File corruption causes Windows XP system to restart repeatedly

Windows XP system has repeatedly logout phenomenon. Since almost all users reflect the same problem at the same time, this matter has caused the Kingsoft Internet Security Global Anti-Virus Monitoring Center to attach great importance to it and contact users who have encountered the problem for the first time. An anti-virus engineer is immediately sent to the sample for extraction, and the current virus sample is being analyzed and processed.

Kingsoft Internet Security anti-virus expert Dai Guangjian said that although there is no final confirmation of the virus causing repeated logout of the user's XP system, there are two main reasons for this type of problem: 1. System default The userinit registry value was modified and the userinit.exe file was replaced. 2, viruses and malware use image hijacking technology to hijack userinit.exe.

The virus and malware attacks on the computer operating system have not stopped, and the phenomenon of repeated logout of the xp system is one of them. It is understood that in 2005, a similar phenomenon occurred in the msn sexy chicken attack.

In order to help users who encounter similar problems solve problems early, Kingsoft Internet Security anti-virus engineers have launched a solution to this problem:

Processing ideas: modify the registry, replace the normal userinit.exe . Since both normal mode and safe mode are inaccessible, we need to consider other boot mode fixes. Dos command line modification of the registry and replacement files is too complicated for the average user, so we only introduce the use of WinPE disk boot mode to correct this phenomenon.

First press the delete key to enter the BIOS to confirm whether the current boot mode is CD boot. Press + to modify the first boot as the CD-ROM drive, and press F10 to save and exit the restart. As you can see, the virus hijacking userinit.exe to a file that does not exist will cause the XP system to log out repeatedly.

HKEY_LOCAL_MACHINE<quo;Software"Microsoft“Windows NT"CurrentVersion"Winlogon

Find the Userinit key value inside and change its data to the default value of the system "C:“WINDOWS<quo;system32“ UserInit.exe, as shown in Figure (4):

Next we need to replace the userinit.exe file in the WinPE disk with the file in the system directory to ensure that the file is not modified by the virus. The method is to browse the CD-ROM to find the system32 directory under the I386 directory, right-click the userinit.exe file and select "Copy to", the default path X: & ldquo; windows “ system32 input dialog box as shown in Figure (5):

If the userinit.exe file exists in the system directory, the following prompt will appear. The recommendation is to avoid the previous file being modified by the virus. As shown in Figure (6):

When the registry modification and file replacement are completed, restart the computer, and the phenomenon of repeated logout can be solved. (Pay attention to remove the WinPE CD to avoid repeated access to the WinPE system)

Note: This method is only for the reference of people who encounter such a phenomenon. Users who do not have this problem should not imitate similar operations.