pc wont start - xp home

confetti

hello,

my friends pc (with XP home edition) won't start up,

just before the login screen should appear the folowing messages comes up,

winlogin.exe - bad image

the application or dll c:\windows\system32\odbcint.dll is not a valid windows image

please check againsts installation deiskette

the when you click ok


user interface failure
the logon user interface dll msgina.dll failed to load

contact your systme administrator to replace or restore the original dll

and there's a button to click which says restart

if you click it or close it X then is just al starts again

****************************************
any easy way to fix this? ive googled it and apparently its somethign that happens after installing a service pack or something but i know they have not done anything like this as its not used for internet much,

they dont have a bootable windows cd either so what are the options??

Karoma

Can you boot into Safe Mode? (Tap F8 on boot-> Safe Mode)
Also, double-check the spelling of the error messages reported,please and confirm spelling. (For instance "winlogin.exe")

confetti

i tried last night to boot in safe mode, and i also tried to boot with last kown good configuration, both ended in the same thing, resulting in a restart

im pretty sure i got the spelling right as i wrote it down and copied it into my previous post

atheist

I believe you have a virus.
The problem will be cleaning the infected hard disk.
You will need an os that will boot from CD, network or USB key that understands the file system and can run a virus scanner and edit the registry to manually clean after the virus is identified. Or move the hard disk into another machine as a secondary disk.
You will have to pay a fortune as this work is time consuming. Ask for a backup to be made to dvd first so when you cut your losses and do a clean install you can get back some of your documents and music.
Note that with the best retrospective backup you will likely loose contacts, files protected by drm (you didn't know media player did that did you).

The quickest fix may be an over the top install, boot to safe mode and run stinger, update everything, use lavasoft, spybot etc to scan for nasties, use housecall and commercial av to do same etc

confetti

crap!

no i didn't think it was that serious,

i could put the hard drive into my own pc and do a virus check on it??

if that worked and i replaced it in its own machine would things be back to normal or do you reckon i will have two sick pcs on my hands??

MunsterCycling

Update your virus software first, install disk into your own machine as a slave drive and scan the disk with your virus software. Next step, providing it comes up clean is to copy off the files that are important to your friend (this means no software, you can just reinstall that if needs be) onto either a cd or your own HD.


Then you can try to re-install the file in question and then put it back in th emachine and reboot, hopefully it should work.


MC

confetti

right ive eventually updated my virus scan, put the other drive into my pc and done a complete scan, the other drive turned up lots of adware-not virus stuff and one trojan virus,

all gone now,

i assume its not as simple as replacing in its home pc and it will work?

can i copy system files from my pc into the other harddrive as we both run xp home??

or will that completely mess up things, i.e Is there a login folder or something i can copy the important files ????????

atheist

Backup "Documents and Settings" but be aware that not all programs store their files and settings there.

Removing the Trojan will not reinstate the files it has mangled, part of the secure login sequence (SLS), so reinstating the hard disk is only the first step.

As previously requested, what is the specific virus or Trojan. After identifying it , you will need to follow the manual removal instructions. These may assume you are in the original OS, but you are currently in a parallel install, so you will need to use regedt32 to open the registry hives from the \windows\system32\config directory of the original install and correct problems with the registry, if that's what's happened.

Do you know which service pack was installed on the corrupted system? If having reinstated the hard disk, the system will not boot all the way, you will need a XP Home CD with SP2 slipstreamed, (first preference) with SP1 slipstreamed (second preference) or XP Home without a service pack (third preference) and do a repair install. Be careful not to reformat the hard-disk. By overwriting the SLS files you should be able to get further in. You are likely to get reinfected without the security patches so first priority is to reinstall all the updates, which will involve several reboots and a broadband connection.

nobodythere

winlogin.exe - bad image

the application or dll c:\windows\system32\odbcint.dll is not a valid windows image

Wait wait wait before you go mental reinstalling everything! Boot from your XP home CD and try to do a repair install. If that doesn't work try booting from the XP home CD and going into the recovery console (it's a menu option somewhere). Choose your windows installation and when you get to a command prompt, type (or whatever your CD drive letter is). Then:

> cd i386
> expand odbcint.dl_ C:\windows\system32\
> expand winlogon.ex_ C:\windows\system32\
> exit

Don't boot from CD next time round. This will replace the corrupted files with the files from the XP cd.

As the previous poster said, it would be very helpful to have XP with the correct service pack slipstreamed (i.e. files updated to the same version as is on your pc).

confetti

grasshopa wrote:

Wait wait wait before you go mental reinstalling everything! Boot from your XP home CD and try to do a repair install. If that doesn't work try booting from the XP home CD and going into the recovery console (it's a menu option somewhere). Choose your windows installation and when you get to a command prompt, type (or whatever your CD drive letter is). Then:

> cd i386
> expand odbcint.dl_ C:\windows\system32\
> expand winlogon.ex_ C:\windows\system32\
> exit

Don't boot from CD next time round. This will replace the corrupted files with the files from the XP cd.

As the previous poster said, it would be very helpful to have XP with the correct service pack slipstreamed (i.e. files updated to the same version as is on your pc).

this is what ill do so, hard to get my hands on a xp home cd, i never got one with my dell either, the scoundrels

nobodythere

You got a restore CD though that should do the trick (I think). Reformatting is a last resort

confetti

no never got a restore cd either.

would a bootable xp pro cd do the job or does it have to be the home edition?

nobodythere

Eh.... possibly.... The files would have to be identical to the XP Home ones, that's the problem.

Do you know anyone with XP home SP2 that you could copy the files off?

confetti

yeah me!

i have xp home on my pc but no cd.

i don't know what files to copy? the 'other' drive works fine as a slave so i could copy files to it but what??

thanks for your help by the way

p.s instead of a boot/restore cd off dell i got a piece of paper in the shape of a cd that says you do not need a system restore cd just use the system restore function refer to users manual.... some bull eh?

atheist

What was the smoking gun?

nobodythere

odbcint.dll
winlogon.exe
I'm trying to say that these two files are likely corrupt (damaged). There could be more problems, but replacing those files with the original versions is likely to fix it.

Some bull indeed. Guess we'll have to throw the XP CD idea out the fuinneog.

However it is actually possible to do a System Restore from DOS. Let's hope you have it enabled! Get yourself a disk that you can boot into DOS from (see bootdisk.com), preferably a Windows version of one. Once you boot from it, type

cd C:\windows\system32\restore       (PRESS ENTER)
rstrui.exe     (PRESS ENTER)

This should let you run system restore. Pick a date to restore to that will work. There is a chance however, that the boot disk won't be able to read your hard drive if it is stored in NTFS (i.e. it is an encrypted file system). In that case you'll need to get the bootdisk off bootdisk.com that can read NTFS or put it together yourself.

Pain in the ass isn't it Report back anyway.

confetti

i will give that a go so...


thanks again

confetti

right i tried replacing the winlogon.exe adn odbcint.dll from my system onto the other one but it didnt work, it kept restarting before the logon screen as before.

But i did get a system restore disk which seems to be compatible.

it still wont boot from cd though, restarts as usual.

it will setup and ask me if i want to reinstall or go into revovery console.

so i went into recovery and did that i386 expand thing above and restarted from the harddrive this time. same thing was still happening.

so where does this leave me?

-is there anything else in recovery i can try?

-or do i have to seect reinstall ?
-if so will this wipe the drive or just the software installed?

at least i have an xp cd now so something at least is gonna the hit the fan.

nobodythere

A reinstall would wipe everything clean as the setup would delete the partition table.

What you can try however is the XP repair thing on the CD. Instead of pressing R (I think) to go into the recovery console, you should be able to press enter and let it do an automatic repair, try here http://www.michaelstevenstech.com/XPrepairinstall.htm

If that doesn't work.... I say just give up, back up, and start over.

atheist

Hi Confetti

You have a couple of choices.

As you are not following my instructions on your own head be it. More problems are caused by immature recovery than the original problem.

When you "Removed" the trojan the scanner you used checked the registry and file system, and as you pointed at the files on the problem disk it found the trojan but it could not scan the registry of the problem system as it was not loaded. I wanted to know the specific exploit so as to advise on manual removal.

First choice - do you want to tell us what the trojan was or keep secret that it was dancinglesbians.exe

The second method (to use in combination with above) to find out what happened is to reinstate the drive as a slave in a working system and run eventvwr and use it to open the system and application logs (highlight application log, right click, open log file, browse to the \windows\system32\config directory of the slave drive) of the problem system.

With what errors did the cascade of problems begin? Use eventid.net to interpret the messages. It should also give information about the corrupted files rather than working from memory you can print out the messages.

Do you trust that backup that you made? It would not have included the files above from which a root cause diagnostic could be attempted.

If you have a backup that YOU trust (I don't care) you could repair windows choosing to leave the existing file system intact. But the entries the trojan made in the registry (where most of your friends preferences are stored) that could reintroduce the problem. Or gung ho reinstall cleanly and recover what's being backed up.

Re-read my second posting.

It would help if you had the correct CD as the difference between Home and Pro is the latter can log into domains. I would not expect one wrong version of winlogon to be sufficient - a bunch of files work together to make the Secure Logon Sequence and windows will shutdown if it believes this has been compromised.

Help us help you.

confetti

GRASSHOPPA --- I was able to do the repair install, seems to have worked, booting ok from hard drive now. hopefully it will stay this way. thanks for all your help.

ATHEIST -- thanks for the help but i don't understand half of what you're on about but thanks anyway