Explorer.exe, Winlogon.exe Infected

Greetings,

I'm working with a deeply infected PC.

Its performance is very, very sluggish. I've had an exceedingly difficult time running anti-virus and anti-malware software simply because they won't run at all or will run but with strict limits as a result of the infection.

Independent of your forum's preliminary removal procedures, I attempted to install and run Avast. Avast installed without much hassle and proceeded to perform a quick scan just prior to completing its installation. After the quick scan, it asked if it could perform a boot time scan, which I agreed to. The boot time scan unveiled an enormous number of infected files and Avast was able to repair or quarantine all but two: explorer.exe and winlogon.exe

With that, I decided to do a little bit of research and I discovered that these two system files are frequently infected in combination. But I also discovered that repairing them isn't easy; hence why I registered with your forum for your assistance in this matter going forward.

Unfortunately, I encountered issues running all of your software, and I'll explain in what way I had problems with each of them:

SUPERAntiSpyware
I couldn't install SUPERAntiSpyware without renaming the installation file. After installing it, I was unable to run it, even after renaming the executable. However, I was able to run SUPERAntiSpyware Portable. I attached a log.

Malwarebytes Anti-Malware
I was able to install Malwarebytes Anti-Malware without much hassle, but I couldn't run the executable without renaming it. I attached a log.

ComboFix
I couldn't run ComboFix as is. It simply won't open. I haven't tried renaming it yet, and I didn't want to take that step unless specifically instructed to.

RootRepeal
RootRepeal was literally crashing and rebooting my PC each time I tried to run it normally. Renaming it wasn't helping matters. So I decided to try it in Safe Mode. As luck would have it, it opened without crashing my PC. But upon opening it, I got an error message saying: "invalid PE image found!" I clicked OK, and then clicked the "Scan" button. A list of drivers and system files populated the window. But a "Select Drives" form didn't open as described in the instructions. I saved a log and attached it to my thread, but I don't know how helpful it will be.

MGtools
I seemed to have the most luck running MGtools as is right up until I got error message type 4: "Process DLL.EXE - Application Error The application failed to initialize properly (0xc0000135) Click on any key to terminate." I attached the logs.

Other thoughts and observations

• I considered reformatting and reinstalling Windows XP until I discovered that I'm unable to boot from my Windows XP installation disc for some odd reason. I double checked my PC's BIOS and my CD-ROM drive definitely has priority over the hard disk drive in the boot order. What makes this even stranger is that the PC won't recognize the Windows XP installation disc when I'm in Windows, but it will recognize other discs such as my Microsoft Office installation disc. I know that my Windows XP installation disc is good because I've tested it in several other disc drives. One thing I haven't tried yet is booting to a different disc, like Knoppix.
• Doing anything on this PC after booting normally is just excruciatingly slow. But it's actually manageable after booting to Safe Mode.
• The PC won't recognize USB flash drives at all. There's no prompt. It doesn't show up in explorer. Just nothing at all. I don't know if this is part of the infection or a product of malfunctioning hardware.

If I think of anything else, I'll edit my post.

I appreciate any help or insight you could offer, and I apologize if I left anything out of my thread that might otherwise be of service to you up front.

Thank you for investigating and helping me solve this problem.

 

Hi TimW. Thank you for replying.

I renamed ComboFix.exe to 123.exe as you suggested, and I was able to run it this time.

After some time, it prompted me to download and install Windows Recovery Console. I agreed. A few moments later, it warned that it didn't appear my PC was behind an active Internet connection. I know for a fact that isn't the case. In spite of how infected my PC is, I'm still able to browse web sites. In fact, if I wasn't behind an active Internet connection, I wouldn't have been able to email myself logs produced on the infected PC. Regardless, the download failed, but the scan continued. I attached a log.

Unfortunately, I was unable to locate an avast log assuming that one was even created. It could be that it was removed unintentionally after I uninstalled avast. The only reason why I did that is because I couldn't interact with the software. With the exception of the boot time scan that it offered to perform during the installation process, I couldn't open the user interface and I couldn't bring up a menu from the system tray. Since I was unable to figure out how to disable its active protection feature, I just thought it best to uninstall it for now so that I could run this other software without interference.

 

I'm having some difficulty completing these steps.

After dragging and dropping CFScript.txt on top of ComboFix.exe (mine is still named 123.exe), it proceeded to load a series of files before launching the blue command prompt. Then it prompted me about downloading and installing Windows Recovery Console, but it still failed just as described in my original post. But now it's stalling at the window which says:

"Scanning for infected files . . ."
"This typically doesn't take more than 10 minutes"
"However, scan times for badly infected machines may easily double"

After sitting there for more than an hour doing absolutely nothing, I thought I'd try it again. I carefully executed each step exactly as you described in your instructions until I returned to this window. Then I left it overnight in hopes that it would proceed scanning sooner or later.

When I woke up this morning, I discovered that it still hadn't scanned anything. It's just perpetually stalled at this window.

As I reported earlier, ComboFix has completed its scan successfully before after I renamed it to 123.exe. Why it's not completing now I can only guess has something to do with the script I'm launching in combination with it.

Is there something else I can try? Would there be any benefit to launching the script in combination with ComboFix in Safe Mode?

 

I updated ComboFix and ran through all the steps again, but I'm once again stalled at that same window I described earlier.

 

I have attached the SystemLook log.

 

Thanks for replying chaslang.

I agree this PC could definitely use a lot more physical memory.

I renamed combofix.exe to 123.exe in accordance with TimW's instructions. "ComboFix.exe" doesn't launch at all, but "123.exe" does. Should I have approached this step differently?

 

Even in Safe Mode, if it's called "ComboFix.exe", it will not launch. But if I rename it to "123.exe", it will.

Would you like me to try running it in combination with CFScript.txt in Safe Mode?

 

Well, I have to admit I'm very confused now.

As I mentioned before, ComboFix launches in Safe Mode, but it's stalling at that AutoScan window I described before. In fact, it stalls there whether I use CFScript or not.

That's when I realized I haven't been able to complete a ComboFix scan since I completed it the first time and posted the log.

Out of curiosity, I booted normally and attempted a ComboFix scan without CFScript. Sure enough, it's stalling at the AutoScan window. It would seem that ComboFix simply won't scan at all now.

I'm not really sure what's changed to cause this behavior. All I remember doing since completing that first scan is updating ComboFix to the latest versions.

 

Thank you chaslang,

I have attached the logs you requested.

 

I really, really wanted to return this morning with good news, but I'm afraid it's just more of the same from my end.

I followed your instructions right down to the letter. After I clicked the "Run Fix" button, I watched as the desktop icons and Windows task bar disappeared, and OTL's status changed to "Killing processes. DO NOT INTERRUPT . . ." I waited patiently for something else to happen since your instructions mentioned a possible reboot and the creation of a log file. After an hour passed with no update to OTL's status, I gave up and went to bed leaving OTL to continue overnight. When I checked on it this morning about eight hours later, nothing had changed. OTL's status remains "Killing processes. DO NOT INTERRUPT . . ."

Is it possible that these processes are being stalled due to a lack of available physical memory? If so, I think I might have a spare 512 MB stick I can salvage from a obsolete PC. That would bump up the infected PC's physical memory from 256 MB to 768 MB.

By the way, I don't recognize any of those MountPoints you inquired about before. To be honest with you, this isn't actually my PC. It belongs to a friend. I'm just trying to get it back in working order for them. But if I had to guess, I doubt they'd recognize those items too.

I don't know if this is related or not, but since you mentioned those MountPoints, I noticed that there are a series of Removable Drives in Windows Explorer (drives E, F, G, and H) that are hanging around but don't appear to point to anything physical. When I click on one and try to access it, I receive an error message about needing to insert a disc. I don't think those drives are supposed to be there, but at the same time I'm not sure if they're actually doing any harm.

 

I upgraded the infected PC's RAM from 256 MB to 768 MB. The expected performance boost from tripling the physical memory was immediately noticeable.

With that, I attempted the OTL Fix again, but it's still stalling at the Killing Processes phase I described before.

Would there be any benefit to attempting the OTL Fix in Safe Mode?

 

Hah! Running the OTL Fix in Safe Mode did the trick! I attached the requested logs.

Unfortunately, I haven't had much time to inspect the infected PC after OTL completed. And I realize now that any performance enhancement I observe from this point on may just as easily be attributed to the additional RAM I recently installed. However, I have noticed that I can open SUPERAntiSpyware now, which is something I couldn't do before (even after renaming it). But some peculiarities remain. For example, while I can open SUPERAntiSpyware now, any attempt to update its definitions fails instantaneously. In addition, I'm still unable to open Malwarebytes Anti-Malware without renaming it first.

But I definitely think we're on the right track and I'm very optimistic about the progress we've made so far. Thank you so much for your assistance.

 

Unfortunately, I couldn't run OTL normally. It's still stalling indefinitely at "Killing Processes." But it once again worked immediately in Safe Mode. I posted the requested logs.

The good news is I have my Windows XP Professional installation disc. The bad news is I think the infected PC's CD/DVD-ROM drive is malfunctioning.

It has power. I can open and close the drive bay normally. It's recognized by BIOS. And it's recognized by Device Manager in Windows. The problem is it's not reading any of the discs I've tested. I've tried booting the infected PC with my Windows XP Professional installation disc, Windows Recovery Console disc, Knoppix disc, and Ultimate Boot CD, but nothing works. It boots straight to Windows each and every time.

And I've triple checked my boot order in BIOS and the CD/DVD-ROM drive definitely has the highest priority.

I just think the drive is malfunctioning because it won't read discs in Windows either.

I might have a spare CD/DVD-ROM drive lying around that I can replace the suspected malfunctioning one with. If not, or if it turns out that it's not the drive but something else at play, is there an alternative solution to not having the ability to boot to disc?

 

I have some good news.

I replaced the infected PC's CD/DVD-ROM drive with a spare one I found. I can now boot from discs and read discs in Windows. So I'm ready for the next step.

 

Thanks as always, chaslang.

I was able to run through your latest set of instructions without much trouble. I have attached the requested logs.

 

The PC seemed to be running pretty well, although some peculiarities remained. For example, Windows recognized what appeared to be four removable drives--E, F, G, and H--in Explorer, but not a single one of them pointed to anything physically connected to the PC. I also noticed that a Generic Win32 process would inevitably crash shortly after booting to Windows. I'm not really sure what the consequences were of that since I didn't observe anything unusual in the wake of the crash. But the fact that it was crashing is obviously out of the ordinary. Finally, and this was the most concerning thing to me, some applications still were not functioning properly. Specifically, SUPERAntiSpyware's attempts at updating its definitions would fail instantaneously, and Malwarebytes Anti-Malware still would not open unless the executable file was renamed first.

I didn't want to assume anything about the state of the infection at this point. It seemed to me that explorer.exe and winlogon.exe had been restored at the very least, and I was very happy with our progress. So with that I decided to reinstall Avast. After all, it was Avast's boot time scan that alerted me that explorer.exe and winlogon.exe were infected in the first place, and it was also Avast that kept crashing prior to asking your forum for assistance with this infection. What better time than now to see if Avast would start functioning properly, I thought.

So I reinstalled Avast and once again agreed to have it perform a boot time scan next time I restarted. Prior to restarting, I was a bit disheartened to see that AvastGUI was still crashing just like it was before. Nevertheless, I forged ahead and restarted. What happened next was not the boot time scan I scheduled, but a seemingly infinite cycle of reboots that would occur when the Windows loading screen would normally appear in the boot sequence. I attempted to boot using the Last Known Good Configuration, but that resulted in an automatic reboot as well. I also attempted to boot to Safe Mode with and without Networking, but that process would freeze right after loading all of its drivers (with MUP.SYS being the last one, if I recall).

To be clear, the computer was booting fine before. What seemed to serve as the catalyst to this latest problem was my scheduling of Avast's boot time scan.

At this point, I decided to talk to the PC's owner and I described the latest round of problems I was having. Since they weren't interested in recovering or backing-up any software or personal files in the first place, they agreed with my recommendation that we simply start fresh by reformatting the hard drive and reinstalling Windows. In retrospect, I suppose this option was always available to us ever since I replaced the PC's malfunctioning CD-ROM drive.

Last night, I successfully reformatted and reinstalled Windows XP Professional. I'm currently in the process of downloading and installing all of its subsequent Service Packs and updates. I'm planning on converting this rig into a fortress based on your advice in this post. I'm also planning on talking to the owner about investing in some new physical memory, since 256 MB is clearly not enough to run adequately by today's standards.

I wanted to once again thank you and TimW for your assistance. I really appreciate all the time you spent helping me out with this problem. Does your site accept donations?

I guess at this point you can consider my case closed. Thanks again.

 

Absolutely! It would be my pleasure.