After logging on to the Windows XP system, will the system automatically log out again? It turns out that SP3 is not successfully installed.

After logging on to the Windows XP system, will the system automatically log out again? It turns out that SP3 is not successfully installed.

 

Original endurer
2008-01-13 1st

 

Today, a colleague said that his computer was faulty: After logging on to the Windows XP system, the system was automatically canceled. Please help me with the repair.

Restart your computer in safe mode and log on normally. Pe_xscan is used to scan logs and analyze the logs. The following suspicious items are found:

 

Pe_xscan 08-04-26 by Purple endurer
2008-11-2 10:37:47
Windows XP Service Pack 3 (5.1.2600)
MSIE: 7.0.5730.13
Administrator user group
Security Mode

O4-hkcu/../runonce: [tsclientmsiuninstaller] cmd.exe/C "cscript % SystemRoot %/installer/tsclientmsitrans/tscuinst. vbs"
O4-hkcu/../runonce: [tsclientaxdisabler] cmd.exe/C "% SystemRoot %/installer/tsclientmsitrans/tscdsbl. Bat"

O20-appinit_dlls = nhmxejkl. dll, mmwlangh1006.dll, tisqctyu. dll

O24-shlexechook: [5]-{528df602-9541-a985-210a-984a698c6f25} = 5
O24-shlexechook: [5]-{00070007-0007-0007-0007-00070007bb15} = 5
O24-shlexechook: [5]-{00010001-0001-0001-0001-00010001bb15} = 5
O24-shlexechook: [5]-{00050005-0005-0005-0005-0005-00050005bb15} = 5
O24-shlexechook: [5]-{00170017-0017-0017-0017-00170017bb15} = 5
O24-shlexechook: [5]-{00030003-0003-0003-0003-00030003bb15} = 5
O24-shlexechook: [5]-{00330033-0033-0033-0033-00330033bb15} = 5
O24-shlexechook: [5]-{00060006-0006-0006-0006-00060006bb15} = C:/Windows/system32/dispexcb. dll
O24-shlexechook: [5]-{00130013-0013-0013-0013-00130013bb15} = C:/Windows/system32/ksuserfy. dll
O24-shlexechook: [5]-{00300030-0030-0030-0030-00300030bb15} = C:/Windows/system32/imgutilhx2.dll

 

Among them, o20 and o24 items are obviously maliciousProgramYou can use the Kaka Security Assistant to delete the files.

This is a bit strange about the O4 item. First, cancel the auto-start feature in the Kaka Security Assistant.

Restart your computer and start Windows normally. An error prompt box is displayed.

The title is "Windows product activation" and the message content is: an issue that prevents windows from correctly detecting the license for this machine. ErrorCode: 0x80070002.

It seems that a colleague accidentally patched the system.

Restart the computer and select "start with the last correct configuration.

Restart the computer to safe mode and go to "add and delete programs" on the control panel for detection. No new patches are found.

Check the C:/Windows folder and find that the backup folder of an SP3 patch is created at 2008-11-1. Use the unmount function in this folder to unmount SP3 and restart your computer.

 

Google, the two O4 items were used in the SP3 patch.