A virus was found a few days ago. The root directory of each partition contains autorun. inf, which seems to be a virus that is spread through a USB flash drive. The virus is very simple. It didn't do much bad things. It just spread through batch processing, changed the registry, and canceled the administrator password of the system, so that anti-virus software didn't treat it as a virus. If the anti-virus software cannot be killed, delete it manually. During deletion, You need to delete the virus files under the root directory of each partition and the Windows System directory, modify the Registry location in the batch processing, and change those places back.
In the registry
[HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Winlogon]
"Userinit" = "C: \ WINDOWS \ system32 \ userinit.exe, ***. exe"
Here you only need to set ***. the exe can be deleted, but I accidentally deleted the entire key value. As a result, the system is logged out upon startup and cannot enter the system. The security mode is also the same.
Userinit.exe is a key process in the Windows operating system. It is used to manage different startup sequence, such as creating network links and Windows Shell startup. The location of the Registry is also a favorite of the virus, which can be used to enable the startup of the virus. Replacement.
If you know the reason, you need to restore this item in the registry. But the system cannot be started. How can this problem be recovered? I have read an article about how to retrieve the lost XP password, saying that a script can be used to run the specified batch processing before the logon screen appears on Windows. Enter the "Winxp password, script recovery" and google it. I found that this article was all posted. However, I tried it according to the statement in the article and found that it did not work.
| [Content navigation] |
| Page 1st: understand the key system files deleted by mistake in security recovery |
Page 2nd: understand the key system files deleted by mistake in security recovery |