How to delte items from winlogon

  ACOLYTE 16:42 15 Oct 2008
Locked

I had a vundu varient trojan,and although i have removed the .dll file it installed,i still have an entry in Winlogon(current system)that shows in spybot,my attemps to remove wth spy bot seem to work but when i open spybot again the entry is back,so i was wondering if i could remove it manually?

  ambra4 16:53 15 Oct 2008

Download, update and scan

click here

  ACOLYTE 17:06 15 Oct 2008

I have already scanned and removed the trojan,i just need to know how to remove the entry from winlogon.

  Rahere 17:10 15 Oct 2008

Run the program suggested above in safe mode
Boot and press f8 (I have to press it twice) to enter safe mode.

  Joe R 17:18 15 Oct 2008

ACOLYTE,

start-run-type "msconfig" (without the hyphens)

choose startup, and untick the entry.

  baldydave 17:38 15 Oct 2008

Hi,
Try this
click here
or
click here
if using the 2nd option (much more informative)download/extract and use
autoruns NOT autorunsc,untick entries you want to remove then file tab /exit

  ACOLYTE 11:26 16 Oct 2008

Thx guys,the file didnt not show in msconfig,but i tried autoruns and found it,when i try to remove it says: error deleting start settings The system cannot find the specified file,i know this because i deleted all the files regading this trojan just cant shift this entry lol.

I guess if the files are not there then the entry will do no harm?
so i could leave it?.

  brundle 11:30 16 Oct 2008

Run RegDelNull from the same people;
click here

It may not be the technique that was used to protect it, sometimes nasties set permissions you can't override from within the infected system. Worth a try though.

  ACOLYTE 11:45 16 Oct 2008

Thanks,i tried RegDelNull,but im not sure how it works,when i open it all it does is close straight away nothing else i can do with it after that.
Im pretty sure that all the files are gone that need to be gone,so ill leave this entry and see what happens.


Thx all.

  brundle 11:50 16 Oct 2008

You need to supply the registry key to delete.

regdellnul HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\ < problem key >

This thread is now locked and can not be replied to.

Elsewhere on IDG sites

Xiaomi Mi Mix 2 review

What went wrong at the Designs of the Year 2017

iPhone X news: Release date, price, new features & specs

Comment utiliser Live Photos ?