Wednesday, October 11, 2006

Removing extra Winlogon Autostarts (viruses or spyware)

This has to be preformed outside the installed windows enviroment.
Boot from a CD like WinPE, MegaBoot, or other that allows you edit access to the installed registry.

Make changes and rename suspect files or alternate extention.

Exit / and Reboot, check your work.

Remember to look close at all autorun locations before starting, where there is one problem there are usually others.

Recommend using Autorun from
sysinternals.com
Looking at logon, winlogon, explorer, delayload, policies, and services.

This should get you on the right track.
-Joe

0 Comments:

Post a Comment

<< Home