Winlogonhook specific help

I am a victim of the Winlogonhook trojan downloader agent

I've been scouring the web looking for solutions, and have even tried my own methods of combining the different fix's i've come across and nothing has worked.

*Known Problems*
I have a re-occuring LOCAL_MACHINE\SOFTWARE\MICROSOFT\MSSMGR registry string. Every time I delete it, it comes back within minutes.
I also have the ismon.exe and ishost.exe process running that won't remove. I have this "Yazzle Active X" trace that always installs and wont go away. Nod32 occassionally pops up windows that display Busky.AM and Purity Scan trojans.

*Attempted Fix's*
I've downloaded 9 different spyware removers (Spy Sweeper, Adware Away, Xoftspy, Ewido, SUPERantispy, Ad-Aware, Bazooka Spyware. I've tried various multi step fix's including "Process Explorer/Kill box" combinations. I've tried the Smitfraud cmd program, Virtumundobegone, look2me...ect ect ect. I've gone into the registry trying to delete the ishost.exe and ismon.exe... I'm at the end of my rope, and really can't afford to reformat at this point in time.
Anyone, please help.

 

Welcome to MajorGeeks.com, please follow the steps below:

- Run ALL the steps in this Sticky thread READ & RUN ME FIRST Before Asking for Support

• Make sure you check version numbers and get all updates.

After doing ALL of the above you still have a problem make sure you have booted to normal mode and run the steps in the below link to properly use HijackThis:

Downloading, Installing, and Running HijackThis

Make sure you also rename HijackThis.exe as suggested in the procedures. Use analyse.exe for the new name. This is very important due to some new infections going around.

When you return to make your next post, make sure you attach the following logs and that you have run these scans in the following order too:

• runkeys.txt - the log from GetRunKey.bat
• newfiles.txt - the log from ShowNew.bat
• CounterSpy - ONLY IF you were not able to run Windows Defender
• Bitdefender - from step 6
• Panda Scan - from step 6
• HijackThis