help / advice needed

[psp83]

On my friends laptop avast keeps stopping winlogon.exe as its infected with w32 patched trojan.

I've done a boot time scan and tried to repair the file and it wont let me repair it, wont let me move it to the chest or delete it.

Anything else I can do to recover this file ?

[Rik]

Win 7, Paul?

[psp83]

Win 7, Paul?

Nah, XP SP3

[Glenn]

http://www.xp-vista.com/spyware-removal/trojanwin32patched-removal-instructions

Any use?

[kinmel]

To remove/replace any file in XP....

Start the Recovery Console and then delete, or rename the file.

Then "expand" winlogon.ex_ from the Windows install disk

[Rik]

There's some suggestions here, Paul.

[psp83]

I will try the above.. But now it says explorer.exe is infected with w32 patched-rp.

I might aswell backup and reformat.

[Glenn]

It will be far quicker I think.

[psp83]

Start the Recovery Console and then delete, or rename the file.

Then "expand" winlogon.ex_ from the Windows install disk

They not got a full win xp install disk, just the one that you make when you first buy & power on the laptop.

[Glenn]

Extract it from the HP disk I sent you, Paul.

[DorsetBoy]

Asks the techs at avast!, either via support or on the forum where they have people around 24/7 .

[psp83]

Extract it from the HP disk I sent you, Paul.

I would but it says on a site I read that it needs to be same version etc. The disk you sent me is XP pro and the laptop isn't XP pro.. So would that cause more problems?

Plus explorer is also infected.

Looks like another weekend spent repairing another laptop.

I just wonder why avast didn't stop it in the first place.

I think the safe way is to reformat, there's only 19gb of data that needs backing up anyways so won't take long.