Hi,
The userinit value may have been corrupted by the removal of blazefind. It adds wsaupdater.exe to the logon value in the system registry, sometimes appending it, sometimes replacing it. Running
Adaware or other cleaners detects and removes wsaupdater.exe, but doesn't
correct the registry damage. If this is the case, then you may need to load
the registry hive from another installation and change it. This is the key:
HKEY_LOCAL_MACHINE\SOFTWAR
Userinit string value should be:
C:\WINDOWS\system32\userin
On the damaged installations it's one of these:
C:\WINDOWS\system32\wsaupd
C:\WINDOWS\system32\userin
Another "quickie" method of resolution is to load the Recovery Console (see
below), copy userinit.exe as wsaupdater.exe from the command prompt, then
restart normally. Once in, go and change the registry value back to what
it's supposed to be and delete the copied file. To do this, use these
commands:
C:\Windows>
C:\Windows>copy C:\Windows\system32\userin
C:\Windows\system32\wsaupd
Then you can exit once completed.
HOW TO: Install and Use the Recovery Console in Windows XP [Q307654]
http://support.microsoft.c
This can also be done by using the 6 disk boot floppy set mentioned in the
above article, as it loads enough of the Recovery Console so that you can
copy the file. This is particularly useful if you have an OEM installation
that includes only a Restore CD, or no disk at all.
Courtesy: http://www.tomshardware.co
Regards,
Faraz H. Khan
Main Topics
Browse All Topics
by: vahiidPosted on 2009-11-03 at 23:00:14ID: 25737032
Should work on Windows 2003 as well, I just did it a couple of weeks ago on an infected 2003 machine. Were you not able to locate the file or it still loops when you copy it over.
Also you should use remote registry editor and look at HKEY_LOCAL_MACHINE\SOFTWAR