The reason that you are getting redirected is because of the userinit.exe being infected.
The backup copy is also infected.
Let's try it this way:
Please download FileFind from Atribune.
Unzip the file and save it to your desktop.
To run FileFind, please do the following:
- Click on FileFind.exe
- In the box labeled "Directory"
- Enter Drive eg.. C:\
- In the box labeled "File"
- Enter this file name userinit.exe
- Now click on the "Search" button
- Once the utility has found the files click on "Export"
- A Notepad will open up. Please copy the entire contents of the Notepad and paste them here.
- NOTE: The notepad is saved on your C:\ drive as "Export.txt"