StarDestroyer.Net BBS

Managed to encounter something called winloqon.exe and its done some interesting things to my laptop. I found part of the source and removed it from the registry and startup. Running Spybot and Adaware. Any other recommendations?

MalwareBytes would be my top pick. Run AVG or Avast as well to clean out the viruses, and maybe a HijackThis log to make sure you're clean.

What operating system are you using?

XP SP3

Use Microsoft's MRT here.

I think those did it. No subsequent traces.

Wait, did you say Winlogon? That's a real windows process, not a virus. What happened to your computer?

No, I said winloQon

Fuck it, I'm nuking the laptop this weekend.

Assuming that means it came back I'd run these apps in safe mode if you havent already

Suspicion confirmed. Much harder to remove than first anticipated. All files on this PC are considered disposable and will not be backed up. Reformat to factory specs is the only viable solution at this time.

Or someone bombed a very suspicious site to the top search bracket above Walmart when searching Walmart on Google. Still reformatting this thing.

Reformatting is best, but a system restore to a time before you were infected is often an acceptable work around.

Sriad wrote:Reformatting is best, but a system restore to a time before you were infected is often an acceptable work around.

Did that. Knowing how some virus's work and my complete lack of care about the data on this laptop means I have no problem nuking it from orbit Shep style.

Before you do that, try running TDSSKiller. It's specifically designed to get rid of any rootkits that may have found its way in.

For more extreme cases, there is also Combofix.

Some infections can be pretty hard to crack. But if you are just getting redirection as opposed to, say, having your EXE associations in the registry changed, system restores or system rebuilds are not necessary.