\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\sdra64.exe,) Good: (Userinit.exe) -> Quarantined and deleted
successfully.
Folders Infected:
C:\WINDOWS\system32\lowsec (Stolen.data) -> Delete on reboot.
Files Infected:
C:\WINDOWS\system32\lowsec\local.ds (Stolen.data) -> Delete on reboot.
C:\WINDOWS\system32\lowsec\user.ds (Stolen.data) -> Delete on reboot.
C:\WINDOWS\system32\lowsec\user.ds.lll (Stolen.data) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\sdra64.exe (Spyware.Zbot) -> Delete on reboot.
=======================
So i thought of manually removing the infected Registry keys. (Something i've done many times before)
While I was at
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\
I saw a key named 'Special Accounts', it looked fishy to my paranoid eyes. Had some 'strange' values in it, None
corresponding to my Username (Administrator) or Guest. 3 were somewhat random letters with a ~, and one was '
search assistant'. Looked like malware remains of some kind, so, i deleted them all.
After that i rebooted, the welcome screen showed up (usually straightaway shows me desktop since there is just one
user 'Administrator') with the only user 'Administrator'. When i click it, it shows 'loading your personal
settings' for a second. Then it reads 'saving your settings' and stays at the logon screen. Repeated it for 10
times. Restarted and repeated. Shut Down and repeated. Always same result.
Then i tried the 'Last Know good configuration' in statup options. Still same result.
Tried 'Safe Mode' starts loading then breaks at 'unable to load NTFS.dll'
'Safe mode with networking' same logon screen and same one second login and return to logon screen.
I dont know how to login. Can someone please help. Is there a way to remotely add the keys back to my registry. Or
