winlogon.exe seems infected by something

Hi folks,
It would seem that somehow my computer is infected with something.
Whenever I connect to the internet (by activating my wireless connection) NOD32 and Comodo report the following:

First off Comodo Firewall reports that:
C:\WINDOWS\system32\winlogon.exe is trying to connect to 81.95.149.101

Then there is a bunch of other things related to winlogon.exe trying to access files on the net which NOD32 is reporting as viruses.

I think that gives you the idea.

I told Comodo to block these access attempts although the files still triggered alerts from NOD32 suggesting they made it onto my computer.

Here's the details of what NOD32 has had to say today about all this:
I've scanned the computer with NOD32 and nothing comes up.
I've scanned with a-aquared free and it cleaned up a bunch of registry entries related to "blubster". It also removed the file "C:\program files\Common Files\Microsoft Shared\MSInfo\WinService32.exe" and stated it was the "Backdoor.Win32.SdBot.aad" trojan.

XsoftSpy also found teh Blubster stuff.

But none of this has fixed this issue with winlogon.exe doing this odd stuff.

Please advise what I should do.
Thanks a lot of your help.

Regards,

Jonathan

At the bottom of my signature is a link to hijackthis 2.0, click it and scroll down the page and follow directions for hijackthis and copy/paste it back into this thread and post the uninstall list as well please.

__________________
Stalking and killing Spyware

Have we helped you? Please consider a donation to help keep D-A-L free. Click on donate below



MALWARE: READ FIRST Procedures:
|_ SpyBot V1.5 _|_ HijackThis Log __V2.0.2 _|



ASAP: promoting a high standard and quality of security support no matter where you seek help.

Thanks.
I am doing the HJT scan shortly.
For the record, I just tried to run Tweaknow Powerpack 2006 (a great tool I've used for last couple of years) and it warned me that it's program file was corrupt and potentially infected with a virus. It then terminated itself. So I uploaded the particular file it was referring to at http://virusscan.jotti.org/ and the results were as follows:
The other thing I should mention is that yesturday NOD32 told me it's on-demand scanner file had a bad CRC check and may be virus infected. I reinstalled NOD32 and the issue has gone. I note, however, that in the last two days (since this issue arose) NOD32KRN.EXE is using an excessive amount of CPU resources. Basically the AMON scanner is constantly scanning files. I normally only scans files on access, so this suggests to me that something is accessing all the files on my computer -- potentially infecting them?

Jonathan

Looks like I've got a major issue here.
Since NOD32 was not detecting this beast and the online scan showed that BitDefender (among others) was, I downloaded the free version of BitDefender 10. Scanning the system, nearly every .exe. file was coming up as infected with Win32.Virtab.V. They could not be cleaned though. So I tried the scan in safemode. Same issue. Obviously I can't have it delete all these files as many of them are system files.

So what I need is something that can clear the Win32.Virtab.V virus. BitDefender indicates in its virus info pages that it can disinfect this virus, but that is not the case in my experience.

Here is the HJT log:
Here is the uninstall list:
For now I am able to limit the amount of further spreading of the virus by using Process Explorer to identify and kill the processes that it is using to propogate itself. Although it has infected nearly every .exe process running it seems to only be able to proliferate using those processes that can open/access .exe files (like Opus and Explorer).

Thansk for your help. I get the impression this is quite serious and am hoping I can clean it off without a full reinstall. As you can see, I use quite a wide range of applications (IT consultant among other things) and reinstalling takes what feels like days.

Jonathan

UPDATE:
PC is almost completely crippled now.
Takes about 30 mins to get into it after a restart and onto the net.
Tried installing CA Anti-virus to remove the virus (as they indicated it would) but no luck. Didn't detect anything.
NOt sure what to do.
Can't access the internet in Safe mode as I only have wireless connection (via a USB wireless adapter) and that won't load in safe-mode. Also can't use any of my boot repair utility discs because again I can't update the virus scanners on them (no net connection).
Tricky.
Please advise.
Jonathan

Sounds bad, sounds like your computer is on it's last leg.


Try this scanner below, normally is is a quick scan but in your case proabably a long time.


Download Dr.Web CureIt to the desktop:
ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe

* Doubleclick the drweb-cureit.exe file and Allow to run the express scan
* This will scan the files currently running in memory and when something is found, click the yes button when it asks you if you want to cure it. This is only a short scan.
* Once the short scan has finished, mark the drives that you want to scan.
* Select all drives. A red dot shows which drives have been chosen.
* Click the green arrow at the right, and the scan will start.
* Click 'Yes to all' if it asks if you want to cure/move the file.
* When the scan has finished, look if you can click next icon next to the files found:

* If so, click it and then click the next icon right below and select Move incurable as you'll see in next image:


This will move it to the %userprofile%\DoctorWeb\quarantaine-folder if it can't be cured. (this in case if we need samples)
* After selecting, in the Dr.Web CureIt menu on top, click file and choose save report list
* Save the report to your desktop. The report will be called DrWeb.csv
* Close Dr.Web Cureit.
* Reboot your computer!! Because it could be possible that files in use will be moved/deleted during reboot.
* After reboot, post the contents of the log from Dr.Web you saved previously in your next reply. You can use Notepad to open the DrWeb.cvs report.


Good luck.

__________________
Stalking and killing Spyware

Have we helped you? Please consider a donation to help keep D-A-L free. Click on donate below



MALWARE: READ FIRST Procedures:
|_ SpyBot V1.5 _|_ HijackThis Log __V2.0.2 _|



ASAP: promoting a high standard and quality of security support no matter where you seek help.

Hi Neal,
DrWeb found the win32.virut.5 virus in over 2000 exe files.
It cleaned them from all but 10 or so files, which I have moved to quarantine.

The system no longer tries to download virus/trojan infected files from the net when I turn on the wireless. Apps I am running also no longer try to access and infect every exe file on the computer when the PC is running in normal mode.

I do note that the system is taking over 3 minutes, however, to kick into life after I log in. The screen is blank for about 3 mins, then it takes another 2 mins for the desktop and apps to fully load.

It is necessary to post the DrWeb log? It is rather enormous.

Here's the list of files it could not cure:
split.exe;C:\cygwin\bin;Win32.Virut.5;Incurable.Mo ved.;
KnockOut.exe;C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Office;Win32.Virut.5;Incurable.Moved.;
Take10!Timer.exe;C:\Documents and Settings\Jonathan\Desktop;Trojan.MulDrop.8512;Dele ted.;
1.exe;C:\Documents and Settings\Jonathan\Local Settings\Temp;Trojan.PWS.LDPinch.1413;Deleted.;
2.exe;C:\Documents and Settings\Jonathan\Local Settings\Temp;Trojan.MulDrop.4164;Deleted.;
dl[2].exe\data001;C:\Documents and Settings\Jonathan\Local Settings\Temporary Internet Files\Content.IE5\MGD5V9ZL\dl[2].exe;Trojan.DownLoader.31840;;
dl[2].exe;C:\Documents and Settings\Jonathan\Local Settings\Temporary Internet Files\Content.IE5\MGD5V9ZL;Archive contains infected objects;Moved.;
IDriver.exe;C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32;Win32.Virut.5;Incurable.Moved.;
FontExpert.exe;C:\Program Files\FontExpert;Win32.Virut.5;Will be cured after reboot.;
gm.exe;C:\Program Files\Gammadyne Mailer\22.1.2 backup;Win32.Virut.5;Incurable.Moved.;
QuaskPoll.exe;C:\Program Files\Quask\Shared;Probably WIN.WORM.Virus;;


Regards,

Jonathan

Very good,


I see you have CCleaner, run a scan useing the windows tab only up front by default and let it clean what it finds.


Have you checked to see if you need to defrag?


Also you add/remove program is showing this:

BitDefender Free Edition v10
ClamWin Free Antivirus 0.91.2
NOD32 antivirus system


Way to much anti-virus protection which will slow down your PC and actually lower your protection. Suggest you remove all but one then do a search on your PC for any existing files or folders maybe left behind from the two you uninstall.



1. Download this file - COMBOFIX
2. Double click combofix.exe & follow the prompts.
3. When finished, it will produce a log for you. Post that log in your next reply

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall.


Post a new hijackthis log also please.

__________________
Stalking and killing Spyware

Have we helped you? Please consider a donation to help keep D-A-L free. Click on donate below



MALWARE: READ FIRST Procedures:
|_ SpyBot V1.5 _|_ HijackThis Log __V2.0.2 _|



ASAP: promoting a high standard and quality of security support no matter where you seek help.

Hi Neal,
Implementing all that in a moment.
With regards to the multiple virus scanners.
My understanding is this. Of the three there, only NOD32 is an active file monitor (an active resident scanner/monitor). ClamAV and BitDefender 10 (free version) are both passive (scan on demand) scanners. When I use either of these scan-on-demand scanners, I temporarily turn off the NOD32 AMON component (so that it does not check each file that the passive scanner is checking at the same moment). Then when the passive scanner has done its thing, I turn AMON (NOD active monitor) back on.

Is there something wrong with that way of going about things that I should know about?

Cheers,
Jonathan

As long as only one is running in the back ground your ok.

__________________
Stalking and killing Spyware

Have we helped you? Please consider a donation to help keep D-A-L free. Click on donate below



MALWARE: READ FIRST Procedures:
|_ SpyBot V1.5 _|_ HijackThis Log __V2.0.2 _|



ASAP: promoting a high standard and quality of security support no matter where you seek help.