WEIRD virus thing

Greyd

Platinum Member
Dec 4, 2001
2,119
0
0
Using Vista (yeah I know...I'm too lazy to reformat right now)

So I got a virus named WNlogon.exe So far the only thing it did was to logon multiple instances of itself, eating up CPU/memory.

I tried deleting it with hijack this, only to have it come back. However, when I went to go to the actual file, this is when it got really weird.

Task manager indicated that it was supposedly at this location c:\Windows\System32\Install\Wnlogon.exe

However, no matter what I used (file explorer, windows search, even dos,) I could not for the life of me find the actual file. I was able to mess with the permissions by locating it through task manager. This finally got it to stop starting up when windows started up. However, I STILL can't get to the actual file itself. (yes, I made hidden files viewable)

Another weird thing is that when I enter c:\Windows\System32\Install\Wnlogon.exe in Chrome/address bar - it shows the file itself.

Any ideas? Suggestions?
 

Modelworks

Lifer
Feb 22, 2007
16,240
7
76
Sounds like a file that was set to run at ring0 level meaning you normally cannot see it, not even with hidden files settings.
Try gmer at gmer.net