system config. utility problem

On Dec 17, 1:44*pm, "Marcy" wrote:
Hi Jose,
(1)To answer your first question in the last post, "Let me make sure I got
this straight... *You modified your boot.ini
using msconfig and then could not boot in any mode. *You used RC to rename
your
boot.ini, booted successfully, fixed the boot.ini issue, ran AVG and then
got
stuck in the login cycle?
Answer: YES. After I did AVG, I rebooted and got stuck in the login
cycle....

(2) While in the RC (from my cd), I do see, in C:\Windows\system32, *both
the userinit.exe AND winlogon.exe.
I tried numerous ways to rename both of them. Here are ways I used and their
outcome:...

C:\ren c:\userinit.exe userinit.old
*"The system cannot find the file or directory specified"

C:\cd\attrib -shr userinit.exe ren userinit.exe userinit.bak
"The command is not recognized. Type HELP...., etc"

I even did it like this (since I was not sure from which are to do the
renaming)..
C:\Windowscd\attrib -shr userinit.exe ren userinit.exe userinit.bak
C:\Windows\System32cd\attrib -shr userinit.exe ren userinit.exe
userinit.bak

***** and***
C:\Windowsren c:\userinit.exe userinit.old
C:\Windows\System32ren c:\userinit.exe userinit.old

I did the same using the winlogon.exe and got the exact same outcome..both
times.
So either I did something wrong in trying to rename or something. But I do
see both the userinit.exe and winlogon.exe in the
C:\Windows\System32directory.

I am sorry I could not go further in your directions.....
I hope you want to continue with this. If not, I totally understand.
Thanks, Marcy

So, I could not go any further with your instructions...

-- __________________________________________
Thanks so very much for your help-! ! ! !"Jose" wrote in message

You are c: happy. Stop putting c: in front of everything - that is
what got you mixed up before!

When you start RC you are in the C:\WINDOWS folder which is correct.

You need to do your ALL your work in the C:\WINDOWS\SYSTEM32 folder.
The prompt should be something like:

C:\WINDOWS\SYSTEM32

First, rename the files you want to replace:

ren userinit.exe userinit.old
ren winlogon.exe winlogon.old

Reboot RC and get back into the c:\windows\system32 folder, make sure
the files you want to replace are really gone and then expand the
replacements from your installation CD (all this from within c:\windows
\system32)

expand d:\i386\userinit.ex_
expand d:\i386\winlogon.ex_

The messages should tell you the expand worked.

Now, see if there is a file in c:\windows\system32 called
wsaupdater.exe. If there is a wsaupdater.exe, copy userinit.exe over
the top of wsaupdater.exe and we'll fix the rest later.

Hopefully I made no typos. You get the idea though - in c:\windows
\system32 you want to replace the two suspicious files by renaming
them, rebooting, expanding the two replacements from your XP CD... Do
the appropriate dir commands to make sure the files get renames,
copied, expanded, etc as you go.

Remove the CD and see how rebooting/logging in on the HDD looks now.

On Dec 17, 1:44*pm, "Marcy" wrote:
Hi Jose,
(1)To answer your first question in the last post, "Let me make sure I got
this straight... *You modified your boot.ini
using msconfig and then could not boot in any mode. *You used RC to rename
your
boot.ini, booted successfully, fixed the boot.ini issue, ran AVG and then
got
stuck in the login cycle?
Answer: YES. After I did AVG, I rebooted and got stuck in the login
cycle....

(2) While in the RC (from my cd), I do see, in C:\Windows\system32, *both
the userinit.exe AND winlogon.exe.
I tried numerous ways to rename both of them. Here are ways I used and their
outcome:...

C:\ren c:\userinit.exe userinit.old
*"The system cannot find the file or directory specified"

C:\cd\attrib -shr userinit.exe ren userinit.exe userinit.bak
"The command is not recognized. Type HELP...., etc"

I even did it like this (since I was not sure from which are to do the
renaming)..
C:\Windowscd\attrib -shr userinit.exe ren userinit.exe userinit.bak
C:\Windows\System32cd\attrib -shr userinit.exe ren userinit.exe
userinit.bak

***** and***
C:\Windowsren c:\userinit.exe userinit.old
C:\Windows\System32ren c:\userinit.exe userinit.old

I did the same using the winlogon.exe and got the exact same outcome..both
times.
So either I did something wrong in trying to rename or something. But I do
see both the userinit.exe and winlogon.exe in the
C:\Windows\System32directory.

I am sorry I could not go further in your directions.....
I hope you want to continue with this. If not, I totally understand.
Thanks, Marcy

So, I could not go any further with your instructions...

-- __________________________________________
Thanks so very much for your help-! ! ! !"Jose" wrote in message

You are c: happy. Stop putting c: in front of everything - that is
what got you mixed up before!

When you start RC you are in the C:\WINDOWS folder which is correct.

You need to do your ALL your work in the C:\WINDOWS\SYSTEM32 folder.
The prompt should be something like:

C:\WINDOWS\SYSTEM32

First, rename the files you want to replace:

ren userinit.exe userinit.old
ren winlogon.exe winlogon.old

Reboot RC and get back into the c:\windows\system32 folder, make sure
the files you want to replace are really gone and then expand the
replacements from your installation CD (all this from within c:\windows
\system32)

expand d:\i386\userinit.ex_
expand d:\i386\winlogon.ex_

The messages should tell you the expand worked.

Now, see if there is a file in c:\windows\system32 called
wsaupdater.exe. If there is a wsaupdater.exe, copy userinit.exe over
the top of wsaupdater.exe and we'll fix the rest later.

Hopefully I made no typos. You get the idea though - in c:\windows
\system32 you want to replace the two suspicious files by renaming
them, rebooting, expanding the two replacements from your XP CD... Do
the appropriate dir commands to make sure the files get renames,
copied, expanded, etc as you go.

Remove the CD and see how rebooting/logging in on the HDD looks now.

Marcy wrote:
I did see a
suspicious/malware file in there with a similar name,
winupdate86.exe.

FYI:

http://www.bleepingcomputer.com/star...exe-25303.html

Marcy wrote:
I did see a
suspicious/malware file in there with a similar name,
winupdate86.exe.

FYI:

http://www.bleepingcomputer.com/star...exe-25303.html

On Dec 18, 1:02*pm, "Marcy" wrote:
Thanks Jose:
I did the rename of :
ren userinit.exe userinit.old
ren winlogon.exe winlogon.old

I rebooted back into RC and got back into the c:\windows\system32 folder.
The "exe" files I renamed were gone (only the newly renamed "old" were
there).
So I went on your next step-to expand. I did:

expand d:\i386\userinit.ex_
expand d:\i386\winlogon.ex_

The messaged stated it worked..

I went to see if there is a file in c:\windows\system32 called
wsaupdater.exe. *Wsaupdater.exe was NOT there. I did see a
suspicious/malware file in there with a similar name, winupdate86.exe. But
no executable file that had exact letters of wsaupdater.exe

*Ironically, I noticed when searching for the wsaupdater.exe that BOTH the
userinit.exe AND userinit.old, plus *the winlogon.exe AND winlogon.old were
there. Was that supposed to happen?

I was not able to go further to this next step....
"If there is a wsaupdater.exe, copy userinit.exe over
the top of wsaupdater.exe" and we'll fix the rest later.
**Note that I would not know how to do this Copy part anyways, so when this
next step comes, unfortunetly i would need more step by step to avoid
messing up.
***Note that for some reason, when starting my pc this morning for the first
time, my machine did not want to read/start up the cd disk. I went to BIOS


Still in the system32 folder ...

You renamed the userinit and winlogon. Then you expanded replacements
from the CD to that gives you a .old (the old one) and a .exe (the
expanded one). You are doing fine.

Sounds good so far except for the winupdate86.exe. I somehow got
stuck on thinking winlogon - that indeed appears to be malware and so
rename it to something else, reboot... Thanks to Daave for the
reminder. It presents other symptoms while you are running, but it
should not be there. The Internet seems to tell you about it and what
it does, but not too much what to do about it. Check if you have
winlogon86.exe, and if so rename it too.

You could till have the wsaupdater issue so if the same symptoms, copy
the userinit.exe to wsaupdater.exe, reboot...

We need to know what happens on the two reboots.

We just need to get you running and back on the Internet so you can
run MBAM and SAS, then fix any residue.

On Dec 18, 1:02*pm, "Marcy" wrote:
Thanks Jose:
I did the rename of :
ren userinit.exe userinit.old
ren winlogon.exe winlogon.old

I rebooted back into RC and got back into the c:\windows\system32 folder.
The "exe" files I renamed were gone (only the newly renamed "old" were
there).
So I went on your next step-to expand. I did:

expand d:\i386\userinit.ex_
expand d:\i386\winlogon.ex_

The messaged stated it worked..

I went to see if there is a file in c:\windows\system32 called
wsaupdater.exe. *Wsaupdater.exe was NOT there. I did see a
suspicious/malware file in there with a similar name, winupdate86.exe. But
no executable file that had exact letters of wsaupdater.exe

*Ironically, I noticed when searching for the wsaupdater.exe that BOTH the
userinit.exe AND userinit.old, plus *the winlogon.exe AND winlogon.old were
there. Was that supposed to happen?

I was not able to go further to this next step....
"If there is a wsaupdater.exe, copy userinit.exe over
the top of wsaupdater.exe" and we'll fix the rest later.
**Note that I would not know how to do this Copy part anyways, so when this
next step comes, unfortunetly i would need more step by step to avoid
messing up.
***Note that for some reason, when starting my pc this morning for the first
time, my machine did not want to read/start up the cd disk. I went to BIOS


Still in the system32 folder ...

You renamed the userinit and winlogon. Then you expanded replacements
from the CD to that gives you a .old (the old one) and a .exe (the
expanded one). You are doing fine.

Sounds good so far except for the winupdate86.exe. I somehow got
stuck on thinking winlogon - that indeed appears to be malware and so
rename it to something else, reboot... Thanks to Daave for the
reminder. It presents other symptoms while you are running, but it
should not be there. The Internet seems to tell you about it and what
it does, but not too much what to do about it. Check if you have
winlogon86.exe, and if so rename it too.

You could till have the wsaupdater issue so if the same symptoms, copy
the userinit.exe to wsaupdater.exe, reboot...

We need to know what happens on the two reboots.

We just need to get you running and back on the Internet so you can
run MBAM and SAS, then fix any residue.