Facebook Winlogon.exe MSN Gaming Zone virus

Question

My daughter clicked on a baitFacebook posting and now we believe that our PC is infected with a Virus that is sending out similar bait postings to her friends.

I narrowed it down to a folder

C:\Program Files\msn gaming zone\windows

I am unable to delete the folder,so I used an app Unlocker to show me what file or folders are locked:

If I kill winlogon.exe, my PC blue screens.

I can delete the folder in safe mode, but the folder restores itself.So far, I cannot identify the process responsible for putting this folder back in place.

Any idea where this winlogon.exe actuallyresides? The \??\path is strange.I believe that the winlogon.exe is a required file. could it have REPLACED Microsofts so that it performs the same required function but also injecting virus behavior?

I need help in getting rid of this muffer.

Answer 1

WinLogon is the process that allows you to log in on Windows; if you kill it, you see the BSOD, as you noticed.
The executable is in C:\WINDOWS\System32.

A UNC starting with \\?\ is called long UNC (or UNCW); \\?\C:\WINDOWS is equivalent to C:\WINDOWS.

Answer 2

Since the program is not locked in Safe Mode, it is likely that it is not running then - this should make it easier to remove. You could try running an up-to-date antivirus scan on your hard drive in Safe Mode; this might find the other malicious software on your computer that is restoring the malicious folder.

Here are some auxiliary tools that might help if your antivirus program has issues:

• Process Explorer - Task Manager on steroids, and with pretty colors.
• HijackThis - shows you programs, DLLs, and other executables that start up automatically
• Rootkit Revealer - shows files with strange attributes, which may be caused by a rootkit.