Is Winlog.exe a Virus.Need Help

[kevlawliet]

Malwarebytes found infections should i clean them.I don't know what to do.Is winlog.exe legitimate.

 

[touch]

Hello

It should be safe to fix ->

"winlog.exe - W32/Agobot-LF moves itself to the Windows system folder as winlog.exe and creates the following registry entries to run itself on system startup: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunWindows Login = winlog.exe"

I´ll suggest we check your computer, for more (possible) infections ->

Please run the steps in this guide:

8-step Viruses/Spyware/Malware Preliminary Removal Instructions

Post attached log´s from:

Malwarebyte
Superantispyware
Hijackthis

In your next reply

 

[kevlawliet]

. . .

That means i can remove those three infection right?

 

[touch]

Yes, you can.

Reboot.

Run a scan in HijackThis. Check each of the following and hit 'Fix checked' (after checking them) if they still exist (make sure not to miss any):
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [winlog.exe] C:\Documents and Settings\L\Application Data\Microsoft\winlog.exe

Reboot, attach new hijackthis log and tell how things are running

 

[kevlawliet]

Sorry for the delay i was sick, and why should i remove itunehelper.exe and etc.

 

[touch]

There is no need having itunehelper to startup.

How are things running now ?

 

[kevlawliet]

Everything is working fine Thanks a lot!!!!!

 

[touch]

Great

You should Create a New Restore Point to prevent possible reinfection from an old one.
The easiest and safest way to do this is:
Go to Start > All Programs > Accessories > System Tools > System Restore
Select Create a restore point, and Ok it.
Next, go to Start > Run and type in cleanmgr
Select the More options tab
Choose the option to clean up system restore and OK it.

This will remove all restore points except the new one you just created.

To learn more about how to protect yourself while on the internet, please read Tony Klein´s guide:
How did I get infected in the first place?