Just fyi, English is not my primary language, so please be patient to any grammatical error.
My Computer OS is Windows XP Professional, SP3. Pre-installed when I bought it (2007) and I don't have the CD/DVD installer.
Now on to my problems..
1. My Spyware Terminator informed me that I have a Trojan Ramnit.A.42 in svchost.exe.
2. Then I found a file name WATERMARK.EXE in my Program Files\Microsoft folder, when I tried googling it they told me it was a virus.
3. I followed these steps to remove it (but I think I made something wrong along the way ) :
Open “Task Manager” using “Ctrl+Alt+Del” click tab “Processes”.
Find “svchost.exe” with user YourComputerName (not LOCAL SERVICE, SYSTEM, or NETWORK SERVICE).
Delete or “End Process” all of them. Let the window Task Manager open.
Enter command prompt, Start -> Run, type “cmd”, enter.
Type “cd program files/microsoft”, press enter.
Type “del watermark.exe /a /s”, press enter.
Type “md watermark.exe”, press enter.
Type “cd watermark.exe”, press enter.
Type “md con\\”, press enter.
Open Registry, Start -> Run, type “regedit”, press enter.
Go to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon, and find “Userinit”, double click and look at the value.
Change “c:\windows\system32\userinit.exe, c:\program files\microsoft\WaterMark.exe” to “c:\windows\system32\userinit.exe”.
Refresh Registry and make sure the value of Userinit not change back.
If nothing change, then you can be assured that the virus is removed.
4. I made all those steps above on Safe Mode logon with Administrator password. And after I did all that, when I tried to logon again with Administrator password in Safe Mode I can't! It started to loading and then it seems to automatically logoff and back to logon screen.
5. So I can not do any of the "Preparation Guide For Use Before Using Malware Removal Tools and Requesting Help", because I can't even logon.
Just fyi I don't have access to other computers and to send this I'm using my father's Laptop. I hope this laptop does not have any virus too.
Please, please, please help me..
An expert should be with you soon.
Edited by nasdaq, 13 September 2012 - 08:14 AM.