XP Repair when Explorer is corrupted

[Doz]

Trojan.Bamital.GEN Found in = Winlogin
Trojan:Win32/Bamital.E Found in = Explorer.exe

My Spyware Doctor Anti-Virus version 8 found both of these Trojans and removed them
It asked me to reboot so it could remove the Trojan and I said OK

That is where the fun started

Upon reboot I saw a black screen and computer goes into a constant reboot / black screen loop

I was like OMG do I need to format. NO

XP REPAIR to the rescue


Here is a site that has info on how to perform a XP Repair in steps with pictures

link = http://pcsupport.about.com/od/operat...txprepair1.htm

I suggest you use a another computer or laptop to view this page as you XP Repair the computer with the issue.
1. You will need your OEM XP CD
2. You will need XP Key because during to the repair it will ask for it.

Follow the 20 steps on the link I have provided to help you.

Note XP repair will replace all the Window files and put them back to original.
When you complete the XP Repair, you will need to UPDATE.
You have IE6 and Windows Media player 9

Note if you have an XP SP1 or XP SP2 CD then you should use a 2nd computer and download XP SP3
You can burn it to a CD or put it on a Ext HD or Thumb Drive.

Here is a link for XP SP3 = http://www.microsoft.com/downloads/e...displaylang=en


Special note on what happen to me after XP Repair

After reboot and I went to run Windows Update and received and error.
I could not update the computer.

Here is the FIX

You need to download IE8
Here is a link for IE 8 download = http://www.microsoft.com/nz/windows/internet-explorer/

After I downloaded IE 8 and installed, it asked to reboot.
I was then able to run Windows Update

After I got all of the Window Updates
1. Run Registry cleaner
2. Defrag HD

Note if you want Windows Media player then go to Windows Update and run Custom scan and you will see more options.

[Doz]

Note It looks like my winlogin was wiped out and the black screen reboot is back.

STOP: c000021a {Fatal System Error}
The Windows Logon Process system process terminated unexpectedly with a status of 0xc0000034 (0x00000000 0x0000000)
The system has been shutdown.


Nothing will work Safe mode, last known, NOTHING

I have a USB SATA docking station so I can pull the HD out of the computer to search for files.

I have confirmed that Winlogin is gone from my Problem computers HD and it looks like Spyware Doctor Anti-Virus aka SDA has removed it since it found a Trojan in it.
winlogin is located in c:\windows\system32

Note search for > win and you will see winlgoin

I copied winlogin from another computer with same OS that is fully updated.

The problem computer boots up and works perfect.

The problem is after shut down it will not reboot. I look at Winlogin is gone.

This could be problem since SDA has Winlogin quarantine

I will post the update on how I fixed it

[Doz]

I have it back up working after updating the Graphic Driver.



Note I did some Google searches and found some good info


1) run PC from Win XP installation disk
2) on 1st screen of installation process choice ‘R’ and then choose path (default 1), confirm and type yr admin password

3) go to Win XP installation disk (default e: drive) and then go to e:\i386\ dir

4) copy and replace files csrss.exe, win32k.sys, winlogon.exe and msgina.dll in c:\windows\system32 by these once in e:\i386\ dir (just remember that files in e:\i386\ dir have diff extensions, so to copy use comand eg. (when yr current dir is e:\i386\) copy msgina.dl_ c:\windows\system32\msgina.dll)

5) after that its done, you can restart PC.


Go to start/run and type in “sfc /scannow" (without the quotes)



More Info that might help you

Rebooted the system and continued pressing F8 –> got a screen that allowed for a F1: Boot –> did the F1 and continued pressing F8 and got the Safe Mode screen –> selected the Last Know Good Configuration and repeatedly pressed Ctrl+Shift+Esc sequence –> Windows XP loaded correctly! –> opened the C drive –>windows folder –>system32 folder –>restore folder –> and started the rstrui application –> selected a date prior to the download of the bad files –> and now the problem is all gone




More Info that might help you
From James

I hope this helps. All Blue Screens are NOT fatal and unrecoverable. In fact, most of the time when they are not the result of a hardware error or bad disk driver, you get around them by booting into Safe Mode or Safe Mode with Command Prompt. It’s worth noting that the ability to do so is the first clue that your problem is most probably software / operating system and not hardware.
If you ARE able to get into safe mode, there’s a good chance that you are dealing with one of the following:

a: A corrupt file, insert your particular flavor of file corruption here. If that’s the case, start by doing the following while in Safemode:

1. Run “chkdsk /f on all drives” from a command prompt.
2. Defragment your partitions. A file can become so fragmented as to be corrupt and a simple Defrag can fix this.
3. Run MSCONFIG and disable half of the items loading on Start Up. Then reboot. If the system boots normally, the problem is probably one of the items that you disabled. In that case, continue enabling half items and rebooting until you find out which one it is.

b: A bad driver or driver install. When you have a bad driver or driver install, you can use a reg hack to start the installer service and uninstall the offending driver(s) to get the system stable again. You will need stable drivers to reinstall. I’m sure you can figure out where to get those.

This is the reg hack to start Windows Installer Service is:

REG ADD “HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\ Minimal\MSIServer” /VE /T REG_SZ /F /D “Service”
net start msiserver

REG ADD “HKLM\SYSTEM\CurrentControlSet\Control\Network\M inimal\MSIServer” /VE /T REG_SZ /F /D “Service”
net start msiserver

c. A virus or software product loading during the boot or logon process that is causing a memory instability. Don’t forget to check for driver and software service set to Autostart. If it is a virus, then booting with an anti-virus boot disk should fix it.

One last thing: I have a friend who was getting a BLSOD on boot up. It turned out that he had a bad network driver and a corrupted anti-virus install. To fix it, I had to uninstall both in safe mode, then reinstall them after a reboot. I just found out that he has been overclocking again. For those of you who are overclocking, remember that Bluescreens are usually the first sign that you have been pushing your hardware beyond its limits. You might want to reduce your processor speed and try to reinstall before you decide you have bad hardware to replace.

I hope this helps,
James Carey
MCP, MCSE, MCSE+I, A+, Network+, Compaq APS, HP APS



NOTE Please share Knowledge for it makes a better world

[Doz]

WinLogon.exe application errors are a common occurrence for many users of Microsoft Operating Systems such as Windows XP, Windows Vista or Windows 7. These application errors can happen for a number of reasons, usually as a result of virus, trojan or other kind of malware infection or system file damage due to faulty hardware, especially RAM or HDD. Winlogon.exe is a crucial system component that handles the login and logout procedures so such errors can completely disrupt the stability of your PC!
Symptoms of Winlogon EXE Error
You are getting a "winlogon.exe has encountered a problem and needs to close" or a "The instruction at (location) referenced memory at (location). The memory could not be read/written" error message, most likely during the operating system startup. The computer crashes or restarts automatically after that. Don't worry, there is hope yet.
How to Fix Winlogon EXE Error
1) The easiest and fastest way to fix Winlogon.exe errors is to use the System File Checker which is integrated in all modern versions of Windows. To do that, press Start > Run and enter "SFC.EXE /SCANNOW" (no quotes) and press Enter. You may need to run it as administrator in Vista. You might also need to insert a Windows CD so the SFC program could copy over the files that need replacing (if your system32dllchache folder doesn't already contain them all).
Note that while this may as well fix the Winlogon.exe error, the cause of it (such as virus or other malware) will still stay in your system. System File Checker does not remove viruses!
2) Restart your computer and press F8 on load to enter Safe Mode. This starts your OS with only the barebone services and no unneeded stuff. After booting Windows in Safe Mode, use an antivirus scanner to thoroughly scan your computer. Use an antispyware scanner for a good measure as well.
3) In case the above steps fail, you can always do a Repair routine for your Windows installation. To do that insert your Windows CD and restart your computer (make sure CD-ROM or DVD-ROM is set as the first boot device in your BIOS). Press Enter when prompted to enter the setup. Press F8 to accept the terms. Once inside, use the keyboard keys to navigate to your existing installation and press "R".
Note that this should be your last resort as Windows Repair will overwrite your registry, causing most installed programs to cease working!
Remember that keeping your PC secure by doing frequent updates and always running an antivirus monitor and a firewall at all times will minimize the chance of Winlogon.exe application errors occurring in the future. Research all software before installing it and don't trust pirated copies.




Doing a little research to help others