11 replies to this topic

[circlecthrift]

Hello all I have a customer that got AntiMalware 2009 and after running Malwarebytes the computer won't let you login.

I have tried to login in safe mode and as admin but to no avail, Everytime I try it just says logging on then within 2 seconds it is saving settings and logging off. I can't login in safe mode or anything. I removed the hard drive and put it in another computer as a slave. I ran Malwarebytes and it found 4 removed them, still same thing not able to login .I even ran my updated Avast. Thanks in advance

[sjpritch25]

Welcome to Malwarebytes !!!

Its a pretty easy fix, but you will need a cd burner and software to burn an ISO image. Let me know if its possible or not. Thanks

[circlecthrift]

I have both! thanks for the reply

[sjpritch25]

Go here to download a program to burn an ISO image
Make sure you choose the correct one.
http://isorecorder.a...isorecorder.htm
Ignore if one is already installed!!!!!


I need you to download and install MIcrosoft Recovery and Diagnostic toolkit from here
http://www.microsoft.com/downloads/details...;displaylang=en

It will create a folder in Program Files called something like Microsoft Recovery and Diagnostic Toolkit
Look for the following .iso image
erd50.iso

Use your cd burning software to make a cd image/iso or use this one


Example on how to use ISO Recorder v 2
http://isorecorder.a...n.com/HowTo.htm


Once you create the iso image, you will need to make sure your computer can boot to cd. Instructions here
http://www.computerh...es/ch000217.htm


Once everything is set up, reboot your computer. Stick the cd in immediately. press any key to boot from cd (if prompted).

Skip Network settings
Log in to your Windows Installation only!!!!!!!

Once your in the desktop
Click on Adminstrator tools
Look for Registry Editor
Open Registry Editor
Navigate to the following key
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon


Look for the following value
Userinit

It should look like the following

"C:\\WINDOWS\\system32\\userinit.exe,"

If not you will need to add the following to the value by right-clicking on Userinit and click on Modify
Type the following Must include the quotes

"C:\\WINDOWS\\system32\\userinit.exe,"


Click Ok


Reboot, take cd out and let me know if you can get into Windows. Thanks

At any point you have a question stop and let me know. Thanks.

[circlecthrift]

Still won't boot into windows.

[circlecthrift]

circlecthrift, on Feb 20 2009, 09:06 PM, said:

Still won't boot into windows. I forgot to mention I made the iso and everything in Winlogon was ok

[sjpritch25]

Okay well that tells me another thing

boot back into ERD commander and search for userinit.exe. Let me know if its found. I have a feeling it may have been deleted. Thanks

[circlecthrift]

found it in 3 different folders C:/WINDOWS/$NtServicePackUninstall$ C:/WINDOWS/Prefetch C:/WINDOWS/ServicePackFiles/i386 Thanks John

[sjpritch25]

yep figured as much. The copy in one of those folders should be clean. Copy it from their to the following folderds
C:\WINDOWS\system32
and
C:\WINDOWS\system32\dllcache

Reboot the pc and it should be fixed

[sjpritch25]

the best would be this one
C:/WINDOWS/ServicePackFiles/i386

[circlecthrift]

Spot on Everything worked out great. Thank you for your help Sipritch25 that was easier than I thought it would be. I guess anything is easy if you know what you are doing THANKS AGAIN "Props TO Sipritch25" Thanks John

[sjpritch25]

Well just tell your customer to send me a check!!!! LOL

I would suggest a scan with Kaspersky just in case.

Run an online virus scan called Kaspersky from HERE.

1. At the main page. Press on "Accept". After reading the contents.
2. At the next window Select Update. Allow the Database to update.
Note: If prompted to run or update your Java, then follow the prompts to do so. Kaspersky requires Java to run.
3. Once the Database has finished, under the Scan icon Select My Computer to start the scan. The scan may take a few minutes to complete.
4. Select Scan Report.
5. If any threats were found they will appear in the report
6. Select "Save error report as"
Then in the file name just type in kaspersky
Under "save as type" select text .txt
Save it to your Desktop.

Copy and post the results of the Kaspersky Online scan. If no threats were found then report that as well.