winlogonn.exe - Dangerous
winlogonn.exe
Jeff's Story:
My PC had gotten a bad rootkit that my ISP antivirus software (powered by McAfee) could not detect, nor could fix.
I sought a solution on the Internet and discovered your product and tried out the trial.
You quickly found the rootkit and SAVED my PC!
I haven't had any problems since, and I'm extremely grateful.
Manual removal instructions:
\Admin$\system32\GT.exe
\c$\winnt\system32\GT.exe
The worm receives instructions from an IRC channel on a predetermined IRC server. One such command will trigger the aforementioned spreading.
Steals the CD key of some popular games.
It does the following:
Copies itself as %System%\Winlogonn.exe.
Calculates a random IP address for a computer that it will try to infect.
Attempts to authenticate itself to the randomly generated IP addresses.
Copies itself to computers that have weak administrator passwords, at the following locations:
\\
\\
Remotely schedules a task to run the worm on a newly infected computer.
For manual removal, please delete value: "Windows mangement"="winlogonn.exe"
from the registry keys:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Removal:
Use RegRun Startup Opimizer.