RC.ISO and save it somewhere you can find it.
Also download MagicISO.

Start MagicISO. You should see a window informing you about the full version of MagicISO.
In the bottom right select Try It! and the program will open.
Click on File and then on Open and navigate to the RC.ISO file you downloaded. Select it, and click Open.

First, we'll need to add a clean version of userinit.exe to the current RC.ISO

* In the upper right pane, double click on the i386 folder.
* Right click in the upper right pane and select Add Files...
* Navigate to C:\Windows\System32 and select userinit.exe
* Then click Open to add userinit.exe to the CD image.
* Click File and select Save As...
* Name the file RCplus and save it somewhere you can find it.


Next, we'll need to burn the newly created image to a disk that we can use to fix the problem.

* Put a blank CD-R disk in your CD burner and close the tray. If an AutoPlay window opens, close it.
* Click on Tools and select Burn CD/DVD with ISO.... A window will appear.
* Click on the little folder to the right of CD/DVD Image File then navigate to the newly created RCplus.iso Image file and click Open.
* In the CD/DVD Writing Speed drop-down menu choose the 8X setting.
* Under Format make sure that Mode 1 is selected.
* And finally, click on the Burn it! button to burn RCplus.iso to disk.


Once the disk is burned, put it in the machine you want to fix and restart it.
Boot to the CD just as you would with a Windows XP disk.
At the Welcome to Setup screen, press R to enter the Recovery Console.
Choose the installation to be repaired by number (usually 1) and press Enter.
When you are asked for the Administrator password, enter the password or leave it blank (default) and press Enter.

At the C:\Windows> prompt, type the following commands pressing Enter after each one. Note: Watch the spaces.

D:
cd i386
copy userinit.exe c:\windows\system32
exit


After putting in the third command, you should receive the message 1 file copied which will indicate that the operation succeeded.
Now take out the CD and reboot your computer to normal mode. Try to log in and it should let you back in.

Thanks to wannabe1

[rshaffer61]

Give this a try. Without knowing a little more about what caused the problem, I can't guarantee it will work...and it requires the machine you make the disk on AND the machine you are fixing are both running XP.

Please download RC.ISO and save it somewhere you can find it.
Also download MagicISO.

Start MagicISO. You should see a window informing you about the full version of MagicISO.
In the bottom right select Try It! and the program will open.
Click on File and then on Open and navigate to the RC.ISO file you downloaded. Select it, and click Open.

First, we'll need to add a clean version of userinit.exe to the current RC.ISO

* In the upper right pane, double click on the i386 folder.
* Right click in the upper right pane and select Add Files...
* Navigate to C:\Windows\System32 and select userinit.exe
* Then click Open to add userinit.exe to the CD image.
* Click File and select Save As...
* Name the file RCplus and save it somewhere you can find it.


Next, we'll need to burn the newly created image to a disk that we can use to fix the problem.

* Put a blank CD-R disk in your CD burner and close the tray. If an AutoPlay window opens, close it.
* Click on Tools and select Burn CD/DVD with ISO.... A window will appear.
* Click on the little folder to the right of CD/DVD Image File then navigate to the newly created RCplus.iso Image file and click Open.
* In the CD/DVD Writing Speed drop-down menu choose the 8X setting.
* Under Format make sure that Mode 1 is selected.
* And finally, click on the Burn it! button to burn RCplus.iso to disk.


Once the disk is burned, put it in the machine you want to fix and restart it.
Boot to the CD just as you would with a Windows XP disk.
At the Welcome to Setup screen, press R to enter the Recovery Console.
Choose the installation to be repaired by number (usually 1) and press Enter.
When you are asked for the Administrator password, enter the password or leave it blank (default) and press Enter.

At the C:\Windows> prompt, type the following commands pressing Enter after each one. Note: Watch the spaces.

D:
cd i386
copy userinit.exe c:\windows\system32
exit


After putting in the third command, you should receive the message 1 file copied which will indicate that the operation succeeded.
Now take out the CD and reboot your computer to normal mode. Try to log in and it should let you back in.

Thanks to wannabe1

[Beeracuda]

and it requires the machine you make the disk on AND the machine you are fixing are both running XP.

The computer I use here at work has Windows XP Professional (as opposed to XP Home on my computer at my house). Would this be compatible?

[rshaffer61]

It should work but I make no guarantee of that.
Here is another method to do this:


Put your winxp cd in cd drive and reboot your system
When prompted to push any key to boot to cdrom then click a key
Click R to enter recovery console

Type the following

expand d:\i386\userinit.ex_ c:\windows\system32
click enter

Once it says 1 file copied
Then type exit and click enter
System will reboot
Make sure to remove winxp cd before it boots up and let it boot fully
Windows should start normally

If not post with result

[Beeracuda]

Thank you very much for your help, rshaffer. I'll give your advice a try when I get home from work, and I'll post the results on Monday morning.

Thanks again, much appreciated!

[rshaffer61]

You are welcome and I will await the results on Monday. Good luck

[Beeracuda]

UPDATE:

I never did try your fix. I was able to find my old copy of Windows XP install disk, and loaded a new copy of Windows onto a secondary hard drive I have on my computer(F: drive). It took a long time to install, and it ran very slowly, but it was enough for me to be able to run Spybot - S&D and Malwarebytes software and scanned both C: and D: drives. It came up with 36 instances of malware infections. After the software fixed the errors, I was able to boot up Windows normally from my original C: drive. Much to my surprise, all data and files located on the F: drive were restored to how it was before the infestation happened, despite the Windows warning of "all files will be erased" just prior to installing the secondary version of XP.

So back to normal again. Thank you so much for your help rshaffer!

Edited by Beeracuda, 07 December 2009 - 06:23 AM.

[rshaffer61]

It came up with 36 instances of malware infections

I'm willing to bet you are still infected. I suggest you go to the Malware Removal and Spyware Removal Forum and run all the steps located in the
START HERE. These self-help tools will help you clean up 70% of problems on your own.
If you are still having problems after doing the steps, then please post the reguested logs in THAT forum.
If you are unable to run any of the tools then start a new topic in the malware forum and put this in the subject line...I am unable to run any malware tools

If you are still having problems after being given a clean bill of health from the malware expert, then please return to THIS thread and we will pursue other options to help you solve your current problem(s).

Add a link to this topic so that malware tech can see what steps have been taken here