microsfot process explorer
http://technet.microsoft.com/en-us/sysinternals/bb896653
microsoft autoruns
http://technet.microsoft.com/en-us/sysinternals/bb963902
Go to registry. Navigate : [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon], Delete all data under Userinit String value except C:\WINDOWS\system32\userinit.exe. Exit registry. Search and delete boot.vbs file. Lastly end the process called dxdlg.exe and delete the associated file from System32.
1. you need to remove wscript.exe in the Shell key in [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] too.
2. You need to use command prompt to unhide and delete the boot.vbs
commanded needed to del boot.vbs :=
a) c:\> dir /ah /as /s boot.vbs to find boot.vbs in your computer
b) attrib -h -s *.* inside the folder where boot.vbs is located
c) del boot.vbs
