Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

My daughter clicked on a baitFacebook posting and now we believe that our PC is infected with a Virus that is sending out similar bait postings to her friends.

I narrowed it down to a folder

C:\Program Files\msn gaming zone\windows

I am unable to delete the folder,so I used an app Unlocker to show me what file or folders are locked:

alt text

If I kill winlogon.exe, my PC blue screens.

I can delete the folder in safe mode, but the folder restores itself.So far, I cannot identify the process responsible for putting this folder back in place.

Any idea where this winlogon.exe actuallyresides? The \??\path is strange.I believe that the winlogon.exe is a required file. could it have REPLACED Microsofts so that it performs the same required function but also injecting virus behavior?

I need help in getting rid of this muffer.

share|improve this question

3 Answers 3

WinLogon is the process that allows you to log in on Windows; if you kill it, you see the BSOD, as you noticed.
The executable is in C:\WINDOWS\System32.

A UNC starting with \\?\ is called long UNC (or UNCW); \\?\C:\WINDOWS is equivalent to C:\WINDOWS.

share|improve this answer

Since the program is not locked in Safe Mode, it is likely that it is not running then - this should make it easier to remove. You could try running an up-to-date antivirus scan on your hard drive in Safe Mode; this might find the other malicious software on your computer that is restoring the malicious folder.

Here are some auxiliary tools that might help if your antivirus program has issues:

  • Process Explorer - Task Manager on steroids, and with pretty colors.
  • HijackThis - shows you programs, DLLs, and other executables that start up automatically
  • Rootkit Revealer - shows files with strange attributes, which may be caused by a rootkit.
share|improve this answer

I've applied the diagnostic tools and still have the same result that the "msn gaming zone" directory keeps getting re-created. Do you have a definitive way to fix this issue? I'm unable to replace winlogon.exe as its a basic windows process. Thanks, Dave

share|improve this answer
    
Perhaps some spyware byproduct? Run an antivirus and a spyware remover. –  vonbrand Feb 7 '13 at 19:59
    
msn gaming zone isn't malware. Furthermore the author was killing winlogon.exe and getting a BSOD which is to be expected when you kill a system process. –  Ramhound Feb 7 '13 at 20:33

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.