Anonymous login, PC changes settings

KiD6160 · Nov 26, 2013

Hi
My sister asked me to take a look at her pc because its opening programs and changing settings on its own. I looked in the event log and found an anonymous login so i began the process for malware removal and attached are the log files i came up with.

This site is awesome and you all rock!
Thank you for helping so many people

Kestrel13! · Nov 26, 2013

Uninstall

Viewpoint Manager (Remove Only)
Viewpoint Media Player

Please re run Hitman and have it delete the Malware Remnants & Potential Unwanted Programs.

Download OTL to your desktop.

Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.

Vista and Windows 7 users Right-click OTL and choose Run as Administrator)

When the window appears, underneath Output at the top change it to Minimal Output.

Check the boxes beside LOP Check and Purity Check.

Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.

Attach both of these logs into your next reply.

KiD6160 · Nov 26, 2013

Thanks for the reply and here are the logs you requested.
Sorry i didn't include this earlier but if it helps this is the system info.
WinXP Home SP3
AMD Athlon 1700+
1.47 GHZ 1.00 GB Ram

Kestrel13! · Nov 27, 2013

And how are things running now?

KiD6160 · Nov 27, 2013

Really slow. Looking at the security event log i still see this anonymous logon each time i turn on the computer. Should i be concerned with this, or is it some type of standard procedure. Here is the info it shows for the logon.
User: NT AUTHORITY\ANONYMOUS LOGON
Successful Network Logon
User Name:
Domain:
Logon ID: (0x0,0x1245E)
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: NTLM
Workstation Name:
Logon GUID:

Kestrel13! · Nov 27, 2013

You can ask about this in the software forum.

If you are not having any other malware problems, it is time to do our final steps:

We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware.

Renable your Disk Emulation software with Defogger if you had disabled it in step 4 of the READ & RUN ME.

Go to add/remove programs and uninstall HijackThis. If you don't see it or it will not uninstall, don't worry about it. Just move on to the next step.

If running Vista, Win 7 or Win 8, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Now goto the C:\MGtools folder and find the MGclean.bat file. Double click ( if running Vista, Win7, or Win 8 Right Click and Run As Administrator ) on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

KiD6160 · Nov 28, 2013

Thank you for all your help.

Kestrel13! · Nov 29, 2013

You are most welcome. Safe surfing!

Log in or Sign up

Anonymous login, PC changes settings

KiD6160 Private E-2

Attached Files:

RKreport[0]_S_11252013_192451.txt

mbam-log-2013-11-25 (19-31-01).txt

TDSSKiller.3.0.0.19_25.11.2013_20.24.27_log.txt

HitmanPro_20131125_2106.log

MGlogs.zip

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

KiD6160 Private E-2

Attached Files:

OTL.Txt

Extras.Txt

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

KiD6160 Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

KiD6160 Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member