0xc0000005 userinit error on startup

[netRAT]

Hi all,

I'm trying to help out a mate with his laptop. The machine is (was) heavily infected with malware and cannot access Windows now (XP Pro SP2).
What had happened was I ran a scan using SuperAntispyware and it found heaps of stuff including many Vundo variants. Once completed I restarted the computer and now I'm getting the dreaded 0xc0000005 userinit error on startup.
I researched this issue and although it seems to be quite common I cannot get it fixed because:

1. Cannot access safe mode
2. Cannot run task manager
3. Registry info under:
Local_machine/software/mircosoft/windowsNt/currentversion/winlogon/
seems to be correct:

Shell=explorer.exe
Userinit = C:\windows\system32\userinit.exe,

I'm using ERD boot disk to mount the OS registry.

Is there something else I can do?

Cheers,

netRAT

[netRAT]

Please guys...is there anything that can be done to revive this system?

If I could only log on to Windows I'm sure I'd be able to take it from there...

netRAT.

[Blade81]

Hi

Download and install TrendMicro HijackThis (http://www.trendsecure.com/portal/en-US/_download/HJTInstall.exe)
* Once installed open HijackThis by clicking Start > Programs > HijackThis and click the button labeled
Do a system scan only

* Click the scan button in the lower left hand corner of the interface and HijackThis will quickly scan your system.
* Once the scan is complete the scan button will now read save log. Click this button to save the log file to your PC. Once you select where you would like to save the file it will open in your systems default text editor. Typically this application is Notepad. Post the log here.

PS. You may need to rename HijackThis.exe -> somethingElse.exe to make HijackThis work.

[Blade81]

Due to inactivity, this thread will now be closed.

Note:If it has been five days or more since your last post, and the helper assisting you posted a response to that post to which you did not reply, your topic will not be reopened. At that point, if you still require help, please start a new topic and include a fresh HijackThis log and a link to your previous thread.

If it has been less than five days since your last response and you need the thread re-opened, please send me or MOD a private message (pm). A valid, working link to the closed topic is required.