Honestly, I would need to see a scanlog or two from the combofix runs. Too many different possibilities to speculate....

Lots of nasties with rootkit components these days - that makes them hard to kill and easy to spread.

If you could post a few logs from the tools you have run, one of our volunteers can have a look and advise you further.

PP

hi,

One quick question, have you put antivirus on those computers lately? if so then read on....

I have had the exact prob on some of my computers... All of them ended up in reformatting the hard drive but i did manage to get into windows and save all my files ...
Ok, well if it is the same as the prob that i had then it IS a virus, now the virus is called the Virut or Sonnahag and there's some more names for it. A good program to remove these files would be Dr.WebCureIT or VRvirut32.

But now, BEFORE you download those, you have to know the cause of the problem... Ok so it starts off as a virus and klings to files on your pc(s) and its mainly on the .exe or .com files which poses as a big problem. Now after this virus has gone and klinged to all the .exe files in your system directory then they are IRREMOVABLE! And you come and put on a simple antivirus program and do a scan, in the scan it will find MANY viruses and you tell it to "cure" or "delete" them. So now since the antivirus cant go into a .exe file (unless its been compacted and not encrypted) it just deletes the whole file. And so it deletes the userinit.exe and many many others... so when the system wants to start up then bad luck, it cant find the necessary files and tells you that it cant start.

So the answer is to use the XP repair disk and press r at the first screen. It will go to a Command prompt interface and ask you what you would like to do, type in "help" if you need help.. now log into the windows dir there and then copy the userinit.exe from C:\windows\ServicePackFiles\i386\userinit.exe to C:\windows\system32\userinit.exe

Now if that doesn't work then u have to get it from the xp setup disk.. put the disk in a workin computer and search for the file and write down the address to it and then put it back into the broken one and copy it from that path to the above one. NOTE: The file on the disk might be named userinit.ex_ and you have to rename it to userinit.exe when you copy it over to the computer.

And that SHOULD do it.... then when you have put on the pc just dissable ALL antivirus and make backups ASAP and then reformat...

Oh yes, you didn't mention above, can you open Task Manager? if so then just click on new task and type in "explorer" and enter...

Best of luck! hope this helps!!

oh and sry that my post is soooooo long HAHA lol

These computers have been running Symantec Endpoint on them for a long while. We have found out that this is a virus running through our network. Everytime you wipe and load a computer and log into it it reloads the virus. Another tech has even tried a new HD and it does the same thing as soon as you login on the network. I will read over your post again and try your suggestions, thank you so much for your help.