Jump to content
Sign in to follow this  


Recommended Posts

I don't know exactly how but i am infected with this virus or trojan thing that is eating up lots of my memory. My computer now recognises my total memory available as half of what is really available.


It is a WINLOGON.EXE process that keeps appearing in my task manager and msconfig. Impossible to end the process in task manager as it has somehow disguised itself as a critical system process like the real winlogon.exe. When i uncheck it in msconfig and reboot, it just keeps coming back both in my process list and msconfig.


I have tried ad-aware, spybot, panda and trendmicro online scans, but none have done the trick. I even tried to use Killbox to end the process, but when i did that the computer immediately goes to a BSOD and reboots.


Oh and yes, even though the process is supposedly from a WINLOGON.exe file residing in my C:\Windows directory (as i saw from msconfig), i was unable to locate any such file in the directory.


Lots of help needed!

Share this post

Link to post
Share on other sites

:sparkle:This is not an easy one to get rid of but, it can be done.

There's a lot of that going around......


Please follow these instructions so that one of our Trusted HJT Advisors can help you get rid of it.


Download HijackThis! from here:

http://radiosplace.com/ (look in the left hand column)


Put it in a permanent folder (it makes backups) by doing this:

Click My Computer, then C:\

In the menu bar, File->New->Folder.

That will create a folder named New Folder, which you can rename to "HJT" or

"HijackThis". Now you have C:\HJT\ folder. Put your HijackThis.exe there,

and double click to run it.


Click on "Do a system scan and save logfile". The logfile will be saved to



Start a new topic in our HJT forms



Copy and paste the HJT log from notepad in that new topic.


DO NOT post your HJT log in this


Share this post

Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

Sign in to follow this  

  • Create New...