I personally had a few problems with this virus and researched into it to find hardly any working advice, then I stumbled across this program, and it worked a treat, so I thought id share it on here!
Comment if you would like a more detailed tutorial, and show the steps step by step!
DOWNLOAD LINK:
http://www.regrunreanimator.com/security/download_regrun_suite.html
3. there are many variations of this virus
if you cant find watermark.exe, it should be desktoplayer.exe
theres also a variation that creates a random lettered folder in the c:\program files folder, delete this if you find it
there are many anti-viruses that can detect this infection although they cant repair your files (like avast)
drweb cureit is one of them that can cure them
good luck to everyone
Shadowfiendd2jsp 7 months ago
2. edit the value of that registry key to "C:\WINDOWS\system32\userinit.exe," without the quotes
DO NOT OPEN ANY .EXE FILES, .HTML, /HTM FILES AT THIS TIME, YOU WILL GET REINFECTED
download the free anti-virus called "Drweb cure-it" (its safe to open the .exe).
Do the full scan and REPAIR the infected .exe and .dll files
if you have any more questions, feel free to PM me
note that some variations of this virus may make a default browser process to create a backdoor so end process to these also
Shadowfiendd2jsp 7 months ago
1.to every one who have this virus
i'll make a quick removal guide, thumbs this up so every one can see
first, delete the processes named svchost.exe that are not in the system32 folder, you may need process explorer.
delete watermark.exe in c:\program files\microsoft
open regedit (google how to do it) and change the key Hkey_local_machine/software/microsoft/windows NT/currentversion/winlogon/C:\WINDOWS\system32\userinit.exe,,C:\infected folder\infected file.exe
(continue reading my second post)
Shadowfiendd2jsp 7 months ago
@shuhong89 I got the ramnit.a virus today and to stop it, turn off your system restore (as the virus stores itself in there, so restoring does nothing), then boot your computer in safe mode. Run a reliable antivirus scan with up-to-date definitions. (I used NOD32).
The virus tends to install itself on *.htm and *.html files, so you may get a lot of these files popping up as infected by your antivirus. Turn system restore back on and boot up normally and it should be fixed. Hope this helps!
ShortyScooby 9 months ago
FUCK!!!!!!!!!!!!!same as every other program i tried, u need to buy it to use it...
shuhong89 9 months ago
hope this works ... i dun know why but desktoplayer also affects my background and theme, it changes my theme to windows ME and im using XP. and after awhile it says my sound card stops working and could not play sound
shuhong89 9 months ago