I have a virus on my Dell Inspiron 530. My son was downloading a movie and it had a virus embedded in it.
Once I saw what was happening, I immediately stopped the movie from loading and ran a virus scan with AVG since AVG alert windows were popping up everywhere informing me of one virus after another.
I have tried normail startup and startup via Safe Mode, Safe Mode with Networking, Last Known Good Configuration, and even Directory Services Restore Mode, and none of those work. These were done with and without the assistance of Dell's On-Call support, of which I was told by a rep that I did not have an On-Call Contract, even though I know for a fact I do, but for whatever reasons it's not showing up in my account.
Even after starting up normally, the computer goes through the entire motions of booting up in normal mode, then a window appears telling me this after clicking on my account name:
"Userinit.exe - Application error.
The application failed to initialize properly (0xc0000005). Click OK to terminate the application."
When I do this, it goes to my desktop, and that's it. No icons. I can't access the Start Menu via the keyboard, and I can't bring up the Task Manager.
I really don't want to reload anything as I'll end up losing everything I have on the hard drive. Can someone direct me as to what exactly needs to be done in order to return my computer back to its original working order? Thank you.
First off stay off the phone with Dell unless you are looking for more problems. You will get the answer to your problem here or on another tech forum.
Correcting this may get involved, but first understand a few things. There are different viruses/nasties and variations of them. First identify the name of the nasty and try to locate a removal tool for it. Go to the anti virus program you are running and see if they have a removal tool for it. Google the name of the virus if you can't come up with a removal tool from the nasty.
The only way to do a thorough nasty scan is with System Restore Disabled but if you disable it you will lose all restore points so keep that in mind. If it were me I would disable it and start checking.
I don't recommend making any system adjustments or installing any software until this issue is corrected. But you may need to download, Install and run a few utilities in order to check that pc out.
Run a Normal Start-Up
Empty the contents of the Temp Folder and Temporary Internet Files Folder.
Check the list of Add/Remove programs to see if anything is installed that does not belong there, if so delete them.
To learn more about a specific nasty you can Google it, or go to the website of an anti virus program and they will have information about it probably. I suggest that you do the following either before or after running a removal tool if there is in fact one available.
Download, install and run Kaspersky's on line scanner and follow their instructions.
Download, install and run F Secure Black light and follow instructions.
See to it that you have the following free utilities installed and fully updated, then run all of them from safe mode:
AVG Anti Virus (only run one anti virus program)
Malwarebytes
Adaware 2008
Spybot S&D
CCleaner
Spyware Blaster
Zone Alarm (only run one firewall program) (you don't run this from safe mode)
Once this PC is known to be clean make sure you have the latest Service Pack Installed including all of the current Critical Up-Dates.
Also suggest that you check your browser security settings.
Once all this is completed and the PC is known clean, enable System Restore and then create a new Restore Point.
Then go back to the Selective Start-Up if that is the way you had it set. Reboot.
If this does not correct the issue or even if it does, you may want to run a HJT scan and post the resulting log here or elsewhere for a review and suggestions.
Message Edited by BrickYard on 08-03-2008 06:44 AM
Please do not disable System Restore at this point.
QUOTE:
See to it that you have the following free utilities installed and fully updated, then run all of them from safe mode: Malwarebytes Adaware 2008 Spybot S&D CCleaner Spyware Blaster Zone Alarm (only run one firewall program) (you don't run this from safe mode) AVG Anti Virus (only run one anti virus program)
Please do not try to install all that stuff right now. It will only make matters worse, and will probably freeze the computer.
Fortunately you already have AVG.
Transfer it to the infected computer. Run a scan.
Close all open windows except HijackThis.
Click on "
Do a system scan and save logfile" When the log pops up in Notepad copy and paste that file as a NEW MESSAGE on the HijackThis Board.
Transfer the .txt log from the scan to a good computer to post it.
Posting Your Log:
1. Just click the New Message button in the HijackThis forum here:
http://www.dellcommunity.com/supportforums/board?board.id=si_hijack to start your own thread requesting assistance.
2. In the Message Body window that opens, simply Right-Click and select Paste.
3. Please add text to describe your symptoms.
4. Include in the message subject line a description of your problem. For example, "Popups warning of infection".
5. Make certain you post the entire log by clicking the Preview Post link at the bottom of the window and comparing it to the log from your scan before you click Submit Post
** Note: "The box next to Automatically convert carriage returns to HTML line breaks" should be checked if that appears at the bottom of your Message Body when composing your post.
* DO NOT have Hijack This fix anything yet. Most of what it finds will be harmless or required.
I thank you both for your replies, however....I cannot access anything on my computer. Right now, all I'm looking at on my computer screen is my desktop wallpaper. I have no icons, no taskbar, nothing. I can't even bring up the Star Menu via the keyboard as previously mentioned.
I did Google the "The application failed to initialize properly (0xc0000005). Click on OK to terminate the application" message I keep receiving, and this seems to be the solution at nearly every tech message board for others who have encountered the same problem as me:
"Boot using your winxp cd. Enter recovery console. at the command prompt go to
C:/windows/system32
next type: Dir *.exe
Do you see wsaupdater.exe
If so, type
copy userinit.exe wsaupdater.exe
Exit and reboot normally. You should now be able to logon.
Run regedit
Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\
In the right pane, you should see
C:\WINDOWS\System32\wsaupdater.exe,
Change it so that it reads:
C:\WINDOWS\System32\userinit.exe
That should solve the problem, if the malware was the one that caused the issue."
I tried this, but to a point. I inserted my Windows XP disc that was sent with my Dell computer, and once I did that it started installing (or, re-installing) Windows. Seeing as how I was afraid I was going to lose everything that I had previously saved on it, I ejected the disc only about 1 minute into the process. I haven't seen anything appear on my screen as it explains in the solution above. So, here I am, stuck. I have no idea how to get this problem solved. I am nowhere near tech or repair status. My knowledge is extremely minimal.
It may come to a point at which you have no choice but to repair, and if you lose files in the process, there isn't much you can do about it.
Exception code: 0xC0000005 means that Windows is only reporting the kernel error on behalf of an unknown process exception.
Regarding the articles that you read, unless you were in that specific situation with C:\WINDOWS\System32\wsaupdater.exe, I doubt that procedure will fix your problem.
You are able to logon as Administrator? The Recovery Console does not perform a destructive reinstall of the machine.
Does selecting the "Recovery Console" from the Boot Menu take you to a logon menu where only an Administrator can login to conduct a REPAIR of the Operating System? Can you select REPAIR? What happens then?
Message Edited by Bugbatter on 08-03-2008 04:05 PM
BrickYard
2 Intern
•
501 Posts
641
0
Posted August 3rd, 2008 09:00
First off stay off the phone with Dell unless you are looking for more problems. You will get the answer to your problem here or on another tech forum.
Correcting this may get involved, but first understand a few things. There are different viruses/nasties and variations of them. First identify the name of the nasty and try to locate a removal tool for it. Go to the anti virus program you are running and see if they have a removal tool for it. Google the name of the virus if you can't come up with a removal tool from the nasty.
The only way to do a thorough nasty scan is with System Restore Disabled but if you disable it you will lose all restore points so keep that in mind. If it were me I would disable it and start checking.
I don't recommend making any system adjustments or installing any software until this issue is corrected. But you may need to download, Install and run a few utilities in order to check that pc out.
Run a Normal Start-Up
Empty the contents of the Temp Folder and Temporary Internet Files Folder.
Check the list of Add/Remove programs to see if anything is installed that does not belong there, if so delete them.
To learn more about a specific nasty you can Google it, or go to the website of an anti virus program and they will have information about it probably. I suggest that you do the following either before or after running a removal tool if there is in fact one available.
Download, install and run Kaspersky's on line scanner and follow their instructions.
Download, install and run F Secure Black light and follow instructions.
See to it that you have the following free utilities installed and fully updated, then run all of them from safe mode:
AVG Anti Virus (only run one anti virus program)
Malwarebytes
Adaware 2008
Spybot S&D
CCleaner
Spyware Blaster
Zone Alarm (only run one firewall program) (you don't run this from safe mode)
Once this PC is known to be clean make sure you have the latest Service Pack Installed including all of the current Critical Up-Dates.
Also suggest that you check your browser security settings.
Once all this is completed and the PC is known clean, enable System Restore and then create a new Restore Point.
Then go back to the Selective Start-Up if that is the way you had it set. Reboot.
If this does not correct the issue or even if it does, you may want to run a HJT scan and post the resulting log here or elsewhere for a review and suggestions.