Trojan.Startpage removal

[Ben]

I am running Windos XP Home Edition 5.1.2600 on a Gateway
400SD4 Laptop with 512MB of memory.

In the following directory
C:\document and settings\all users\start
menu\programs\startup
I have a file called winlogon.exe.

Norton Internet Security has identified this file as a
Trojan.Startpage virus.

When I tried to delete the file I got the following
message:

Error deleting file or folder
Can not delete winlogon: access denied

Make sure the disk is not full or write-protected
and that the file is not currently running.

Since the file is in startup it prevents me from
accessing the internet. Also since the file is in the
startup it is currently running therefore I can not
remove it.

How do I get rid of it without reformatting my drive?


The Symantec website suggested the following:

The following instructions pertain to all current and
recent Symantec antivirus products, including the
Symantec AntiVirus and Norton AntiVirus product lines.
1. Disable System Restore (Windows Me/XP).
2. Update the virus definitions.
3. Run a full system scan and delete all the files
detected as Java.StartPage.
4. Reset the Internet Explorer home page.
5. Reset the Internet Explorer Search page.
This did not work. I can not do step 2 because the virus
will not allow me access to the internet.
I did make sure that the System Restore was definitely
off. I did go on to step 3 but still could not remove
the virus.

 

[Carey Frisch [MVP]]

Removes the Registry entries for Winlogin.exe
http://www.dougknox.com/xp/utils/xp_winlogin_remove.htm

[Courtesy of MS-MVP Doug Knox]

--
Carey Frisch
Microsoft MVP
Windows XP - Shell/User

Be Smart! Protect your PC!
http://www.microsoft.com/security/protect/

-----------------------------------------------------------------------------


|I am running Windos XP Home Edition 5.1.2600 on a Gateway
| 400SD4 Laptop with 512MB of memory.
|
| In the following directory
| C:\document and settings\all users\start
| menu\programs\startup
| I have a file called winlogon.exe.
|
| Norton Internet Security has identified this file as a
| Trojan.Startpage virus.
|
| When I tried to delete the file I got the following
| message:
|
| Error deleting file or folder
| Can not delete winlogon: access denied
|
| Make sure the disk is not full or write-protected
| and that the file is not currently running.
|
| Since the file is in startup it prevents me from
| accessing the internet. Also since the file is in the
| startup it is currently running therefore I can not
| remove it.
|
| How do I get rid of it without reformatting my drive?
|
|
| The Symantec website suggested the following:
|
| The following instructions pertain to all current and
| recent Symantec antivirus products, including the
| Symantec AntiVirus and Norton AntiVirus product lines.
| 1. Disable System Restore (Windows Me/XP).
| 2. Update the virus definitions.
| 3. Run a full system scan and delete all the files
| detected as Java.StartPage.
| 4. Reset the Internet Explorer home page.
| 5. Reset the Internet Explorer Search page.
| This did not work. I can not do step 2 because the virus
| will not allow me access to the internet.
| I did make sure that the System Restore was definitely
| off. I did go on to step 3 but still could not remove
| the virus.
|

 

[dglock]

try using the task manager under the services tab,if its
running in task manager stop it and then delete the file.
don

 

[Guest]

Why is winlogon.exe in the startup folder, shouldn't it be in the c:\WINDOWS\system32 folder