OOOPS! I deleted a registry key

[Guest]

I recently removed a spyware virus, and was left with a message that came up
everytime I logged in, that windows was trying to load kernels64.exe, and
that the file couldn't be found.

I believed this was due to my recent virus, as I had never heard of
kernels64.exe

I searched the registry and found to the winlogin shell variable contained a
call to:

eplorer.exe c:\WINDOWS\System32\kernels64.exe

I deleted the entire shell variable and now my system hangs after login.

I now realize I should have left the variable an perhaps removed the
offending parameter c:\WINDOWS\System32\kernels64.exe

How can I restore a registry key If I can't get past the login screen?

Any ideas?

Thanks!

-phil

 

[BobH]

Phil, I am by no means someone to give directions, but I think I would back
up a few days in the System Restore and do that. It may or may not work.
Sure is worth a try until you can get some expert advice.

 

[Bert Kinney]

Hi Phil,

You can try System Restore from safe mode, but beware this may also
restore the virus.

All About System Restore in WinXP
http://bertk.mvps.org

 

[Guest]

Thanks Bob. I don't know how to use System Restore , but you gave me an
idea. I booted in safe mode, with a command prompt. I was then able to run
regedit, and add the Shell key / value to Explorer.exe.

I'm good to go! HAPPY NEW YEAR!

 

[BobH]

Bert, after doing the restore, couldn't Phil then do a AV check and remove
it if it's still there? All in Safe Mode.

 

[BobH]

Phil, glad it worked, whatever you did. The most easy I have found to use
System Restore, is go to Search, do a file search on it, when found click on
it, open and follow instructions. Very easy. Glad your problem is solved.

 

[Bert Kinney]

Yes, as long as his AV program runs in safe mode. Then when the system
is confirmed clean, disable System Restore to remove any infected
restore point.

How to Disable and Enable System Restore
http://bertk.mvps.org/html/disablesr.html