WMI problem

Welcome to Major Geeks!

Please only attach the logs we requested in the READ & RUN ME. You need to attach logs from SUPERAntiSpyware and Malwarebytes. Attach each of the below logs since you ran MBAM many times and we only wanted you to run it once.

Code:

"C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\SUPERAntiSpyware.com\SUPERAntiSpyware\Logs\"
supera~1.log   6 Mar 2009         633  "SUPERAntiSpyware Scan Log - 03-06-2009 - 19-14-38.log"
 
"C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\Malwarebytes\Malwarebytes' Anti-Malware\Logs\"
mb52ff~1.txt   6 Mar 2009        3384  "mbam-log-2009-03-06 (19-56-11).txt"
mbam-l~1.txt   1 Mar 2009        4420  "mbam-log-2009-03-01 (00-18-40).txt"
mbam-l~2.txt   1 Mar 2009        3095  "mbam-log-2009-03-01 (00-31-51).txt"
mbam-l~3.txt   1 Mar 2009        1002  "mbam-log-2009-03-01 (11-19-31).txt"
mbam-l~4.txt   4 Mar 2009        3116  "mbam-log-2009-03-04 (18-43-39).txt"
mbe93c~1.txt   6 Mar 2009         993  "mbam-log-2009-03-06 (20-55-34).txt"

You should not be attaching any of the text file logs from inside of the MGtools folder. Only the MGlogs.zip file was requested.

What is the below process for?
C:\Programme\Alice\Signup\AliceCnn.exe

We have a little more to do. Some of your Windows yystem files are infected and we do not have clean replacements for all of them on your PC. For 2 examples, your C:\Windows\explorer.exe and C:\Windows\system32\winlogon.exe files are infected and do not have clean replacements. This may make a reinstall necessary.

Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\GEMEIN~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')

After clicking Fix, exit HJT.


Now we need to use ComboFix to remove a bunch of malware files.

• Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
  • If it is not on your Desktop, the below will not work.
• Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
• Open Notepad and copy/paste the text in the below quote box into it:

• Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
• At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
• You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
• Now use your mouse to drag CFscript.txt on top of ComboFix.exe
• Follow the prompts.
• When it finishes, a log will be produced named c:\combofix.txt
• I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.


After reboot, now install the current version of Sun Java from: Sun Java Runtime Environment

Now run Ccleaner!

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).


Then attach the below logs:

• C:\ComboFix.txt
• C:\MGlogs.zip

Make sure you tell me how things are working now!

 

Please see the first part of my last message and attach all of those logs I requested from SUPERAntiSpyware and Malwarebytes.

Also you did not do what I requested with ComboFix. You must create the file named CFScript.txt not CFScipt.txt.doc which is what you did and thus the fix did nothing at all.

 

Please do not post Word Document logs. Yes you do have notepad. It is part of Windows. If you click Start, Run, and just enter notepad in the box and click OK. Notepad will open. Alsoif you click Start, All Programs, Accessories you should also see notepad's icon.


You need to attach logs I asked for. These are from scans you previously ran. I do not want new logs. I want you to attach the below files which I will illustrate with the full path information for each file.

C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\SUPERAntiSpyware.com\SUPERAntiSpyware\Logs\SUPERAntiSpyware Scan Log - 03-06-2009 - 19-14-38.log
C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-2009-03-06 (19-56-11).txt
C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-2009-03-01 (00-18-40).txt
C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-2009-03-01 (00-31-51).txt
C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-2009-03-01 (11-19-31).txt
C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-2009-03-04 (18-43-39).txt
C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-2009-03-06 (20-55-34).txt

 

Did you look in the folder I listed? What about the other SUPERAntiSpyware log.

I need a new MGlogs.zip file now that you have properly run ComboFix.

Also please tell me what problems (if any) you are still having.

 

This may well be due to what I mentioned earlier about your Windows system files being infected. There are still at least 3 infected files and all backups for them are infected too. We cannot fix these. If your antivirus program cannot find these infections and remove them, they could potentially spread to every executable file on your hard disk. All of the below are infected.

Code:

 
=============  copies of explorer.exe =================================
"C:\WINDOWS\explorer.exe" 1036800 14.04.2008 03:22 
"C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe" 1036288 13.06.2007 14:10 
"C:\WINDOWS\$NtServicePackUninstall$\explorer.exe" 1036288 13.06.2007 14:21 
"C:\WINDOWS\$NtServicePackUninstall$\explorer.exe.000" 1035264 04.08.2004 00:57 
"C:\WINDOWS\$NtUninstallKB938828$\explorer.exe" 1035264 28.02.2006 13:00 
"C:\WINDOWS\ServicePackFiles\i386\explorer.exe" 1036800 14.04.2008 03:22 
 
=============  copies of userinit.exe =================================
"C:\WINDOWS\$NtServicePackUninstall$\userinit.exe" 25088 28.02.2006 13:00 
"C:\WINDOWS\ServicePackFiles\i386\userinit.exe" 25088 28.02.2006 13:00 
"C:\WINDOWS\system32\userinit.exe" 25088 28.02.2006 13:00 
"C:\WINDOWS\system32\dllcache\userinit.exe" 25088 28.02.2006 13:00 
 
 
=============  copies of winlogon.exe =================================
"C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe" 507392 28.02.2006 13:00 
"C:\WINDOWS\ServicePackFiles\i386\winlogon.exe" 513024 14.04.2008 03:23 
"C:\WINDOWS\system32\winlogon.exe" 513024 14.04.2008 03:23 

If you have a Windows XP SP3 CD you could potentially get replacements for the above from the CD. However there could be others that are infected. I suggest that you backup any personal important data you need and then run the below scans.

Using Dr.Web CureIt attach the log.

Trend Micro Housecall attach a log from this.

Update your copy of Avira and run a full system scan on all drives. Attach a log from this.