winlogon.exe multiple copies

[jhh]

I have been trying to remove the netsky worm from my
computer. The removal tool from norton says it is not
present.

I understand the Worm is related to the winlongon.exe file.
How many places in the file system should have this file.

I have it in 4 places.

The dates of the files do not relate to my system install
date.

Which directorys should have the file.

Also, I have Run the Removal tool, fxnetsky.exe several
times. I am still getting warnings from my e-mail
provider that I am sending out the virus with e-mail.
Any Ideas??
thanks,
JHH

 

[David H. Lipman]

Please go to one or more of the below online scanners and perform a scan of your platform
then report back your results.

Trend:
http://housecall.antivirus.com
http://housecall.trendmicro.com

F-Secure:
http://support.f-secure.com/enu/home/ols.shtml

McAfee:
http://www.mcafee.com/myapps/mfs/default.asp

Panda:
http://www.pandasoftware.com/activescan/

Kaspersky:
http://www.kaspersky.com/de/scanforvirus

Symantec:
http://security.symantec.com/

BitDefender
http://www.bitdefender.com/scan/license.php

Dave




| I have been trying to remove the netsky worm from my
| computer. The removal tool from norton says it is not
| present.
|
| I understand the Worm is related to the winlongon.exe file.
| How many places in the file system should have this file.
|
| I have it in 4 places.
|
| The dates of the files do not relate to my system install
| date.
|
| Which directorys should have the file.
|
| Also, I have Run the Removal tool, fxnetsky.exe several
| times. I am still getting warnings from my e-mail
| provider that I am sending out the virus with e-mail.
| Any Ideas??
| thanks,
| JHH

 

[Gary Smith]

I understand the Worm is related to the winlongon.exe file.
How many places in the file system should have this file.

I have it in 4 places.
The dates of the files do not relate to my system install
date.
Which directorys should have the file.

How many versions of Winlogon.exe you have will depend on your
installation and update history. The current active version is in
\WINNT\system32. There also may be versions in
\WINNT\ServicePackFiles\i386, \WINNT\$NtServicePackUninstall$ and possibly
in some patch uninstall folders. There should NOT be a copy in \WINNT
itself, or in \WINNT\system, or in any of the other Windows folders.