After successfully using ubcd4win version 3.22 to fix many viruses and malware on my friends Windows XP Home computer, the computer will not boot from the Hard Drive. The computer just cycles around the BIOS screen to the Windows XP Home screen over and over again. Any suggestions.

What is actually happening is that XP is set to automatically restart on critical errors... so first you will now need to manually change the setting that controls that behaviour so you will get a BSOD screen that may help you find out what is really wrong now...

Using UBCD4Win again... use the Remove Remote Regedit to edit the computers registry.... change the following value...

in HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\CrashControl ... look for the key named AutoReboot and change its value to 0 instead of 1. Repeat for each ControlSet... ie 002... 003 etc.

Now restart and write down the exact error that Windows gives.


There are two more likely scenerio's that has happened....

A critical Windows system file was infected and then cleaned when you performed the work and as a result the infected file removed. If so you must replace the system file with the exact same version that the system had installed at the time before the infection happened.

The malware listed itself in the registry as a critical system file so now Windows thinks its missing something it must have when in reality it isn't. This is more complex and there isn't an easy way to describe exactly what needs done since there are too many variables... Sometimes its as easy as removing the reference to the malware file and somethings not...

should be Remote Regedit

Sure, Kick a guy when he's tired.

Thanks for replying and thanks for your detailed explanation.

When you say "Remove Remote Regedit" why did you cross out "Remove".
I do not have the PC in front of me and I am not familiar with the UBCD4win program to know all of it's features. How is that done?

I do understand your ControlSet reference. Do I also do the same for the CurrentControlSet?

When you say "replace the system file with the exact same version that the system had installed at the time before the infection happened" how is that done?
I do not know what version was running in the computer when the problems developed.
Can I run UBCD4win and look it up the version on the machine ?

The other problem is that my friend is still looking for the Win XP installation CD. I hope she finds it. I was able to get another one from a friend who bought a new PC and was throwing the old PC out, because the motherboard fried. The CD that I now have is SP1a, I know can perform a slipstream if necessary.

I'm not sure how to replace the system file. I was planning to do a Windows Repair, is that the correct thing to do?

When I typed the instructions I had made a typo and typed remove instead of remote... one of the other mods or dev team corrected my mistake but left the original wording there so others would understand their post... I guess you didn't read their posts???

The CurrentControlSet is mapped to the users ControlSetXXX version... since you won't be logged onto that Windows Registry... there won't be a CurrentControlSet mapped.

Which version of the file that may be missing ( you don't sound like you know that it was a Windows file yet or the malware that inserted itself into Windows ) ... will depend on what updates the computer had at the time. There is no simple answer on this and no way to give a general direction...

You must first identify what is missing before you can look into what direction to take.

OK, after I fix the ControlSet's, I'll try to boot the machine and hope it will boot or tell me what files are missing.
I'll post the results as soon as I can get over there to work on the PC.
Thanks again!

You were right, when I changed the remote Regedit HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\CrashControl AutoReboot to 0 and it booted to the hard drive.
Unfortunately, I got a Blue screen, like you said I probably would with the below error:

STOP: c0000021a {Fatal System Error}
The Windows Logon Process System process terminated unexpectedly with a status f 0xc000034 (0x00000000 0x00000000) The System has been shut down

Can you recommend a course of action! I have read a lot of ideas about a fix for this, but I don’t want start down the wrong road to only have to turn around and do something else.

Thanks for your help!

I'd probably first hope for an easy solution ... but there is a good chance that the malware may have already blocked this from working...

Use the Registry Restore Wizard to restore a registry from a time earlier than the original attack/infection happened...

If none of the actual Windows files were infected AND the above is able to actually be done... you will get lucky and that is all that would be needed.


If you are unable to restore an earlier registry....

Look at the registry key....

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

Userinit = C:\WINDOWS\system32\userinit.exe,

( there is a coma on the end of the above value...

Also look at the keys under...

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify

for any of the malware files that were reported by the utils you used earlier.

I look at the registry to see if I could identify any malware, (HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify) but the registry look normal.
I compared it to my running PC and they looked the same.

So, I used the Registry Restore Wizard to set the Registry back to the first date in 2004. All the other dates were day after day in October 2008, except that first one. I figured that since they were all bunched up in October, those were the ones that were changed by the malware or viruses.

Now I have the same problem that I had in the beginning (The computer just cycles around the BIOS screen to the Windows XP Home screen over and over again). So I used the Remote Registry to fix the boot up process, like I did before, except when Remote Registry runs it can’t find any profiles for me to select. Any Ideas!

Use the Registry Restore Wizard to revert back to the original ( infected if thats the proper term here ) registry

I reverted back and went with the second registry recovery file. Which was the first file in a series that were made in October 2008. The system recognized it, but when I ran the system it got the same blue screen with the same errors.

Should I be doing something like? http://support.microsoft.com/kb/156669

Seting up Dr. Watson to trap user-mode program errors, follow these steps:
At a command prompt, type System Root\System32\Drwtsn32.exe -I, and then press ENTER.

This command configures Dr. Watson as the default system debugger.
At a command prompt, type System Root\System32\Drwtsn32.exe, and then select the following options:
Append to existing log file
Create crash dump
Visual Notification

After the computer restarts from the STOP 0xC000021A error, run Dr. Watson (Drwtsn32.exe).
View the Dr. Watson log to determine what user mode process may be causing the problem.

OR does UBCD4win have a build in facility to do something like that?

You probably already have some DMP files that you can get analyzed ( we don't do that here ) in your Windows\minidump folder.... if there are none there, then following the instructions for the Dr Watson direction may help.

It looks like I'll have to go with Dr. Watson because everything I find related to reading the dump files require you to install the Windows Debugging Tools package. I can not install anything because the operating system doesn't work. I found the file on the 'C:' drive but they are encrypted so I can not make any sense of them.
Is there another way to read those files?