Malware/Spyware Problems

Hey I'm not a noob but I def have been having a problem lately with my computer. I have fallen in the winlogonhook dilema (detected by spysweeper), as well as a few others including pmnlm.dll in system 32 (detected by Ewido).
I have read and gone through the read first advice section, which proved to be s;ightly helpful, but not really fixing my problem. Attatched are a vast array of scans and searches I have done within the past 24 hours. Somebody help me!!


The Symptoms:

When Ewido is running I recieve repeated popups warning me about Windows\system32\pmnlm.dll being infected.

Since installling and running Counter Spy I recieve countless popups for spyware on my comp I have blocked them so far, but the popups are still annoying.

Spysweeper still shows trojan hook for winlogon, so it is quarintined as of right now.

Avast detected several viruses as well before I used the bdscan or panda:


7/5/2006 12:40:21 AM Shane 424 Sign of "Win32:Trojan-gen. {Other}" has been found in "C:\Program Files\MyWay\myBar\1.bin\NPMYWAY.DLL" file.
7/5/2006 12:44:22 AM Shane 424 Sign of "Win32:Adware-gen. [Adw]" has been found in "C:\Program Files\Screensavers.com\Installer\bin\ScreensaversInst.dll" file.
7/6/2006 6:48:24 AM Shane 1688 Sign of "Win32:Adware-gen. [Adw]" has been found in "C:\Program Files\Vg\~GLH0036.TMP" file.
7/6/2006 6:48:52 AM Shane 1688 Sign of "Win32:Adware-gen. [Adw]" has been found in "C:\Program Files\Vg\~GLH0036.TMP" file.
7/6/2006 6:49:00 AM Shane 1688 Sign of "Win32:Adware-gen. [Adw]" has been found in "C:\Program Files\Vg\~GLH0037.TMP" file.
7/7/2006 7:39:42 PM SYSTEM 1704 Sign of "JS:Feebs [Wrm]" has been found in "http://www.advancedhunt.com/popup/zpopup.cgi\unp9218016" file.
7/11/2006 9:07:20 AM SYSTEM 420 Function setifaceUpdatePackages() has failed. Return code is 0x20000011, dwRes is 20000011.
7/11/2006 9:07:20 AM SYSTEM 420 An error has occured while attempting to update. Please check the logs.
7/11/2006 9:13:11 AM SYSTEM 452 Function setifaceUpdatePackages() has failed. Return code is 0x20000011, dwRes is 20000011.
7/11/2006 9:13:11 AM SYSTEM 452 An error has occured while attempting to update. Please check the logs.
8/25/2006 12:53:55 AM Shane 1692 Sign of "Win32urityscan-S [Trj]" has been found in "C:\Program Files\Cowabanga\OINSetup.exe\[UPX]" file.
8/25/2006 12:53:59 AM Shane 1692 Sign of "Win32:Zlob-HM [Trj]" has been found in "http://85.255.116.211/pa/l11.exe\[Upack]" file.
8/25/2006 12:54:02 AM Shane 1692 Sign of "Win32urityscan-S [Trj]" has been found in "C:\DOCUME~1\Shane\LOCALS~1\Temp\oins.exe\[UPX]" file.
8/25/2006 12:54:05 AM Shane 1692 Sign of "Win32urityscan-S [Trj]" has been found in "C:\WINDOWS\system32\oins.exe\[UPX]" file.
8/25/2006 12:59:59 AM Shane 1692 Sign of "Win32urityscan-S [Trj]" has been found in "C:\Program Files\Cowabanga\OINSetup.exe\[UPX]" file.
8/25/2006 12:05:23 PM SYSTEM 308 Sign of "Win32:Trojan-gen. {Other}" has been found in "F:\Spyware Remover\Spyware Doctor 3.2.2.417 for Windows good\Spyware Doctor 3.2.2.417 for Windows.exe" file.
8/25/2006 12:05:36 PM SYSTEM 308 Sign of "Win32:Trojan-gen. {Other}" has been found in "F:\Spyware Remover\Spyware Doctor 3.2.2.417 for Windows good\Spyware Doctor 3.2.2.417 for Windows.exe" file.
8/25/2006 11:45:25 PM SYSTEM 624 Sign of "Win32:CTX" has been found in "http://acs.pandasoftware.com/activescan/as5free/motor.cab\pskavs.DLL" file.


Any Help would be greatly appreciated!


Nwkid

 

Welcome to MajorGeeks.com!

Please follow our standard cleaning procedures which are necessary for us to provide you support. Also there are steps included for installing, running, and posting HijackThis logs as attachments.

- Run ALL the steps in this Sticky thread READ & RUN ME FIRST Before Asking for Support

• Make sure you check version numbers and get all updates.

After doing ALL of the above you still have a problem make sure you have booted to normal mode and run the steps in the below link to properly use HijackThis:

Downloading, Installing, and Running HijackThis

When you return to make your next post, make sure you attach the following logs and that you have run these scans in the following order too (these scans are covered in steps 6 & 7 of the READ & RUN ME sticky)

• Bitdefender
• Panda Scan
• HijackThis

 

Ok so I have been able to get rid of the winlogon hook trohan but now, I am having trouble with "Adware Virtumonde". Ewido is the only program that picks it up, and i am unable to delete it.

I tried to use the newest version of http://www.atribune.org/content/view/24/2/

Vundofix.exe but it ran a scan and said that there were no files detected. I dunno what to do next.. is it possible that this things using a rootkit or something? I have attatched my most recent Ewido log and HJT.

Thank you.


Nwkid

 

Ok so I have been able to get rid of the winlogon hook trohan but now, I am having trouble with "Adware Virtumonde". Ewido is the only program that picks it up, and i am unable to delete it.

I tried to use the newest version of http://www.atribune.org/content/view/24/2/

Vundofix.exe but it ran a scan and said that there were no files detected. I dunno what to do next.. is it possible that this things using a rootkit or something? I have attatched my most recent Ewido log and HJT.

Thank you.


Nwkid

 

Complete the instructions given to you by Shadow_Puter_Dude in post #2. Once finished, please attach the logs from BitDefender and the Panda Active Scan so they can be reviewed and he can then give you further help.

 

I ran Bit defender again.. it came up clean. I tried to run the Panda Scan, which I have used before with no problems, but I was unable to get it to work. After choosing to scan my hard disks the app would just sit there, Tskmngr showed no initial problems with it either. Regardless i ran another HJT and will leave it here in hopes that Someone can help. My Computer has been ok, I have not noticed any strange popups or decreased speed, but Ewido still reports the adaware C:\WINDOWS\system32\pmnlm.dll -> Adware.Virtumonde,
It also has it listed as an "error" browser plugin with the CSID of :

90A811EE-57C8-46C1-8A38-4E8F814251A6

I have removed it Ewido but It just reapears.

Thank you for the assistance.

Nwkid

 

Exit Ewido, SpySweeper, and CounterSpy; exit them completely, don't just disable the programs.

Rename hijackthis.exe to analyse.exe. Do this now, before proceeeding.

Follow the directions for Running WinPfind by OldTimer.

Post WinPFind.txt and a fresh HijackThis log.

 

I did as you said, shut all down and ran that scan along with naother HJT. I did notice right away the differencein my Hijack log. It never even occured to me that I should exit all the malware/adware filter progs before running a scan

Thank you for the insight



Nwkid

 

Please download VundoFix.exeto your desktop.

• Double-click VundoFix.exe to run it.
• Put a check next to Run VundoFix as a task.
• You will receive a message saying vundofix will close and re-open in a minute or less. Click OK
• When VundoFix re-opens, right Click inside the listbox (white box) and click add more files
• Copy&Paste the entries below into the top 2 boxes
  • C:\WINDOWS\system32\pmnlm.dll
  • C:\WINDOWS\system32\mlnmp.*
• Click Add Files and Click Close Window
• Click Scan for Vundo button.
• Once it's done scanning, click the Remove Vundo button.
• You will receive a prompt asking if you want to remove the files, click YES
• Once you click yes, your desktop will go blank as it starts removing Vundo.
• When completed, it will prompt that it will shutdown your computer, click OK.
• Turn your computer back on.
• Please attach the C:\vundofix.txt file to your next message

 

I ran the Vundofix.exe as you said, the scan supposedly came up clean, and it

notified e that it would attempt removal of C:\WINDOWS\system32\pmnlm.dll

I don't think it worked though, Ewido still picking it up. But no other scan I

have run has. Also another HJT log attacthed for informative purposes. Additionally

A friend o fmine who had been having the same problems as me

recommended that I also try VirtumonoBegone which only crashed when I

tried to use it. It did produce a log though which I have also attatched. I

have also noticed that since running the two virtumonde progs , I recieve a

Boot Log error when starting-up. As of right now I just make sure a copy of

XP is in my cd-drive when rebooting.



One problem at a time


Nwkid

 

OK, I need to collect a little more information. Looks like we need to manually remove the infection.

Run WinPFind again addtional do the following:
Using GetRunKey
Using ShowNew

Post WinPFind.txt, runkeys.txt and newfiles.txt.

 

Ran those as directed. I did notice however that when I ran the shownew that:

pmnlm.dll Aug 25 2006 573492 "pmnlm.dll" was listed and notice the

date on it. I am def sure something is wrong.. there was an app called "t-clock"

that installed itself when I had gotten the virtumonde & winlogon hook. It had

messed up my time/date/ and alot of stuff on my desktop too, before i was able

to remove it. I have posted all that you asked for. Thank you once again.


Nwkid

 

Make sure you have done and understand the following:
How to view hidden, system files & folders!
Searching for Hidden Files on WinXP

Copy the contents of the below quote box to Notepad; Save As FixReg.reg to your Desktop. DO NOT run it as this time we will do that later in Safe Mode.

Close Notepad.

Do the Following:
Start -> Run
type cmd
Click 'OK'

The Windows Command Terminal will open. At the command prompt enter the following commands, exactly as shown, including the quotes; pressing the ENTER key after each.

REBOOT to Safe Mode.

Locate FixReg.reg on your Desktop. Double-click on it and answer 'Yes' when asked if you want to merge with the registry.

Using the Search function in the Start Menu search for the following:

REBOOT to Normal Mode.

Post a fresh HijackThis log.

 

ok, So I entered the commands in the cmd prompt, and was notified by

RegSvr32 with the following notices:

C:\\WINDOWS\system32\pmnlm.dll was loaded, but the Dll Unregister Server point was noy found. This FIle Can not be registered.


Load Library ("C:\WINDOWS\system32\winmxw32.dll") failed - The Specified module could not be found.


- - - - - - - - - - - - - - - -


So upon rebooting in safe mode, I began running a search for the files you told

me to search for, however I recieved the following error when trying to delete

pmnlm:

Error! Cannot delete pmnlm: It is being used by another person or program. Close any Programs that might be using the file and try again

Additionally the follwing searches produced no results at all:


winmxw32

win*.tmp

mlnmp.*

1679_appcompat.txt

97dd_appcompat.txt

ASPNETSetup_00002.log

dxdiag.txt


Also here is yet another HJT log. Your assistance has been very generous.


Nwkid

 

Install Unlocker may require a reboot.

Open Windows Explorer Navigate to and delete C:\WINDOWS\system32\pmnlm.dll

Since it is in use Unlocker will open, Choose Unlock.

Now delete the file.

Boot to Safe Mode and rerun the registry patch.

Reboot

Post a fresh HijackThis log.

 

Ok so I tried the unlocker program and my computer crashed every time.

Explorer.exe crashed every single time.. windows gave me errors about an

overun buffer. The window from unlocker provided the following information:

PROCESS PATH LOCKED PID HANDLER

WINLOGON.EXE C:\WINDOWS\system32\pmnlm.dll 752 1

EXPLORER.EXE C:\WINDOWS\system32\pmnlm.dll 1808 1

WRSSDK.EXE C:\WINDOWS\system32\pmnlm.dll 1124 1

WINLOGON.EXE C:\WINDOWS\system32\pmnlm.dll 752 1864



I don't know if I did something wrong?? Please help. This virtumonde thin gis

drivin me nuts.

Nwkid

 

Start by downloading two tools we will need

- Process Explorer
- Pocket KillBox

Extract them to their own folder somewhere that you will be able to locate them later.

IMPORTANT: You should print or save the below locally, so you can refer to them while offline. You must exit all browsers before running the below steps and it would be best if you actually physically unplug your cable to the internet, reboot, and do not run anything but what I give you to do. Also it would be good to exit all processes and items in your System tray.

Do the above before continuing! Okay unplug your cable now.

Make sure you have rebooted in Normal Mode (do not open any other processes)

- Run Process Explorer

In the top section of the Process Explorer screen double click on winlogon.exe to bring up the winlogon.exe properties screen. Click on the Threads tab at the top.

Once you see this screen click on each instance of pmnlm.dll once and then click the kill button. After you have killed all of the pmnlm.dll under winlogon click ok. (If you do not find the dll, just continue on.)

Next double click on explorer.exe and again click once on each instance of pmnlm.dlland kill it. (If you do not find the dll, just continue on.)

Next double click on wrssdk.exe and again click once on each instance of pmnlm.dlland kill it. (If you do not find the dll, just continue on.)

Now just exit Process Explorer.

Now Run HijackThis. Click the 'Do a system scan only' button. Place a checkmark in the box next to the following lines DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now::

Click on the 'Fix checked' button. Wait for HijackThis to finish; close HijackThis.

Copy the bold text below to notepad. Save it as fixme.reg to your desktop.
Be sure the "Save as" type is set to "all files"
Once you have saved it double click it and allow it to merge with the registry.

Now run Pocket Killbox by doubleclicking on killbox.exe
Choose Tools > Delete Temp Files and click Delete Selected Temp Files.
Then after it deletes the files click the Exit (Save Settings) button.
NOTE: Pocket Killbox will only list the added files it is able to find on the system. So when you do the below, if some files do not show in the list after pasting them in, just continue.

Select:

• Delete on Reboot
• then Click on the All Files button.
• Please copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):

C:\WINDOWS\system32\pmnlm.dll

• Return to Killbox, go to the File menu, and choose Paste from Clipboard.
• Click the red-and-white Delete File button. Click Yes at the Delete on Reboot prompt. Click OK at any PendingFileRenameOperations prompt (and please let me know if you receive this message!).

If Killbox does not reboot just reboot your PC yourself.

Now attach a new HJT log and tell me how the steps went.
Make sure you tell me how things are working now!

 

I downloaded the apps you suggested and was able to delete the threads without running into any errors. There were allot of pmnlm.dll threads in every process you had me look at. When running Killbox i did not recieve any PendingFileRenameOperations prompt. I still recieve the whole" DISK BOOT LOG ERROR INSERT SYSTEM DISK AND PRESS ANY KEY TO CONTINUE" immediately after the computer posts, before the XP load screen. I am unsure as to what steps to take to fix this, I do not have a good copy of windows available, I have been using a old copy of xp pro without sp1 or sp2 on it just to get my computer to boot every time. But the good news is that Virtumonde appears to be defeated I can't thank you enough. I have noticed that there are less popups, and Ewido has turned up clean as well on my last scan! Thank you for the assistance and if you know how to fix the BOOT LOG ERROR please tell me.


Nwkid

 

Make sure that your boot sequence is configured correctly in BIOS, and that there are no non-bootable disks in any drives.

 

So I am almost 100% positive that my boot sequence is ok, in fact i never changed it to begin with. I still keep recieveing the BOOT LOG ERROR message. If I have a burnt cd wuth an XP iso on it, and it boots up fine so long as its in one of my drives. I don't know what happened, maybe all this deleting and registry work has damaged something? I am still unsure what to do.



Nwkid

 

Let's try fixing the boot sector.

Do the following:
[FONT=Bitstream Vera Sans, sans-serif]1. To start the computer and use the Recovery Console to replace the boot sector[/FONT]
[FONT=Bitstream Vera Sans, sans-serif]Insert the Windows XP Professional Setup CD-ROM into the CD-ROM drive. [/FONT]


[FONT=Bitstream Vera Sans, sans-serif]2. Restart the computer. If prompted to press a key to start the computer from the CD-ROM, press the appropriate key.[/FONT]


[FONT=Bitstream Vera Sans, sans-serif]3. When the text-based part of Setup begins, follow the prompts. Press the R key to repair a Windows XP Professional installation. [/FONT]


[FONT=Bitstream Vera Sans, sans-serif]4. If you are repairing a system that has more than one operating system installed, from the Recovery Console choose the Windows XP Professional installation that you need to repair. [/FONT]


[FONT=Bitstream Vera Sans, sans-serif]Note:[/FONT]

• [FONT=Bitstream Vera Sans, sans-serif]If you press ENTER without typing a number, the Recovery Console quits and restarts the computer. [/FONT]
• [FONT=Bitstream Vera Sans, sans-serif]The Recovery Console might also show valid installations of Windows NT 4.0. However, the results of attempting to access a Windows NT 4.0 installation can be unpredictable.[/FONT]

[FONT=Bitstream Vera Sans, sans-serif]5. When prompted, type the Administrator password. If you do not have the correct password, or if the security database for the installation of Windows XP Professional that you are attempting to access is corrupted, Recovery Console does not allow access to the local disks and you cannot replace the boot sector. [/FONT]


[FONT=Bitstream Vera Sans, sans-serif]6. To replace the boot sector, at the Recovery Console command prompt, type: [/FONT]


[FONT=Bitstream Vera Sans, sans-serif]fixboot [drive:][/FONT]


[FONT=Bitstream Vera Sans, sans-serif]if you do not specify a drive letter, the Recovery Console replaces the boot sector of the system volume. If you need to replace the boot sector of a volume that is not the system volume, then you must specify the appropriate drive letter.[/FONT]

 

I have done that allready, what else could it be? I'm currently running XP pro with sp.2 but the iso I have is an old stripped version, I dunno if that would have any effect on the matter.



Nwkid

 

What all have you tried?

 

I have run repair console and Fixboot on all drives.

 

OK, let's try repairing the Master Boot Record.

Restoring the MBR [FONT=Bitstream Vera Sans, sans-serif]Caution[/FONT]

• [FONT=Bitstream Vera Sans, sans-serif]Use this command with care because it can damage your partition table if any of the following apply: [/FONT]
  • [FONT=Bitstream Vera Sans, sans-serif]A virus is present and a third-party operating system is installed on the same computer. [/FONT]
  • [FONT=Bitstream Vera Sans, sans-serif]A nonstandard MBR is installed by a third-party disk utility. [/FONT]
  • [FONT=Bitstream Vera Sans, sans-serif]A hardware problem exists.[/FONT]
• [FONT=Bitstream Vera Sans, sans-serif]It is recommended that you run antivirus software before you use the fixmbr command. [/FONT]

[FONT=Bitstream Vera Sans, sans-serif]To start the computer and use the Recovery Console to replace the MBR[/FONT]

1. [FONT=Bitstream Vera Sans, sans-serif]Insert the Windows XP Professional Setup CD-ROM into the CD-ROM drive. [/FONT]
2. [FONT=Bitstream Vera Sans, sans-serif]Restart the computer. If prompted to press a key to start the computer from the CD-ROM, press the appropriate key.[/FONT]
3. [FONT=Bitstream Vera Sans, sans-serif]When the text-based part of Setup begins, follow the prompts. Press the R key to repair a Windows XP Professional installation.[/FONT]
4. [FONT=Bitstream Vera Sans, sans-serif]If you are repairing a system that has more than one operating system installed, from the Recovery Console choose the Windows XP Professional installation that you need to repair.[/FONT]

Note

• [FONT=Bitstream Vera Sans, sans-serif]If you press ENTER without typing a number, the Recovery Console quits and restarts the computer. [/FONT]
• [FONT=Bitstream Vera Sans, sans-serif]The Recovery Console might also show valid installations of Windows NT 4.0. However, the results of attempting to access a Windows NT 4.0 installation can be unpredictable.[/FONT]

​

1. [FONT=Bitstream Vera Sans, sans-serif]When prompted, type the Administrator password. If you do not have the correct password, or if the security database for the installation of Windows XP Professional you are attempting to access is corrupted, Recovery Console does not allow access to the local disks and you cannot repair the MBR.[/FONT]
2. [FONT=Bitstream Vera Sans, sans-serif]To replace the MBR, at the Recovery Console command prompt, type: [/FONT]

[FONT=Courier New, monospace][FONT=Courier New, monospace][FONT=Bitstream Vera Sans, sans-serif]fixmbr[/FONT][/FONT][/FONT]
​

[FONT=Bitstream Vera Sans, sans-serif]Verify if you want to proceed. Depending upon the location and the cause of the corruption within the damaged MBR, this operation can cause the data on the hard disk to become inaccessible. Press the Y key to proceed, or press the N key to cancel.[/FONT]

 

When I used repair console and fixmbr, windows said that the detected mbr was invalid so I hit "y" to replace it. Still having the message when I boot up. Havung no problems accessing my hardrives since the removal of the trojans and malware, but would still like to fix this, and to understand it. Thanks again.


Nwkid

 

I firmly believe all malware has been removed from the computer. This is an OS problem and best suited for teh Software Forum. Start a new thread in Software about this problem and reference this thread.

There are some pretty sharp people in Software and you should get a reply in a timely manner.

 

Thank you for all your help.


Nwkid

 

You're welcome