WinME Boot Issue

[JeffersonK]

In keeping with stupid human tricks, I was diligently cleaning out a virus yestreday (QAZ trojan). One of the duties to cloean this is to delete notepad.exe, delete note.com(whant QAZ renamed the Notepad.exe to originally) and wininit.exe. You then invited to reinstall both Notepad.exe and Wininit.exe.

Have not done that yet, but did search for wininit.* and found wininit.bak. So renamed it to wininit.exe. (BF Mistake!)

Now the fun part. On restarting my 'puter, I get WinME splash but that is all.

Trying to bypass windows and get to c: or a: prompt so I can go back and rename the exe file to a bak file.

Here is the really hard question - How do I get there on boot up?

Please advise so my family gets off my back.. Thanks.

JeffersonK

 

[Bryan]

You basically just reloaded changes from an old install, upgrade or the trojan itself by renaming wininit.bak to wininit.exe. Right off the top of my head I'm not sure if that trojan uses the wininit file but I'm sure someone will know or I'll check when I get a chance.

Anyway, try booting up in SafeMode like this,

Restart the PC and press and hold down the Ctrl key during the bootup. Assuming you get the Startup menu, choose SafeMode.

Once in SafeMode, if it's still named Wininit.exe, rename it back to wininit.bak and restart Windows into Normal mode. You may get luck.

Or it may already be renamed to wininit.bak if Windows processed it on startup. If that's the case, open Wininit.bak with Notepad and post the contents to a reply here.

Whatever you do don't delete the wininit.bak file til you see what it did, if anything.

If you are able to get back up in Normal mode after renaming it, rerun the virus scan and cleanup.

 

[Bryan]

Wininit.exe is infected as part of that Trojan but I'm not sure what the wininit.bak file contained. It could be the Trojan version on wininit.exe or it still could be an old install or upgrade.

Let us know what you find in SafeMode.

 

[JeffersonK]

Bryan:

Thanks so much for your speedy reply. I understand what you are saying regarding Wininit.bak.

I still cannot get up in safe mode, nor can I boot to DOS (c prompt etc.)

Any suggestions ref booting to basics would be good.

Best regards,

JeffersonK

 

[Bryan]

You need to boot to a Windows ME boot diskette and then take the option to "Start without CDRom Support" or "Start With CDRom Support". Once you have an a:\> prompt, try renaming wininit.exe

ren c:\windows\system\wininit.exe wininit.xxx

Remove the boot diskette and press alt/ctrl/del.

If it still won't start try restoring a copy of the registry. Boot back to the a:\> prompt and do this,

Type in scanreg /restore at the prompt, press enter and follow the prompts to restore a backup. Once it's restored, remove the boot diskette and restart the PC.

BTW, if you don't have a Windows ME boot diskette, you can look <a href=http://www.bootdisk.com> here</a> or you can create one on any Windows ME PC under Start>Settings>ControlPanel>Add/RemovePrograms>StartupDisk