restore an older registry in XP?

[Darmok]

Hi,


I have a friend who apparently got some kind of trojan on her system,
and it has infected her current registry, where the programs "aux.exe"
and "aux.dll" are being envoked and lauched. She's tried deleting
them from the registry, but, after boot, they keep being recreated.

I know that in 98SE you can boot to a command line session, and run
"SCANREG" and have the option of going back to one of your older saved
RBxxx.cab files.

Is there something comparable to do in XP? I've told her to run
MSCONFIG and try to find a program which might be putting the lines
into the registry at boot up. This gal is not really too computer
savvy, so I've been trying to come up with a simple solution. If I
can't find anything, I may just tell her to format the HD and try and
completely reinstall her OS and files. (she has some kind of off the
shelf computer .. a Dell, Gateway, HP ... or similar, and it comes
with CDs to reinstall everything, I'm sure)

TIA

 

[Darmok]

You can try using System Restore.
It's located at Start / [All] Programs / Accessories / System Tools / System
Restore.

Well, if my memory is correct, System Restore is based on having
created "Restore Points" to restore from. I asked her about this, and
she said that none of her available restore points are older than the
time at which she feels she was infected. So, using System Restore
might go back a couple days, but not far enough back to get rid of her
problem.

Thanks anyway ...

 

[Kelly]

Hi,

Where exactly is she removing this from the registry? What is the complete
path to better know what it is related to? Do some reading here:
http://tinyurl.com/gyp3 for recognition. Good luck!

/xp_tweaks.htm

Top 10 Frequently Asked Questions and Answers
http://www.kellys-korner-xp.com/top10faqs.htm