"Windows Blocked" part 2

As the authors wrote 2 topics. It was enough to delete the blocker. * In the All users / application data folder
But apparently about it already heard enough and in the case of my friend there was no such file.

Thanks ykcyc for the method with the printer by pressing Shift 5 times, but in our case it did not really help.

The situation was as follows:
')
The printer's help did not have a menu, but the option of installing a new printer in the print menu helped:

We select installation from a disk

And here already it turned out to call the explorer aka explorer, the whole shell of Windows was loaded accordingly =)



1) Open regedit and go HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Winlogon in Userinit
There should be only a record of the form "C: \ Windows \ system32 \ userinit.exe,"
In our case, Vir added his launch at the end of this line.

2) Search for the file specified in this line and nail it

3) Scan the computer with a good antivirus.

4) We are happy.

While we were googling information on this issue, we accidentally found another alternative from DrWeb.

1) Follow the link news.drweb.com/show/?i=304&c=5

2) And we see ... =) what would you think, "keygen" for this trojan (Trojan.Winlock.19).