Having Trouble with Spybot S&D

[groovicus]

Which would totally depend on the placement within the directory tree then...So you are saying that C:\WINDOWS\WININIT.EXE is valid, while placement in any other directory is invalid?

Just clarifying. I have not yet found anywhere that says it is valid, and I did direct searches for C:\WINDOWS\WININIT.EXE...??

[deadfreeze]

When i try to extract the file from the boot disk it says it cannot open the file, can anyone help i have looked on google but none of them seem to work.

[MoonWolf]

Which would totally depend on the placement within the directory tree then...So you are saying that C:\WINDOWS\WININIT.EXE is valid, while placement in any other directory is invalid?

To me this is what is happening.


Deadfreeze had the Xabot trojan. This trojan can create the file wininit32.exe it uses this name because it looks like a normal windows file.

It then executes itself by adding "SysInit"="wininit32.exe"

to the registry keys:

* HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\
RunOnce
* HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
* HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\
RunServices
* HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\
RunOnce
* HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run


Notice not using Wininit.exe at all.

Deadfreeze mistaked the real wininit.exe file located in c:\windows for the one created by the Xabot worm and deleted it.

Here is where his current problem starts

To fix your problem deadfreeze.

Here is a Wininit.exe file. It should go into your C:\windows folder. Check it for virii before use.

[deadfreeze]

so all i have to do is put the file on a floppy disk and then go into command promt and extract it and place it in the windows folder?

[MoonWolf]

1. extract
2. scan for virii
3. put on dos boot disk
4. place in c:/windows
5. reboot without disk
6. pray.

[deadfreeze]

Would i put the file onto the boot disk the same as i would put a file on a regular floppy disk?

[MoonWolf]

Yes. A boot disk is no different then a normal one except that it has files on them that make it bootable.

[deadfreeze]

Does it matter where abouts on the boot disk i put the file?

Sorry bout all the questions i just dont want to mess it up.

[MoonWolf]

No.

It doesn't mater where on the boot disk it can be in a:\ or a:\something or a:\something\*\*\etc

doesnt matter.

[deadfreeze]

When i try to extract the file it shows all these letters do i jus type in:Extract [/L C:/windows] wininit.exe?