WEIRD virus thing

[Greyd]

Using Vista (yeah I know...I'm too lazy to reformat right now)

So I got a virus named WNlogon.exe So far the only thing it did was to logon multiple instances of itself, eating up CPU/memory.

I tried deleting it with hijack this, only to have it come back. However, when I went to go to the actual file, this is when it got really weird.

Task manager indicated that it was supposedly at this location c:\Windows\System32\Install\Wnlogon.exe

However, no matter what I used (file explorer, windows search, even dos,) I could not for the life of me find the actual file. I was able to mess with the permissions by locating it through task manager. This finally got it to stop starting up when windows started up. However, I STILL can't get to the actual file itself. (yes, I made hidden files viewable)

Another weird thing is that when I enter c:\Windows\System32\Install\Wnlogon.exe in Chrome/address bar - it shows the file itself.

Any ideas? Suggestions?

 

[Modelworks]

Sounds like a file that was set to run at ring0 level meaning you normally cannot see it, not even with hidden files settings.
Try gmer at gmer.net

 

[Lanyap]

Rootkit maybe? Trend Micro also has a rootkit cleaner program. You can go to trendmicro.com and look for the "free tools" link or you can go directly to it with this link. TM must own this domain too.
http://free.antivirus.com/rootkit-buster/