jeremyofmany Posted March 31, 2009 ID:68853 Share Posted March 31, 2009 The latest version is reporting the following as 'Trojan.Agent':[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]"Userinit"="D:\\WINDOWS\\system32\\userinit.exe,"I allowed MBAM to remove this and I was unable to login to Windows after a reboot.I was unfortunately having issues with the backing up of my OS files in Acronis True Image but used ERD Commander 2005 to boot on and manually type the registry and value back in. Link to post Share on other sites More sharing options...
Staff miekiemoes Posted March 31, 2009 Staff ID:68889 Share Posted March 31, 2009 Hi,Can you post the developers log please? MalwareBytes doesn't remove that value though - it just replaces it with the default value again in case it was modified by malware. Link to post Share on other sites More sharing options...
nosirrah Posted March 31, 2009 ID:68934 Share Posted March 31, 2009 Likely replaced userinit.exe file . Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now