PCTech Forums

by **brad** » Fri Jul 09, 2004 9:50 pm

Press Ctrl/Alt/Del and "End Task" or "End Process" on each of the following: (They may or may not be there)

winlogin.exe

Turn off System Restore. (Turn it back on after this is repaired and you've rebooted.)
(This would also include the “GoBack” Program if it is installed.)
Close all other open Windows and have HiJackThis Fix:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O4 - Global Startup: winlogin.exe

Now delete these Folders or Files that are Highlighted: (You may need enable "Show all Files" and disable "Hide System Files" in Windows Explorer / Tools / Folder Options / View Tab) (You may have to boot to "Safe Mode" in order to delete some Files/Folders)

winlogin.exe

Now, empty all your TEMP Folders (WinXp has up to 4 of them) / Temporary Internet Files Folder and then empty your "Recycle Bin" and reboot.

Finally we found it. winlogin.exe
Check this out:

brad

by **turbostangman** » Fri Jul 09, 2004 10:45 pm

I will do that here in a minute.

If this is part of a trojan why was norton and the others missing it?

by **brad** » Fri Jul 09, 2004 11:49 pm

Ask Norton.
brad

by **turbostangman** » Sat Jul 10, 2004 12:59 am

Well I did what you said in the instrunctions and I could get rid of

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1

but hijcak said it couldn't delete O4 - Global Startup: winlogin.exe

I went into reg edit and deleted all entries with winlogin.exe, there were 6 files.

I went into safe mode and turned off "Winlogin.exe" and restarted in safe mode.

I go to delete it and it says "Con not delete. Make sure the file is not being used...." so I go back to msconfig, IT IS CHECKED AGAIN!!!

I uncheck it and restart in safe mode again, IT IS CHECKED AGAIN!!! I selected Turn off all start-up, came back on again!! Something will not let me turn it off!!!

I went into the file location C:\Documents and Settings\All Users\Start Menu\Programs\Startup\winlogin.exe and it says "0-bytes" so the file is empty...appairently. I tried renaming it to a .jpg, no dice, tried moving it out of start up, said could not move empty file.....

Is there a remote trigger for this file or am I missing soething?

The only other file in the same startup folder is desktop.ini. I opened that and this is what it says....[.ShellClassInfo]
LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-21787

What should I do next or try?

by **brad** » Sat Jul 10, 2004 9:28 am

You do realize that I've never told you to go into the Registry?
I hope you're backing it up.
It should have been in: C:\Documents and Settings\Username\Start Menu\Programs\Startup\winlogin.exe
Here's a Removal Tool from Doug Knox:

brad

by **turbostangman** » Tue Jul 13, 2004 12:16 am

by **brad** » Tue Jul 13, 2004 12:35 am

by **turbostangman** » Tue Jul 13, 2004 5:44 am

by **brad** » Tue Jul 13, 2004 10:34 am

Delete it here: C:\Documents and Settings\Username\Start Menu\Programs\Startup\winlogin.exe
Rename it won't let you delete it. Then delete it.
brad

by **turbostangman** » Tue Jul 13, 2004 6:11 pm

by **brad** » Tue Jul 13, 2004 6:27 pm

by **turbostangman** » Wed Jul 14, 2004 6:37 pm

by **brad** » Wed Jul 14, 2004 6:50 pm

by **turbostangman** » Thu Jul 15, 2004 12:03 am

Thanks so much!! I will try it right now.

PCTech Forums

Can't get rid of Program 123946.dlr/.exe and Com.exe HELP!!!

Who is online