I am working on a Laptop that is infected with what appears to be the XPANtivirus2008 trojan, it is causing Windows to loop the Logon. It allows you to get to the logon screen, but when you try to log in to Windows it loops back to the log on screen, during the process sometimes it shows the XPAntivirus 2008 screen, typical of this infection. This issue occurs even when trying to log on in Safe mode. I have went and downloaded the UBCD4Win Bootable CD-Rom booted to it and ran all the scans on it, it finds infections and removes them, but it still won't let you log into windows. I have also tried to boot to the WinXP cd and run recovery console, tried fixboot and fixmbr, neither of these have fixed the problme either. Any Ideas on how to fix this?? Is there any way to edit the registry from recovery console?? This is Aggrivating to say the least!! IKE Ike Welsh 3rd Party Support services

PE Builder will let you edit the registry and transfer files from a floppy and cd(I think). Sounds like the winlogon.exe file is corrupt. The corrupt one will be "C:\Windows\System32\winlogon.exe" and there should be a clean copy at "C:\Windows\ServicePackFiles\i386" and "C:\Windows\$NtServicePackUninstall$" or on the computer that you are using now.

PE Builder would not let me edit teh registry. It said the administrator had disabled registry editing?!?!? I will try booting to the XP CD and using recovery console to repalce the winlogon.exe file. Thanks for the help!! I'll post followup when I get done!! IKE Ike Welsh 3rd Party Support services

OK I was able to replace the file under docs&settings/owner with one from the I386 folder. I still have the issue with the virus screen and logon looping!!I was able to get into the registry from pe builder, but not sure exactly what to modify in there!! Any Ideas?? Ike Welsh 3rd Party Support services

OK Here's the followup. Replacing the winlogon.exe file didn't work. I also tried the steps listed at http://windowsxp.mvps.org/peboot.htm to inlcude replacing the userinit.ese file, now I can't even get to the login screen, just boot loops with BSOD, can't get the error (goes to fast). But now it seems worse than it was before!! ANy ideas other than reformatting??? Customer doesn't want to lose data, and doesn't want to pay for the labor to do the back/ reformat/ retrieve,... Thanks all!! IKE Ike Welsh 3rd Party Support services

Go to the following link: Repair Install Instructions Scroll down to "Repair Install XP" and follow the directions. This will repair Xp but you will have to reinstall all the updates, all files will be retained so the virus will still be there but hopefully at a much earlier sage of damage. Once you are back up and running post a Malwarebytes log and a Hijack This log.

Hey Jabuck, "Go to the following link: Repair Install Instructions Scroll down to "Repair Install XP" and follow the directions. This will repair Xp but you will have to reinstall all the updates, all files will be retained so the virus will still be there but hopefully at a much earlier sage of damage. Once you are back up and running post a Malwarebytes log and a Hijack This log. " I will try these steps and post back here the results of my the steps!! Thanks for the help!! IKE Ike Welsh 3rd Party Support services