Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

XP PRO not booting


  • Please log in to reply
10 replies to this topic

#1 ChaosDream

ChaosDream

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:11:30 AM

Posted 29 September 2009 - 12:49 AM

My Aunts computer got this windows police pro virust he other day.So she had me remove it from the system. Took me five hours but I got it. At least I thought I had. So we tried system restore but that didn't work. I went online and read that sometimes you have to do it in safe mode. I tried to go in safe mode but it wouldn't let me. I went online again and found another way to do it. It told me to go into mscnfg and click the box that says boot into safe mode, so I did it and this box pops up saying it can't do that.I hit ok and another box pops up saying the same thing, so I hit ok and it immediatly starts restarts the computer before I can unclick safe mode. It starts booting and goes to a list of options with safe mode at the top. I go to safe mode and hit enter, a list of stuff starts appearing and I think it's going into safe mode but it doesn't. Instead it starts the sequence over and keeps looping. Her computer is windows xp pro. A friend gave it to her so she doesn't have the installation cd or any boot disks.How do I fix this?It's driving me crazy. :thumbsup:

BC AdBot (Login to Remove)

 


#2 joseibarra

joseibarra

  • Members
  • 1,085 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Downstairs
  • Local time:02:30 PM

Posted 29 September 2009 - 05:57 AM

We need to take a look at a couple things, but you can't do much if you can't boot so get this working first, then fix it.
(sometimes this is the hardest part :thumbsup: )

You should first boot your PC into the XP Recovery Console using a bootable
XP installation CD or a bootable CD with the XP Recovery Console on it.

You can make a bootable Recovery Console CD by downloading an ISO file
and burning it to a CD.

The same XP Recovery Console commands can be run from the bootable
Recovery Console CD.

The bootable ISO image file you need to download is called:

xp_rec_con.iso

Download the ISO file from here:

http://www.mediafire.com/?ueyyzfymmig

Use this free and easy program to create your bootable CD:

http://www.imgburn.com/

It would be a good idea to test your bootable CD on the computer that is
working.

You may need to adjust the computer BIOS settings to use the CD ROM drive
as the first boot device instead of the hard disk. These adjustments are
made before Windows tries to load. If you miss it, you will have to reboot
the system again.

When you boot on the CD, follow the prompts:

Press any key to boot from CD...

The Windows Setup... will proceed.

Press 'R' to enter the Recovery Console.

Select the installation you want to access (usually 1: C:\WINDOWS)

You may be asked to enter the Administrator password (usually empty).

You should be in the C:\WINDOWS folder. This is the same as the
C:\WINDOWS folder you see in explorer.

RC allows basic file commands - copy, rename, replace, delete,
cd, chkdsk, fixboot, fixmbr, etc.

From the command prompt window run the chkdsk command on the drive where
Windows is installed to try to repair any problems on the afflicted drive.
Running chkdsk is fine to run even if it doesn't find any problems.

Assuming your boot drive is C, run the following command:

chkdsk C: /r

Let chkdsk finish and correct any problems it might find. It may take a long
time to complete or appear to be 'stuck'. Be patient. If the HDD light is
still flashing, it is doing something. Keep an eye on the percentage amount to
be sure it is still making progress.

Remove the CD and type 'exit' to leave the RC and restart the computer.

You do not have to adjust the BIOS again to boot on the HDD since the CD will
not be present.

The mediocre teacher tells. The good teacher explains. The superior teacher demonstrates.


#3 joseibarra

joseibarra

  • Members
  • 1,085 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Downstairs
  • Local time:02:30 PM

Posted 30 September 2009 - 05:09 AM

Part of a PM that I received, responded, etc.

I typed in chkdsk and the computer said nothing was wrong with the disk,but if I wanted to run chkdsk anyway then I should type in /p. I did this and it said the command is not recognized,type HELP for a list of supported commands. What should I do now? :thumbsup:


Did you successfully create and boot on the RC bootable CD? This needs to happen.

chkdsk displays the status of the drive
chkdsk /p checks the disk, reports problems but does not fix anything
chkdsk /r checks, reports and tries to fix problems (implies /p)

There is a space between the word chkdsk and the slash parameter.

I just add the chkdsk to eliminate the possibility of file corruption before going to the next troubleshooting step.

I would boot on the RC again and run chkdsk c: /r like the instructions said, then report back. If it finds nothing, that is good.

When that is done, we can continue to troubleshoot using commands available from the bootable CD.

Let's keep messages related to this issue in the forum so others can contribute ideas!

The mediocre teacher tells. The good teacher explains. The superior teacher demonstrates.


#4 ChaosDream

ChaosDream
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:11:30 AM

Posted 30 September 2009 - 07:03 PM

Ok,I got chkdsk to work and it scanned and repaired some errors,but the computer is still in a loop.What should I do next?

Edited by ChaosDream, 30 September 2009 - 07:03 PM.


#5 joseibarra

joseibarra

  • Members
  • 1,085 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Downstairs
  • Local time:02:30 PM

Posted 01 October 2009 - 06:41 AM

Very good.

If these directions are not clear, let me know so I can change them :thumbsup:

There is a malware that deletes, corrupts or replaces the c:\windows\system32\userinit.exe file.
The userinit.exe is the file that processes your login in regular mode or any kind of Safe Mode,
so if it is broken it creates an endless cycle of unsuccessful logon attempts in any mode.

It may also change your registry so instead of the registry pointing to userinit.exe, it points
to another file called wsaupdater.exe. Sometimes scanning programs can fix part of the problem
but the rest you have to do by hand.

It is popular enough for Microsoft to create a KB that describes the wsaupdater problem

http://support.microsoft.com/kb/892893

The following directions will cover more situations than the article, but you should read it to understand.

After booting on the Recovery Console and having run chkdsk /r successfully, you are in the
c:\windows folder, so change to the system32 folder:

cd system32

Check for the presence of both userinit.exe and wsaupdater.exe. They may be there or they may not,
but we need to know:

dir userinit.exe (post results - the file exists or it does not)
dir wsaupdater.exe (post results - the file exists or it does not)

No matter what you find, replace the userinit.exe from a copy elsewhere on your system anyway.

There is another copy of userinit.exe in the c:\windows\system32\dllcache folder so copy it into
the c:\windows\system32 folder.

From the c:\windows\system32 folder enter:

copy c:\windows\system32\dllcache\userinit.exe

You will get a message that says 1 file(s) copied or to overwrite the existing?, (choose (Y)es to
overwrite) and post back what happened - it either copied or it replaced userinit.exe.

The malware may have changed your registry to point to wsaupdater.exe, but a malware scan may
remove only the wsaupdater.exe file but the registry is still wrong and your system will still not boot until you
copy userinit.exe to wsaupdater.exe. We will fix this later.

Copy userinit.exe to wsaupdater.exe. Do not delete the wsaupdater.exe file if it exists, just copy the
userinit.exe file to the same name.

From the c:\windows\system32 folder enter:

copy userinit.exe wsaupdater.exe

Answer (Y)es if there is an overwrite prompt. Post the results - it either copied it or replaced it.

Make sure userinit.exe exists be entering:

dir userinit.exe (post results - it should exist)

Type exit to leave the Recovery Console, remove the CD and reboot.

If the wsaupdater.exe file existed, we need to check the registry to make sure it is okay,
but scan for malware first, and check/fix the registry later.

Download, install, update and do a full scan with these free
malware detection programs:

Malwarebytes (MBAM): http://malwarebytes.org/
SUPERAntiSpyware: (SAS): http://www.superantispyware.com/

They can be uninstalled later if desired.

The mediocre teacher tells. The good teacher explains. The superior teacher demonstrates.


#6 ChaosDream

ChaosDream
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:11:30 AM

Posted 02 October 2009 - 06:08 PM

The computer said that the userinit.exe file existed and that the wsaupdater.exedid not.I then entered copy c:windows\system32\dllcache\userinit.exe and the computer said it could not find the specified file.I'm guessing that's not a good thing. :thumbsup:

#7 joseibarra

joseibarra

  • Members
  • 1,085 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Downstairs
  • Local time:02:30 PM

Posted 03 October 2009 - 09:42 AM

It could be the malware has deleted the backup copy from dllcache or if you typed in what you posted, you have a typo.

Be sure you followed the directions exactly:

There is another copy of userinit.exe in the c:\windows\system32\dllcache folder so copy it into the c:\windows\system32 folder.

All this would be after booting on the RC and while the prompt says: c:\windows\system32>

copy c:\windows\system32\dllcache\userinit.exe

It may be in another place you can try to copy:

copy c:\windows\servicepackfiles\i386\userinit.exe

The mediocre teacher tells. The good teacher explains. The superior teacher demonstrates.


#8 ChaosDream

ChaosDream
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:11:30 AM

Posted 11 October 2009 - 06:07 PM

Whent back in and typed exactly what the printed instructions said and nothing.It still couldn't find the file.The I used the other path you gave me.The computer found and did everything you said up until I removed cd and rebooted.Instead of starting it continued it's loop.What was my typo?

#9 powerjuce

powerjuce

  • Members
  • 321 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:02:30 PM

Posted 11 October 2009 - 06:16 PM

hey ChaosDream
Follow the intructions here.
Then try rebooting...that should get you normal boot.

Edited by powerjuce, 11 October 2009 - 06:18 PM.


#10 joseibarra

joseibarra

  • Members
  • 1,085 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Downstairs
  • Local time:02:30 PM

Posted 13 October 2009 - 09:00 AM

I missed that msconfig safe mode thing in the first post... :thumbsup:

The mediocre teacher tells. The good teacher explains. The superior teacher demonstrates.


#11 ChaosDream

ChaosDream
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:11:30 AM

Posted 15 October 2009 - 12:58 PM

I'm in. :thumbsup: I've downloaded the malware program and ran it.Apparently I didn't remove everything from windows police pro.Malware is gone now,so are viruses,but I can't find the boot file to rename it and I still can't get into safe mode the normal way.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users