Hi,
Had the same issue on 2 pc's this week: virus removed, and users not able to logon (automatic logoff immediately after logon), or execute programs if able to logon. This is the procedure to fix the problem:
step 1: boot pc using WinPE or equivalent (bartpe, ubcd4win, ...) from cd/usb/pxe
step 2: run regedit inside WinPE (or bartpe, ...)
step 3: open infected windows' registry
- click HKEY_LOCAL_MACHINE
- in menu 'file', select ' load hive'
- browse to c:\windows\ssytem32\config, and click file SOFTWARE (no extension)
- name the hive something (e.g. virus_removal_registry)
- browse to the registry key
HKEY_LOCAL_MACHINE\\Classes\exefile\shell\open\command
- change value from ("c:\windows\system32 \smss.exe" "%1" %*) to ("%1" %*) without the brackets!
- browse to registry key
HKEY_LOCAL_MACHINE\\Microsoft\Windows NT\CurrentVersion\WinLogon
- change value of userinit from (c:\WINDOWS\system32\userinit.exeC:\Windows\system32 \smss.exe)
to (c:\WINDOWS\system32\userinit.exe) without the brackets
step 4: reboot
First registry key tries to start the (removed) virus everytime you execute an executable file (.exe). you can start an .exe file by renaming it to .com
Second registry key loads virus every time a user logs on. If the virus has been removed, userinit will crash and logoff the user immediately.
additional notes:
- be careful when changing the registry, since a faulty registry may render windows unusable
- if you don't have a winpe or equivalent boot medium, you can run regedit in windows if you rename regedit.exe to regedit.com
- don't forget to disable system restore, or the virus might pop up again soon
Hope this helps!
E.T.
