by shresthasumesh » Fri Feb 22, 2008 5:23 pm
in many cases the script files like abc.vbs handles the virus action so first of all make sure that the file Winter.exe /proper.exe is not handled by such scripts for that check for the process wsscript.exe in taskmanager. if u find it then open registry and find userinit key there the default value should be X:\windows\system32\userinit.exe, where X: is the system drive letter besides this is the path of script file.
have fun
Sumesh