wVnlogin.exe, or w?nlogin.exe

[zebratech]

Hi all,

wVnlogin.exe, or w?nlogin.exe keeps popping up in the process list on only one account on my xp pro machine. Can't find any useful info on the net about it but my instincts say that it is malware of some form. Anybody encounter this yet or know anything about it?

Thanks,



Unix IS user friendly... It's just selective about who its friends are.

 

[erikhertzel]

I haven't seen that one yet. But, I suspect they are mimacking winlogin.exe a legit process.

I would run:

AdwareSE
Spybot S&D
Microsoft's Beta Antispyware
Hijack This

Also, check your msconfig startup and see if there something there that is starting the process. These tools should fix you up.

Hope this helps.

Erik

 

[MichealC4]

I had a similar process once, except it was ??plorer.exe. File analysis showed that it popped up ads and pretended the OS crashed on every boot up (in the Run key), and sent the data to a certain site. Sounds like this one is using non-standard characters that Windows will see as winlogin.exe instead of w?nlogin.exe that it should be. So yes, I second Erik's suggestions. Be sure to turn off System Restore first.

----------------------------
"Will work for bandwidth" - Thinkgeek T-shirt

 

[diogenes10]

re system restore,
Could also check system restore for a good restore point prior to start of problem.

-------------------------------------
It's 10 O'Clock ( somewhere! ).
Are your registry and data backed up?

 

[CableInstaller]

??plorer.exe etc are quite common, they are using characters from the russian alphabet as replacements for originals(because they look similar).
Windows will show the characters when browsing so it is hard to spot, other than "explorer.exe" not being sorted by name properly.
Do file find and search *plorer.exe . Its easy to spot the fake ones, or at worst, the one that has no file properties.

 

[zebratech]

Thanks for the help, I have tried running the above programs and AVG, but no help, it shows up in when I run sysinternals Processexplorer but not in task manager. I have removed it manually several times (c:\windows\system32\w?nlogin.exe), but it keeps on showing up in my daughters account, on her process list, on our home pc. Don't know what site she is getting it from, and I'm trying to track down what ports it uses as I suspect it may be a trojan.




Unix IS user friendly... It's just selective about who its friends are.