winlogin.exe and viruses

[Guest]

Everytime i start my computer i get a message saying winlogin.exe has
encountered a problem and need to close, winlogin sounded kinda important so
i wanted to check whether its okay for it to error.

Also, a virus has infected a file "acw.dll" in my C:\windows\addins and it
says it a system file and programs may not work proberly. It cant be cleaned
or quarenteened so is it okay to delete.

Thank you in advance,

Phil

 

[Gerry Cornell]

Phil

What anti-virus programme are you using?

You have a Trojan which will or has opened the door for other spyware.
Just deleting the file will not help. You need to proceed either by
using a removal tool or by following specific instructions,

When dealing with a persistent virus / trojan you need to delete system
restore points and not use them as they will contain the virus and put
it back into your system. Turn off System Restore until cleaning is
finished. Also run your anti-virus with updated definitions in safe
mode.

Create a new folder named Sysclean (e.g., C:\Program files\Sysclean, or
just a desktop folder).
Download Sysclean.com (http://www.trendmicro.com/download/dcs.asp) and
place it in this folder.

Download the latest Controlled Pattern Release zip
(http://www.trendmicro.com/download/pattern.asp, e.g., lpt123.zip) and
extract its contents to the same folder. See the Readme text file for
additional instructions.

Delete Temporary Internet Files (IE Tools>Internet Options>General)
accepting the option to delete all offline content. Reboot and delete
contents of all TEMP folders and then your Recycle Bin.

Close all running programs including your anti-virus application, go
offline, and run Sysclean. For best results, do nothing with the machine
until the scan completes.

If the scan shows any infections in System Restore files and you're
running WinXP, create a new Restore Point
(Start>Programs>Accessories>System Tools>System Restore), then delete
all but the most recent Restore Point (Start>Programs>Accessories>System
Tools>Disk Cleanup>More options).

Work through the spyware removal programmes etc in turn in safe mode
until you get no results.

Afterwards, update your own anti-virus application and perform another
full system scan.

Finally run HijackThis and post the HijackThis log to the HijackThis
forum here:
http://aumha.net/

You will need to register with Aumha to be able to post.

--


Hope this helps.

Gerry
~~~~~~~~~~~~~~~~~~~~~~~~
FCA

Using invalid email address

Stourport, Worcs, England
Enquire, plan and execute.
~~~~~~~~~~~~~~~~~~~~~~~~
Please tell the newsgroup how any
suggested solution worked for you.



~~~~~~~~~~~~~~~~~~~~~~~~

 

[Guest]

Thanks alot for that, i installed McAfee and that cleaned it off the
computer, but im still getting a winlogin.exe error message when i start up
the computer. It doesnt seem to be affecting my computer but i just want to
check it isn't anything important. Is it?

 

[Gerry Cornell]

Phil

What was the name of the virus?

What have you done about checking for spyware?


--


Hope this helps.

Gerry
~~~~~~~~~~~~~~~~~~~~~~~~
FCA

Using invalid email address

Stourport, Worcs, England
Enquire, plan and execute.
~~~~~~~~~~~~~~~~~~~~~~~~
Please tell the newsgroup how any
suggested solution worked for you.



~~~~~~~~~~~~~~~~~~~~~~~~