Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My daughter clicked on a baitFacebook posting and now we believe that our PC is infected with a Virus that is sending out similar bait postings to her friends.

I narrowed it down to a folder

C:\Program Files\msn gaming zone\windows

I am unable to delete the folder,so I used an app Unlocker to show me what file or folders are locked:

alt text

If I kill winlogon.exe, my PC blue screens.

I can delete the folder in safe mode, but the folder restores itself.So far, I cannot identify the process responsible for putting this folder back in place.

Any idea where this winlogon.exe actuallyresides? The \??\path is strange.I believe that the winlogon.exe is a required file. could it have REPLACED Microsofts so that it performs the same required function but also injecting virus behavior?

I need help in getting rid of this muffer.

share|improve this question

WinLogon is the process that allows you to log in on Windows; if you kill it, you see the BSOD, as you noticed.
The executable is in C:\WINDOWS\System32.

A UNC starting with \\?\ is called long UNC (or UNCW); \\?\C:\WINDOWS is equivalent to C:\WINDOWS.

share|improve this answer

Since the program is not locked in Safe Mode, it is likely that it is not running then - this should make it easier to remove. You could try running an up-to-date antivirus scan on your hard drive in Safe Mode; this might find the other malicious software on your computer that is restoring the malicious folder.

Here are some auxiliary tools that might help if your antivirus program has issues:

  • Process Explorer - Task Manager on steroids, and with pretty colors.
  • HijackThis - shows you programs, DLLs, and other executables that start up automatically
  • Rootkit Revealer - shows files with strange attributes, which may be caused by a rootkit.
share|improve this answer

I've applied the diagnostic tools and still have the same result that the "msn gaming zone" directory keeps getting re-created. Do you have a definitive way to fix this issue? I'm unable to replace winlogon.exe as its a basic windows process. Thanks, Dave

share|improve this answer
    
Perhaps some spyware byproduct? Run an antivirus and a spyware remover. – vonbrand Feb 7 '13 at 19:59
    
msn gaming zone isn't malware. Furthermore the author was killing winlogon.exe and getting a BSOD which is to be expected when you kill a system process. – Ramhound Feb 7 '13 at 20:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .