Supposed virus on Windows 7 automatically logging out on log in

I have the same issue as this:

Windows 7 automatically logs out when logging in

The windows 7 computer it straight away logs out when trying to log in (doesn't even get to the desktop on this computer unlike this person's description).

However, I think it is not because of a corrupted User Profile but rather a virus. The reason I think this is, it still allows me to load the computer on profile 'Scott' and any new profiles I create. But a background process is limiting startup of other programs. So for example Norton antivirus software cannot be booted.

I've done some investigation and found out that on startup the following is loading: Program - EgrNhwnl from C:\Users\USER\AppData\Local\vaaxwweu\egrnhwnl.exe

Pretty sure it's a virus as it looks like a randomly generated string of characters to deter me from searching what virus it is :(

I've tried removing it from start up by disabling and deleting, but it instantly reappears. I've tried doing this in safe mode as well. I've also tried deleting the file from AppData but it doesn't allow me to do this either.

So my question is: Any ideas for the next move in trying to combat this? Any ideas what virus this might be? (as this will help find a remedy)

Thanks for your help

slawrence10

Posted 2012-12-22T20:31:57.770

Reputation: 105

Do you actually have an anti-virus program installed on your PC? – Lee Taylor – 2012-12-22T21:05:15.360

Yes as question notes, Norton Antivirus does not load – slawrence10 – 2012-12-22T21:10:00.133

Answers

As @Nicole Hamilton mentions a check with Norton may help. In some cases the malware has hidden part of itself in your system restore so if you don't disable System restrore, it returns even after a clean scan. Not sure if that is still common

Somem alware has a component that checks for removal and then reinstalls possibly quickly or after a period of time.

Norton has some special tools available Norton rescue Tools I have used Power Eraser and the corporate version of the bootable tool and they have removed some nasty stuff.

Dave M

Posted 2012-12-22T20:31:57.770

Reputation: 12 811

Thanks @Dave-m, I will try Norton Rescue Tools and get back to you. – slawrence10 – 2012-12-22T21:22:27.603

Amazingly I noticed that even trying to load a norton website on this computer doesn't work. Clever little virus. But downloaded and transferred from another computer. Unlike most programs currently on the computer, which are switched off as soon as executed...Power Eraser is scanning...so fingers crossed! – slawrence10 – 2012-12-22T21:33:04.170

1Having confirmed that your system is that thoroughly compromised, I would copy any files of your own you haven't already backed up (perhaps by moving it to a USB enclosure on another machine) and then reformat and reinstall the OS. – Nicole Hamilton – 2012-12-22T23:10:10.963

I did end up doing a fresh OS install just to be safe, but Norton Rescue Tools opened up the ability to use user profiles again. Thanks guys. – slawrence10 – 2012-12-23T23:04:45.533

Infected with a Trojan – slawrence10 – 2012-12-23T23:05:19.697

Try running your Norton AV in safe mode.

Nicole Hamilton

Posted 2012-12-22T20:31:57.770

Reputation: 8 987

Unfortunately when I try and do this to perform a full system scan it straight away is closed – slawrence10 – 2012-12-22T21:13:58.127