Gaming Un-deleteable Virus

[[M]artin]

Hey gang, I've run into a big problem. This morning I booted up my PC and ESET greeted me with this:

So, both "Quarantine" and "Remove" are ticked in the Advanced Options underneath. "Submit File for Analysis" is grayed out, though.

So I hit "Remove" and then this pops up:

I hit "Retry" and eventually get stuck with this:

I have no choice but to click "Cancel" at this point.

The Threat Box has popped up a number of times already and I always get stuck with the same messages.

Whatever the threat is, it's been messing with my internet, causing pages to load a bit sluggish and even cutting it out for a few minutes at a time (about 1 or 2).

Any suggestions on what I should do about this?

 

[moodswinger]

Not sure if you should delete it or not, but you can try gmer.

 

[david432111]

http://www.precisesecurity.com/adware-spy/aw-tswm.htm

Gives a few suggestions.

 

[zidane_genome]

Yea, pretty sure if you delete winlogon.exe your gonna have to reinstall Windows (2000 by the looks of it!)

Kill it in your task manager, then you can try...

 

[[M]artin]

http://www.precisesecurity.com/adware-spy/aw-tswm.htm

Gives a few suggestions.

Thanks a bunch, I'll be trying this out shortly.

lilsypha suggested that I run Autoruns to find to file, and while the program was seeking it out, a new threat popped up note the comment and how it points to the new program I was using to seek it out):

lilsypha suggests that the virus is attaching itself to every .exe I try to run. A number of people in IRC also suggest that a full format is the way to go, but I only want to do so as a last resort.

Shit. Think it was from a (working) IPS patcher from a link posted herehttp://gbatemp.net/index.php?s=&showtopic=159844&view=findpost&p=2033796http://gbatemp.net/index.php?s=&showtopic=159844&view=findpost&p=2033796. Not 100% sure, though.

EDIT: And another Threat message just popped up telling me that the Threat has returned back to winlogin.exe...

 

[Golfman560]

It poped up because ESET checks files as programs use them, so if you were in eplorer.exe and went into the system32 folder I would bet quite a few virus alerts would pop up. The comment would then say it was found when running the application explorer.exe.

 

[Law]

lilsypha suggests that the virus is attaching itself to every .exe I try to run.

I had something similar recently, I had to reformat two of my drives (backed up most of the stuff I wanted to keep that weren't exes on a different drive).

 

[xcalibur]

Hijackthis, Malware antibytes, Ad-Aware, Spybot S&D etc etc.
If all else fails, run in safe mode and delete them manually.

 

[OSW]

My PC is stuffed up on numerous levels... I believe part of it is from when i tried to install a cracked antivirus program...

I'm going to backup everything and start from scratch since I haven't been able to remove these viruses after numerous attempts.

 

[outgum]

Do a system restore, back about a week maybe...
Its a chance, and if it works, better than doing a Full Format.
You cant delete it because its a system32 File
You could try boot command prompt and go chkdsk

Might help

 

[blitzer320]

no load in linux or safe mode and copy the winlogon.exe from your i386 folder on linux live cd this is straight forward but on safe mode you have to kill the winlogon process first winlogon is the program that runs when you first load windows and it asks you for your password so yeah you need it to load windows

 

[cobleman]

System restore wont help if its a WORM it will attach its self to your restore point and infect it as well.
Save what you can to a seperate drive, format and reinstall windows get antivirus on rite away then connect your other drive backup and scan before you open it. You could spend upto 20 hours trying to remove it only to find its infected everything you have opened!

 

[funem]

Get a fresh copy of the file from another PC with the same level of OS as yours, boot into recovery console, rename infected file, copy over the replacement one, reboot PC... If there is a problem go back to recovery console and put the old infected file back until you have another fix to try...

 

[Deleted member 35947]

You'll probably need to remove the infection manually. Combofix and HijackThis should be run to find out more, they should create a log file each. I'd advise going to a forum that specialises in virus removal with both logs from those programs. Combofixer requires you to disable your antivirus temporarily to run also.

 

[raulpica]

Do a system restore, back about a week maybe...
Its a chance, and if it works, better than doing a Full Format.
You cant delete it because its a system32 File
You could try boot command prompt and go chkdsk

Might help

Why bump a thread from the 26th JUNE 2009?

 

[.Chris]

http://www.precisesecurity.com/adware-spy/aw-tswm.htm

Gives a few suggestions.

It does look helpful but my McAfee SiteAdvisor tells me it is unsafe.

 

[Deleted member 35947]

Do a system restore, back about a week maybe...
Its a chance, and if it works, better than doing a Full Format.
You cant delete it because its a system32 File
You could try boot command prompt and go chkdsk

Might help

Why bump a thread from the 26th JUNE 2009?

I didn't even notice the date... lol.

 

[funem]

Do a system restore, back about a week maybe...
Its a chance, and if it works, better than doing a Full Format.
You cant delete it because its a system32 File
You could try boot command prompt and go chkdsk

Might help

Why bump a thread from the 26th JUNE 2009?

I didn't even notice the date... lol.

Same.......

just saw a reply and thought it was under discussion......

 

[.Chris]

Do a system restore, back about a week maybe...
Its a chance, and if it works, better than doing a Full Format.
You cant delete it because its a system32 File
You could try boot command prompt and go chkdsk

Might help

Why bump a thread from the 26th JUNE 2009?

I didn't even notice the date... lol.

Same.......

just saw a reply and thought it was under discussion......

WHOA. its from June 26 2009?? Same here funem...

 

[jalaneme]

kaspersky, end of problem!