Winlogonhook

SpywareNazi · Sep 30, 2007

hi,, i followed the instructions on how to remove it but it keeps coming back and i don't know what to do!

but i know where the source of the problem is but don't know how to find it.
"HKLM\Software\microsoft\mssmgr\"

so if anyone can help me fix it or tell me how to find the HKLM thanks.
-------------------------------------------------------------------------------------------------------------------
9:34 PM: Removal process completed. Elapsed time 00:00:00
9:34 PM: Quarantining All Traces: trojan agent winlogonhook
9:34 PM: Removal process initiated
9:33 PM: Traces Found: 1
9:33 PM: Full Sweep has completed. Elapsed time 00:36:34
9:33 PM: Warning: Failed to access drive F:
9:33 PM: Warning: Failed to access drive E:
9:33 PM: File Sweep Complete, Elapsed Time: 00:33:39
9:00 PM: Starting File Sweep
9:00 PM: Cookie Sweep Complete, Elapsed Time: 00:00:00
9:00 PM: Starting Cookie Sweep
9:00 PM: Registry Sweep Complete, Elapsed Time:00:00:20
9:00 PM: HKLM\software\microsoft\mssmgr\ (ID = 1776755)
9:00 PM: Found Trojan Horse: trojan agent winlogonhook
8:59 PM: Starting Registry Sweep
8:59 PM: Memory Sweep Complete, Elapsed Time: 00:02:31
8:57 PM: Starting Memory Sweep
8:57 PM: Sweep initiated using definitions version 999
8:57 PM: Spy Sweeper 5.0.5.1286 started
8:57 PM: | Start of Session, September 29, 2007 |
********
8:57 PM: | End of Session, September 29, 2007 |
Keylogger Shield: On
BHO Shield: On
IE Security Shield: On
Alternate Data Stream (ADS) Execution Shield: On
Startup Shield: On
Common Ad Sites Shield: Off
Hosts File Shield: On
Spy Communication Shield: On
ActiveX Shield: On
Windows Messenger Service Shield: On
IE Favorites Shield: On
Spy Installation Shield: On
Memory Shield: On
IE Hijack Shield: On
IE Tracking Cookies Shield: Off
8:55 PM: Shield States
8:55 PM: Spyware Definitions: 999
8:55 PM: Spy Sweeper 5.0.5.1286 started
8:39 PM: | End of Session, September 29, 2007

abri · Sep 30, 2007

Hi SpywareNazi!
Welcome to Major Geeks!

Please run the following scan and then follow the instructions in the box below. After you've finished the Combofix scan and the others which follow, please post the logs to us.

Run this utility:

1. Download this file - Combo Fix
2. Double click combofix.exe & follow the prompts.
Note: Do not mouseclick combofix's window while it is running. That may cause it to stall.
3. When finished, it will produce a log for you. Attach this log to your next reply.
Click to expand...

After you've run Combofix, please follow the instructions and links in the box below!

Welcome to Majorgeeks!

Please follow our standard cleaning procedures which are necessary for us to provide you support. Also there are steps included for installing, running, and posting HijackThis logs as attachments.

Run ALL the steps in this Sticky thread READ & RUN ME FIRST Before Asking for Support

Make sure you check version numbers and get all updates.

Very Important: Make sure you tell us the results from running the tutorial...was anything found? Were you unable to complete any of the scans?...Were you unable to download any of the tools?...Did you do the on-line scans as suggested? etc.

If, after doing ALL of the above, you still have a problem, make sure you have booted to normal mode and run the steps in Downloading, Installing, and Running HijackThis taking care to install it as per the instructions to the proper folder and to properly rename the hijackthis.exe file to analyse.exe. This is very important due to some new infections going around!

When you return to make your next post, make sure you attach the following logs and that you have run these scans in the following order too:

CounterSpy (this one must be saved by you)

(AVG Antispyware log) – this one ONLY IF you were not able to run CounterSpy

Bitdefender – from step 6

activescan.txt – from the Panda scan from step 6

runkeys.txt - the log from GetRunKey.bat

newfiles.txt - the log from ShowNew.bat

hijackthis.txt – the log from the analyse.exe scan – (HijackThis has to be renamed and be in the proper folder – read the instructions!)

NOTE:You can only attach 3 files in a single message so it will require that you use two messages to attach all of these logs!
Click to expand...

abri

SpywareNazi · Sep 30, 2007

ok, i have a problem with my lab right now so it will take sometime to post up a report.

abri · Sep 30, 2007

no problem! It won't run away.

Log in or Sign up

Winlogonhook

SpywareNazi Private E-2

Attached Files:

Report-Scan-20070930-130317.txt

abri MajorGeek

SpywareNazi Private E-2

abri MajorGeek

Log in or Sign up

Winlogonhook

SpywareNazi Private E-2

Attached Files:

Report-Scan-20070930-130317.txt

abri MajorGeek

SpywareNazi Private E-2

abri MajorGeek

Useful Searches