After merging, I followed the path you showed. I should have done it before I 
merged the files to see if kapua was there. After I merged them and checked the path 
all I found was [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon] 
credentials. The box to the right says ab (default) (value not set) Is that correct?? 


You're looking in the wrong place...that's a sub-key.

Double click on the Winlogon folder......and then look to the right.

-----------------

Since you are worried about it.........

If you want to put it back...same as before:

REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon] 
"System"="kdpua.exe"

---------------------------------

Just want to put back the "system"

REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon] 
"System"=""

MrC

Malware Removal Specialist

• Reply or follow-up to this message

• Search this forum
• Start a new thread on a different subject

• Report abuse of the forum