Welcome to MalwareRemoval.com,
What if we told you that you could get malware removal help from experts, and that it was 100% free? MalwareRemoval.com provides free support for people with infected computers. Our help, and the tools we use are always 100% free. No hidden catch. We simply enjoy helping others. You enjoy a clean, safe computer.

Malware Removal Instructions

Trojan Wigon.I

MalwareRemoval.com provides free support for people with infected computers. Using plain language that anyone can understand, our community of volunteer experts will walk you through each step.

Trojan Wigon.I

Unread postby HiTech_boy » March 11th, 2007, 6:54 am

Hello .
I have a little problem with a person's computer .NOD32 detect this trojan in file in his computer
c:\windows\system32\winlogon.exe

Scan performed at: 3/10/2007 16:04:41
Scanning Log
NOD32 version 2106 (20070310) NT
Command line: c:\windows\system32\winlogon.exe
Operating memory - Win32/Wigon.I trojan

Date: 10.3.2007 Time: 16:05:19
Scanned disks, folders and files: c:\windows\system32\winlogon.exe
c:\windows\system32\winlogon.exe - Win32/Wigon.I trojan - deleted (after the next restart) [2]
Number of scanned files: 1
Number of threats found: 1
Number of files cleaned: 1
Time of completion: 16:05:24 Total scanning time: 5 sec (00:00:05)

Notes:
[2] File is being used (open or running). System restart is required for the cleaning to complete.


Generally I have no problem to tell him delete the file with some tools but I'm a little bit concerned because this file coincides with the path of the original legitimate Windows file winlogon.exe. I am concerned because of this and because I have heard of malware which overwrites the original file and if this is deleted the computer will crash.I have heard that such infection should be cured with the Windows CD , running sfc.exe which will replace the infected one with the original one and the trojan will be gone .

Since I have no information about how this trojan works I would like some advice from knowledgable people here and how do I deal with this.

Thanks very much ! ;)
HiTech_boy
Active Member
 
Posts: 1
Joined: March 11th, 2007, 6:45 am
Advertisement
Register to Remove

Unread postby Angelfire777 » March 12th, 2007, 9:12 am

Hi, welcome to Malware Removal :)

Generally I have no problem to tell him delete the file with some tools but I'm a little bit concerned because this file coincides with the path of the original legitimate Windows file winlogon.exe. I am concerned because of this and because I have heard of malware which overwrites the original file and if this is deleted the computer will crash.


Actually, it is the legit Winlogon.exe but it has been patched by malware. You are right, if it gets deleted, the computer won't go in to the desktop anymore..

I have heard that such infection should be cured with the Windows CD , running sfc.exe which will replace the infected one with the original one and the trojan will be gone .


As of now, we can replace it manually if the computer can still boot..

Since I have no information about how this trojan works I would like some advice from knowledgable people here and how do I deal with this.


This trojan is actually very nasty..The patched winlogon.exe is used to call a rootkit on your system..

Before we start, please tell me if the computer can reach the desktop and if so,

*Click HERE to download a self-extracting version of Hijackthis. Double click on the file, by default it will extract itself to C:\Hijackthis

Next, double click on Hijackthis.exe. Click "Scan System and Save a Logfile." A Notepad will appear in your screen, copy and paste the contents of the notepad to your next reply.


*Please download SRENG

1. Extract it to Desktop & double click SREng.exe to run it

2. Select 'Smart Scan' & tick "Verify Digital Signatures"

3. Click on the [Scan] button

4. When finished, click on the [Save Reports] button & save the log to Desktop

5. Copy all the contents of the report to your next reply.
User avatar
Angelfire777
Retired Graduate
 
Posts: 2554
Joined: April 27th, 2006, 9:58 am

Unread postby Angelfire777 » March 20th, 2007, 1:46 pm

Hi, how is it doing?
User avatar
Angelfire777
Retired Graduate
 
Posts: 2554
Joined: April 27th, 2006, 9:58 am

Unread postby NonSuch » April 3rd, 2007, 3:17 am

Due to inactivity, this topic is now closed. If you wish it reopened, please send us an email to 'admin at malwareremoval.com' with a link to your thread.

You can help support this site from this link :
Donations For Malware Removal

Please do not contact us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
User avatar
NonSuch
Administrator
Administrator
 
Posts: 27230
Joined: February 23rd, 2005, 7:08 am
Location: California
Advertisement
Register to Remove


  • Similar Topics
    Replies
    Views
    Last post

Return to Infected? Virus, malware, adware, ransomware, oh my!



Who is online

Users browsing this forum: No registered users and 30 guests

Contact us:

Advertisements do not imply our endorsement of that product or service. Register to remove all ads. The forum is run by volunteers who donate their time and expertise. We make every attempt to ensure that the help and advice posted is accurate and will not cause harm to your computer. However, we do not guarantee that they are accurate and they are to be used at your own risk. All trademarks are the property of their respective owners.

Member site: UNITE Against Malware