Tilted Forum Project Discussion Community - View Single Post

sailor · 03-31-2006, 10:02 AM

Look in the registry, in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify. If you have a key in there that is 5 letters long, usually with at least on character that is repeated once (but NOT cscdll), that is the file that's causing you so much trouble. But here's the trick--because it is part of the winlogon process, you can't delete it from Windows, even in safe mode. Boot using Knoppix or something like that and delete the file by that name (whatever.dll) from C:\Windows\System32. Then reboot into windows and remove that registry key.

Virtumonde is a sonofabitch. We see it all the time at work.

03-31-2006, 10:02 AM	#4 (permalink)
sailor beauty in the breakdown Location: Chapel Hill, NC	Look in the registry, in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify. If you have a key in there that is 5 letters long, usually with at least on character that is repeated once (but NOT cscdll), that is the file that's causing you so much trouble. But here's the trick--because it is part of the winlogon process, you can't delete it from Windows, even in safe mode. Boot using Knoppix or something like that and delete the file by that name (whatever.dll) from C:\Windows\System32. Then reboot into windows and remove that registry key. Virtumonde is a sonofabitch. We see it all the time at work. __________________ "Good people do not need laws to tell them to act responsibly, while bad people will find a way around the laws." --Plato