Chris said:
I mean debugging mode, not safe mode. When I nornally try to start up xp
pro sp2, i get the continuous rebooting. i reach the windows splash and
then 1 sec later the computer reboots.
This sounds like the trojan that replaces userinit with wsupdater.
Adapted from a Post from Kelly: I suggest using this method if you
have a proper retail type CD you can boot from
Set the BIOS to boot CD before Hard Disk. Boot the XP CD and, instead
of Setup, take the immediate R for Repair. Assume any password
requested is blank, and TAB over.
Change the C:\Windows prompt to: C:\Windows\System32
by
CD System32
then
COPY userinit.exe wsaupdater.exe
Reboot into Safe Mode and use a run of regedit.exe:
Open to
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT
\CurrentVersion\Winlogon
And in the right pane double click UserInit and change from
wsaupdater.exe to userinit.exe,
Then you can reboot and delete the wpaupdater.exe file