Need help or info about recoving a user ID, is it possible?

Wow I'm I a doofuss! err spazz!!

I had some serious popup issuses and figured I had spyware on my system. I start trying to get rid of it and tried several of my normal methods. Including adware and Spybot SD. I got rid of some of it, but it kept coming back to some extent. In the process I think I deleted a valid key from the registery under my UID. Now when I try to login with my ID, the system appears to load up, but never goes past the system tray appearing. My drive activity light comes on and stays almost solid for some time. I can bring up Task Manager, and it shows explorer at about 95% system resources used. If I kill Explorer and restart it, same thing. No movement past this point. I can't even login in safe mode.

That is the bad news, the good news is that I can use my admin account or my wifes account (she's an admin too). I was able to get rid of most of the spyware, although I do still get some redirect poppups from no where. I finnaly made some headway once I disable System Restore. I was able to killed most of the stuff. I have the system patched with SP2, and I have NAV Internet Security 2005 installed. So I don't really get why the poppup are happening. I can only assume a task is running in the back ground. I am aslo seeing some dll errors when I log in under my son's account (he is just a lowly user ).

IE:

error loading c:\windows\system32\ofe32.dll
error loading c:\windows\system32\guard.tmp
error loading c:\windows\system32\eits.dll
error loading c:\windows\system32\PFBDLG.dll
error loading c:\windows\system32\mtvcr71.dll

So here's the million dollar question. Is there a tool that I can use to do comparisons on the registry and hopefully repaitr one user based on the data contained in the other users? I suspect that while I was vigoursly "sqashing the bugs" I accidentally deleted a required key. If there is a tool that will scan the whole registery and then compare the user section, then late you "repair" the registery based on the differences, maybe I can salvage my account. I know I may be wishing in the wind, but if ya don't ask ya don't know!

 

System File Checker (sfc)
Start > Run > cmd
sfc /scannow
and have your XP cd ready.

sfc - system file checker, retrieves the correct version of the file from %Systemroot%\System32\Dllcache or the Windows installation source files, and then replaces the incorrect file.

If you want to see what was replaced, right click My Computer > manage, expand event viewer > system.

Johanna

 

Thanks Johanna!! I am running it now. Should have results in a short while. If this helps then you've earned a merit badge! b

 

Pop up killer from Webfroot

Glad Johanna solved your problem. Idea for stopping stubborn pop-ups in the first place. Kill it with the "Silver Bullet ". Anything that gets past your regular blocker can be killed with a double click and saved in database. You'll never see that sucker again unless you remove it from the bullet database. Good luck! Carolyn

http://www.webfroot.co.nz/index.php?p=25