Cant logon to WindowsXP, deleted some registry keys

[chloec42]

I use Malwarebytes Antimalware regularly

http://www.malwarebytes.org/mbam and havent had an infection found

in about a year.
Yesterday i scanned after about a month and i saw 12 infections !

MBAM said it could not clean a few infections:

==============
Malwarebytes' Anti-Malware 1.44
Database version: 3510
Windows 5.1.2600 Service Pack 2
Internet Explorer Unknown

9/11/2010 11:19:49 PM
mbam-log-2010-09-11 (23-19-49).txt

Scan type: Quick Scan
Objects scanned: 94917
Time elapsed: 2 minute(s), 49 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 2
Registry Values Infected: 2
Registry Data Items Infected: 3
Folders Infected: 1
Files Infected: 4

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\Cur rentVersion\Explorer\{43bf8cd1-c5d5-2230-7bb2-98f22c2b7dc6}

(Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explo rer\{43bf8cd1-c5d5-2230-7bb2-98f22c2b7dc6}

(Backdoor.Bot) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run\mp3_audio_codec (Spyware.Zbot) -> Quarantined and

deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\uid (Malware.Trace) -> Quarantined and

deleted successfully.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Spyware.Zbot) -> Data: c:

\windows\system32\sdra64.exe -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Spyware.Zbot) -> Data:

system32\sdra64.exe -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Hijack.Userinit) -> Bad: (C:

\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32 \sdra64.exe,) Good: (Userinit.exe) -> Quarantined and deleted

successfully.

Folders Infected:
C:\WINDOWS\system32\lowsec (Stolen.data) -> Delete on reboot.

Files Infected:
C:\WINDOWS\system32\lowsec\local.ds (Stolen.data) -> Delete on reboot.
C:\WINDOWS\system32\lowsec\user.ds (Stolen.data) -> Delete on reboot.
C:\WINDOWS\system32\lowsec\user.ds.lll (Stolen.data) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\sdra64.exe (Spyware.Zbot) -> Delete on reboot.
=======================

So i thought of manually removing the infected Registry keys. (Something i've done many times before)

While I was at
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\
I saw a key named 'Special Accounts', it looked fishy to my paranoid eyes. Had some 'strange' values in it, None

corresponding to my Username (Administrator) or Guest. 3 were somewhat random letters with a ~, and one was '

search assistant'. Looked like malware remains of some kind, so, i deleted them all.

After that i rebooted, the welcome screen showed up (usually straightaway shows me desktop since there is just one

user 'Administrator') with the only user 'Administrator'. When i click it, it shows 'loading your personal

settings' for a second. Then it reads 'saving your settings' and stays at the logon screen. Repeated it for 10

times. Restarted and repeated. Shut Down and repeated. Always same result.

Then i tried the 'Last Know good configuration' in statup options. Still same result.
Tried 'Safe Mode' starts loading then breaks at 'unable to load NTFS.dll'
'Safe mode with networking' same logon screen and same one second login and return to logon screen.

I dont know how to login. Can someone please help. Is there a way to remotely add the keys back to my registry. Or

some way to correct this problem?

Thanks and Regards

guptavis

[LinFre]

Hello,

if you know the original content of the registry value it es possible to recreate the key with for example BartPE or the Diagnostic and Recovery Toolkit (DaRT) from Microsoft.
If you will use BartPE you have to start regedit and load the corresponding registry hive, in your case it should be the "software" file in C:\WINDOWS\system32\config.
In MS DaRT it is possible the the registry is automatically loaded, so you dont have to load it separately with regedit, but i am not sure because i dont use it for some time.

Greetings LinFre

[mettlog]

BartPE is definitely the right way on a single computer if you want to access a crashed system's registry.

It can also be used to restore the entire registry to an earlier date, provided there are some restore points available in the hidden directories below the "System Volume Information" folder. The registry is made up of 5 files in the "\system32\config" directory, named "SYSTEM", "SOFTWARE", "SAM", "SECURITY" and "DEFAULT" without an extension and if you replace their current versions with all 5 from one of the restore points, your registry is completely back like it was when the restore point was created.

Unlike Windows own "use last known good configuration" option in the boot menu you can return to any specific registry version from these restore points, you could go back to one that is very close to the last Antimalware scan a month ago for example.

Please remember to backup the existing files before you overwrite them, you might choose a wrong restore point and then it's good to have a way back. It's absolutely neccessary to replace all 5 files together, never restore only a fraction of them!

There are many articles on the web about the details, for example this one here: 040129 - Manually roll-back the registry on a Windows XP system..

The principle is always the same: boot the PC with BartPE, get access to the system restore points, find the right version and replace the existing 5 registry files with those from the restore points. Most of the tips on the web refer to machines not booting at all because the "HKLM"-fork is damaged, but it applies to your case as well and to any other problems that are caused by a damaged or infected registry.

Still, in cases of such a heavily damaged system, it might be a good idea to consider a full new installation.