Winlogon.exe corrupt

[Guest]

While running a virus scan a friend got the message that a virus was found
and was given the choices of "Heal" or "Quarintine". She choose heal and
then followed the instructions to Reboot. Now the computer will only start
in Safe Mode. Checking the Anti Virus log the "Healed" file was
Winlogon.exe.

Question? How can I copy a good version to C:\windows\system32?
Just trying to copy the file Windows gives the message that the file is in
use and it can't copy. I can't stop Winlogon.exe with Task Mngr.

Any help would be appriciated.
Thanks
Walker

 

[David H. Lipman]

From: "WalkerJ49" <[email protected]>

| While running a virus scan a friend got the message that a virus was found
| and was given the choices of "Heal" or "Quarintine". She choose heal and
| then followed the instructions to Reboot. Now the computer will only start
| in Safe Mode. Checking the Anti Virus log the "Healed" file was
| Winlogon.exe.
|
| Question? How can I copy a good version to C:\windows\system32?
| Just trying to copy the file Windows gives the message that the file is in
| use and it can't copy. I can't stop Winlogon.exe with Task Mngr.
|
| Any help would be appriciated.
| Thanks
| Walker


Download and execute HiJack This! (HJT)
http://www.spywareinfo.com/~merijn/files/HijackThis.exe

Create a HJT log file and post it in one of the below locations...

{ Please - Do NOT post the HJT Log here ! }

Forums where you can get expert advice for HiJack This! (HJT) logs.

NOTE: Registration is not required in the below before posting a log
http://www.thespykiller.co.uk/forum/?action=forum


NOTE: Registration is REQUIRED in any of the below before posting a log
http://www.bleepingcomputer.com/forums/forum22.html
http://castlecops.com/forum67.html
http://www.dslreports.com/forum/cleanup
http://www.cybertechhelp.com/forums/forumdisplay.php?f=25
http://www.atribune.org/forums/index.php?showforum=9
http://www.geekstogo.com/forum/Malware_Removal_HiJackThis_Logs_Go_Here-f37.html
http://gladiator-antivirus.com/forum/index.php?showforum=170
http://forum.networktechs.com/forumdisplay.php?f=130
http://forums.maddoktor2.com/index.php?showforum=17
http://www.spywarewarrior.com/viewforum.php?f=5
http://forums.spywareinfo.com/index.php?showforum=18
http://forums.techguy.org/f54-s.html
http://forums.tomcoyote.org/index.php?showforum=27
http://forums.subratam.org/index.php?showforum=7
http://www.5starsupport.com/ipboard/index.php?showforum=18
http://www.malwarebytes.org/forums/index.php?showforum=7
http://makephpbb.com/phpbb/viewforum.php?f=2
http://forums.techguy.org/54-security/
http://forums.security-central.us/forumdisplay.php?f=13

 

[Elmo]

While running a virus scan a friend got the message that a virus was found
and was given the choices of "Heal" or "Quarantine". She chose heal and
then followed the instructions to Reboot. Now the computer will only start
in Safe Mode. Checking the Anti Virus log the "Healed" file was
Winlogon.exe.

Question. How can I copy a good version to C:\windows\system32?
Just trying to copy the file Windows gives the message that the file is in
use and it can't copy. I can't stop Winlogon.exe with Task Mgr.

Any help would be appriciated.
Thanks
Walker

Does she use AVG? If so, try this:

http://forum.grisoft.cz/freeforum/read.php?4,84847,84856

 

[Guest]

Joe,
Thanks, she uses AVG. The instrustions on the link you provided should fix
the problem. I'll see this afternoon.

Thanks again,
Walker