Some virus cleaning tips

Hello peoples!
I just finished spending 2 days on fixing up a pals laptop that had the worse infection I have seen.
This will just be a short guide on how to eliminate some of the errors that were caused because of them and will hopefully help some people out.

Some of this might need to be done in Safe-Mode. To get there hit F8 BEFORE the windows logo shows up when starting your computer. I normally just hit F8 repeatedly until it finally shows up. The regristy may also be needed. If you do not know what it is or how to get to it then you do not know enough about it for me to trust you with it. Google a tutorial for regedit.

1st issue encountered:
Windows XP would log out as soon as it logged in.
 
Turns out he tried to do his OWN fix and deleted userinit.exe. Copying the original from the Windos XP CD (named USERINIT.EX_ in the I386 folder) fixed the problem. In the registry it may have been changed to wsaupdate.exe so if copying the file over doesn't work. Try copying it and renaming it to wsaupdater.exe. If that works then you will need to search the registry and change the value. The copy can take place by putting your hard drive into another computer, or running the recovery console on the Windows XP CD.

This registry value should be set to userinit.exe
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonUserinit

After doing this explorer wasn't loading properly but I could log in and use ALT+CTRL+DELETE then select File -> Run New Task and type in explorer to get it to load up. The fix for this will be discussed later.

2nd issue encountered:
Couldn't run a proper virus scan because the Trojans hijacked the DNS and wouldn't let downloads / updates occur properly.
 
Two things to do here are use Hijack This to identify if you have any Unknown Winsock LSP entries. The one I found was ntdll62.dll which was doing redirects. This was removed using LSPFix with the "I know what I am doing" option..... don't use that if you don't know what you are doing . WinSock XP Fix and SmitfraudFix are also great assets.
Next, had to clear the DNS cache. Start -> run and type in cmd. Then in the command window type ipconfig /flushdns.

This let me get online and get some scanners and update them!
You might need to see if you have a proxy set. Go to control panel -> Internet Options -> Connections -> LAN Settings and make sure that Automatically Detect Settings is checked and nothing else. If you know information that should be there and was given to you by an admin or ISP then use that instead.

3rd issue encountered:
Lots of Trojans / malware / spyware

Let programs do the dirty work for you! I suggest the following, and use more than one of them. Can't count on one program being able to fix everything.
Antivirus / Spyware/ Adware / Malware
SUPERAntiSpyware
Malwarebytes' Anti Malware
AVG Antivirus
Avast Antivirus
Dr.Web CureIt!
Spybot - Search & Destroy
Ad-Aware

Rootkits
Sophos Anti-Rootkit
Link to others:Best Free Rootkit Scanner/Remover

I would also suggest disabling system restore and the pagefile so that any lingering infections would be cleared out of them. Remember to enable them again when you feel you are infection free.
 
4th issue encountered:
Explorer wasn't loading on login
 
Make sure that the registry is set to use the proper shell.
Set this key to "Explorer.exe" (no quotes needed)
HKEY_LOCAL_MACHINESoftwareMicrosoftWindows NTCurrentVersionWinLogonShell
then run sfc from the command prompt to make sure all important system files are the correct versions. Decent instructions here: How to use the Scannow SFC tool in Windows XP. I would suggest creating a new user and logging in to check and see if it is a Profile thing or not. If the new user logs in fine and you don't... you have profile issues. I also like to think that creating a new user makes windows do the necessary things to make sure that it load properly on 1st login and that it may repair missing registry entries. BUT that is just somehting I like to think and have no proof that it actually occurs

Hopefully this helps some of you out in the future!
The problems I had were much more severe and required LOTS of registry searching and editing, but it is hard to give a short guide on how to navigate and fix a registry. So... best of luck to you if that is what you need to do!

If you have any other usefull ideas then add them to a comment!