Winlogon.exe Deleted! PLEASE HELP!

[The_Comanch3]

Deleted Winlogon.exe

My Moms/sisters computer was recently infected with a virus, "altnet" "IEupdate" just to throw those out there. But I am not here to ask for a fix. (for the virus anyways) But, I did some research and found some running processes that are coorilated with the virus. I couldn't find them, in the task manager like the site said, or in search. and a multitude of spyware removal tools and virus scanners (trusted programs) and they can't stop it. Not norton, not ad-aware, it sucks. The virus causes many pop ups that tell you that you have such and such worm, this and that, and says to get "SUPER SPYWARE REMOVAL" (i made that name up) which you click yes-it sends you to the site(bad), you click no-it doesn't send you to a site(not so bad) or you click the top X- and it doesn't send you to a site(still bad, but most likely not as bad as clicking no)

So I decided, since this thing hides so well. I might be able to locate it with a better advanced task manager. So I found a program called "advanced task manager" which is a clean program (i hope) because I currently have it on my computer, and it hasn't done anything bad.

So I was able to EVERYTHING that was going through the computer. what programs were running, what files were running, what programs were running those files. and so I would wait for a pop-up to show on screen, and would try and see what processes/files/programs were showing up whenever I got the pop-ups. I semi-unprofessionally concluded that it was "SvcHost" quarantined that, nothing really happened.....and conluded to "winlogon.exe" I quarantined that (BAD IDEA!) computer shut off, goes to reboot, gets to the XP load screen, finishes loading, monitor reads "no signal input" then it restarts and does it all over again, and again, and again.

I do not know if the file I ended was actually winlogon.exe it could have been "Winlogon.exe" "Winlogin.exe" "WinIogin.exe" "WinIogon.exe"


anyways, if you have made it this far in my story, is there any possible way to fix this. I feel bad, because I know this is my fault. My mom currently thinks that the virus just went into High gear. I really need to fix this, because my mom LOVES geneology, and has save-files, pictures and data of her geneology research. and seeing as she has probably spent a good 300+ hours with her Hobby, I would never be able to live that down... being the cause of the loss..... The computer is replacable, its some cheap-$150-$300 so either buy a new one or repair it. which the repair is probably expensive and may not even be able to save the harddrive files. unless I can do it myself. I'm thinking along the lines of getting into Command prompt-whichever "F-" button gets you there during startup. give me some input, please help


P.S. WinLogin.exe (or whatver variation I listed) was NOT deleted as I said in the title, and first words of the post. I Quarantined it by the program 'Advanced Task Manager' I only said delete to catch peoples eyes. I just learned this myself. but I'm sure many many people on here now that when they see 'Winlogon.exe' and 'deleted' in the same sentence, they know its bad. sorry for the long post.

 

[The_Comanch3]

(also, sorry bout the double post, I posted this copy before realizing you can't delete your own threads, if you can let me know. I wanted to make it with a different title)

 

[Po`Girl]

Hi,

You can edit your post with the "Edit" button.

As for the problem,you have four options,as I see it -

1.Try a System Restore from the command prompt See HERE

2.Boot to the XP CD and extract winlogon.exe from the CD to the system 32 folder.

See step 4 HERE (you only need the Winlogon.exe)

3.Boot to the XP CD and do a Repair Install .See HERE

4.If you have no XP CD,remove the Hard Drive and attach it another computer,

either as a "slave" internally,or via a USB/IDE(or SATA) adapter ($20).

Then copy off all the stuff you want to save.

After that you can use the Restore Disks or buy an XP CD to reinstall the OS.

If you want to be completely certain about saving your data,you might copy

off files first,by attaching the HD to another PC,as in No.4

It should not be necessary,though.

 

[The_Comanch3]

Thank you very much, I will look further into your post later. I just want to try an idea I had first..... I'll share it, just to see if I am told that its impossible, so I don't waste to much time trying it.

But I want to try and F-8 it (or whatever F it is) and run an uninstall file of the advanced task manager program from within the command prompt thing. relieving the quarantine placed on it, thus allowing the computer to boot. Is it possible to run .exe's from command prompt..... if so, how would I type out the folder address, because I've been trying on my computer, and I haven't got it to work. ... dont know if I am typing it wrong

 

[Po`Girl]

That`s an interesting idea,but I`m guessing it is a Windows only program and needs Windows to run.

For what it`s worth,the command to run would be -

"C:\Program Files\Innovative Solutions\Advanced Task Manager 4\atm.exe"

That is assuming your boot drive is C of course.

I should also point out that svchost.exe is a VERY IMPORTANT Windows file, too.

The more likely solutions are as previously stated.

You didn`t say whether you had an XP CD or not.

 

[The_Comanch3]

I'm pretty sure I don't have an XP CD but I could always download one from "sources" because I only need to extract the file. not using the whole operating system.

any Idea how to get to windows command prompt on startup?

 

[Po`Girl]

If you read my first post,you will find most of the info you need.

Techspot doesn`t recommend you get anything from "sources",

so it might be an idea to remove the HD and attach to another

computer.From there, you can -

a) Copy off important data

b) Attempt to fix the issue by copying winlogon.exe from
the host computer to the system 32 of your drive,or by
copying it from the quarantine folder.

You will need to "Show hidden files and folders" and "Take ownership"

of files and folders,to do that.