Options

W?nlogon.exe problem.

Unknown
edited March 2005 in Spyware & Virus Removal
I have had an issue with some program virus or spyware or something trying to access my internet connection. I have a router, mcaffee firewall and I use ad-aware and spybot heavily but none seem to get rid of this. Last night I decided to track down the W?nlogon.exe in the regedit and manually delete it. I did and as soon as I did my winpatrol halted it's attempt to reinstall. But on reboot it's back, the only thing I can think of is that it reinstalled on reboot before winpatrol. Can anyone help me here? I'm in desperate need of help and explanation of how to get rid of this thing. Thanks for the help in advance, you guys do great work.

Comments

  • BardicGifts
    edited March 2005
    Could it be related to weatherbug my fiancee loves the thing and it was part of AIM. It did try to reaccess the internet and was blocked by mcaffee again after I checked out weatherbug. Just wanted to let ya know. It is constantly trying to access the internet and we'll block it and it tries again in a matter of seconds and then again and again. We've even tried to allow it and it still keeps coming back. I think it's trapped behind our router and that's why it keeps bouncing back that way.
  • BardicGifts
    edited March 2005
    I keep leaving out information, bad memory I guess. Anyway, when McAfee firewall stops it it says. "The program W?NLOGON.EXE is requesting access to the Internet. Do you want to allow it?

    Path: C:\WINNT\SYSTEM32\W?NLOGON.EXE

    As I said, we've blocked access consistently for a few minutes before it finally gives up. Even when we've tried to Grant Access once it still kept popping up.
  • BardicGifts
    edited March 2005
    I see that this is the thing to do use Hijackthis so here is my hijackthis log file. Thanks.

    Logfile of HijackThis v1.99.1
    Scan saved at 1:43:01 AM, on 3/8/2005
    Platform: Windows 2000 SP4 (WinNT 5.00.2195)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINNT\System32\smss.exe
    C:\WINNT\system32\winlogon.exe
    C:\WINNT\system32\services.exe
    C:\WINNT\system32\lsass.exe
    C:\WINNT\system32\svchost.exe
    C:\WINNT\system32\spoolsv.exe
    C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
    C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
    C:\Program Files\Network Associates\VirusScan\avsynmgr.exe
    C:\WINNT\System32\svchost.exe
    C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
    C:\WINNT\system32\nvsvc32.exe
    C:\WINNT\system32\regsvc.exe
    C:\WINNT\system32\MSTask.exe
    C:\WINNT\System32\WBEM\WinMgmt.exe
    C:\WINNT\system32\mspmspsv.exe
    C:\WINNT\system32\svchost.exe
    C:\WINNT\Explorer.EXE
    C:\Program Files\Network Associates\VirusScan\VsStat.exe
    C:\Program Files\Network Associates\VirusScan\Avconsol.exe
    C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
    C:\Program Files\Network Associates\VirusScan\Vshwin32.exe
    C:\Program Files\Common Files\Network Associates\McShield\mcshield.exe
    D:\WINPAT~1\winpatrol.exe
    D:\Java\bin\jusched.exe
    C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
    C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe
    C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
    D:\Microsoft Broadband Networking\MSBNTray.exe
    C:\PROGRA~1\COMMON~1\AOL\110744~1\EE\AOLHOS~1.EXE
    C:\PROGRA~1\COMMON~1\AOL\110744~1\EE\AOLServiceHost.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\WINNT\System32\svchost.exe
    C:\WINNT\system32\w?nlogon.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Lavasoft\Ad-Aware SE Personal\Ad-Aware.exe
    C:\PROGRA~1\WINZIP\winzip32.exe
    C:\Documents and Settings\Administrator\Local Settings\Temp\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: (no name) - {E7661E5D-A399-F36F-E01D-8C7A90B60D9A} - C:\WINNT\system32\znyzw.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
    O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1107444375\EE\AOLHostManager.exe
    O4 - HKLM\..\Run: [WinPatrol] D:\WINPAT~1\winpatrol.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] D:\Java\bin\jusched.exe
    O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
    O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"
    O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
    O4 - HKCU\..\Run: [Weather] C:\Program Files\AWS\WeatherBug\Weather.exe 1
    O4 - HKCU\..\Run: [Pdta] C:\Documents and Settings\Administrator\Application Data\wdwd.exe
    O4 - HKCU\..\Run: [AOL Fast Start] "D:\America Online 9.0\AOL.EXE" -b
    O4 - Startup: Screen Saver Control.lnk = C:\WINNT\FSScrCtl.exe
    O4 - Global Startup: Microsoft Broadband Networking.lnk = D:\Microsoft Broadband Networking\MSBNTray.exe
    O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
    O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Java\bin\npjpi150_01.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Java\bin\npjpi150_01.dll
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
    O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
    O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\PROGRA~1\AWS\WEATHE~1\Weather.exe (HKCU)
    O16 - DPF: ChatSpace Full Java Client 4.0.0.320 - http://63.102.226.240:8000/Java/cfs40320.cab
    O16 - DPF: {2359626E-7524-4F87-B04E-22CD38A0C88C} (ICSScannerLight Class) - http://download.zonelabs.com/bin/free/cm/ICSCM.cab
    O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com/computercheckup/qdiagcc.cab
    O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
    O16 - DPF: {9AA73F41-EC64-489E-9A73-9CD52E528BC4} (ZoneAxRcMgr Class) - http://zone.msn.com/binGame/ZAxRcMgr.cab
    O16 - DPF: {9B03C5F1-F5AB-47EE-937D-A8EDA626F876} (Anonymizer Anti-Spyware Scanner) - http://download.zonelabs.com/bin/promotions/spywaredetector/WebAAS.cab
    O16 - DPF: {B24F0664-7DDA-40B6-B38C-A4FD68DE8685} - http://8.7.97.248/main/Install/CentraDownloader.cab
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
    O16 - DPF: {B991DA79-51F7-4011-98D2-1F2592E82A56} (ACNPlayer2 Class) - http://198.99.241.129/ePlayer/V3_2_0_0/ACNePlayer.cab
    O16 - DPF: {D77EF652-9A6B-40C8-A4B9-1C0697C6CF41} (TikGames Online Control) - http://aolsvc.aol.com/onlinegames/shapo/shapo.cab
    O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://aolsvc.aol.com/onlinegames/bejeweled2/popcaploader_v7.cab
    O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
    O23 - Service: AOL Connectivity Service (AOL ACS) - America Online - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
    O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
    O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\\aolserv.exe
    O23 - Service: AVSync Manager (AvSynMgr) - Unknown owner - C:\Program Files\Network Associates\VirusScan\avsynmgr.exe
    O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
    O23 - Service: McShield - Unknown owner - C:\Program Files\Common Files\Network Associates\McShield\mcshield.exe
    O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
    O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINNT\system32\nvsvc32.exe
  • Buckeye_SamBuckeye_Sam Columbus, Ohio
    edited March 2005
    Launch Notepad, and copy/paste the box below into a new text file. Save it as FindFile.bat and save it on your Desktop.
    dir C:\WINNT\system32\w?nlogon.exe /a h > files.txt
    notepad files.txt


    Locate FindFile.bat on your Desktop and double-click on it. It will open Notepad with some text in it. Please post the text here.
  • KidAssassinKidAssassin
    edited March 2005
    Buckeye_Sam wrote:
    Launch Notepad, and copy/paste the box below into a new text file. Save it as FindFile.bat and save it on your Desktop.




    Locate FindFile.bat on your Desktop and double-click on it. It will open Notepad with some text in it. Please post the text here.

    OK, i think i have the same problem I don't really know, but i'm guessing that w?nlogon is a spyware right?

    so this is what i got, only i have XP so instead of WINNT/SYSTEM32 I PUTED WINDOWS/SYSTEM32

    what i got was

    Volume in drive C is OK!!
    Volume Serial Number is C086-830D

    Directory of C:\WINdows\system32

    08/23/2001 11:00 AM 430,080 winlogon.exe
    03/01/2005 07:15 AM 417,792 w?nlogon.exe
    2 File(s) 847,872 bytes

    Directory of C:\Documents and Settings\cstrike.TA-H36R8OF8VBN1\Desktop


    I also have one question, is rundll32.exe a spyware or something? and what about brnu.exe and mqtgsvs.exe
  • Buckeye_SamBuckeye_Sam Columbus, Ohio
    edited March 2005
    KidAssassin - Please do not post your issue in the middle of someone else's thread. Start your own thread and someone will help you.
  • KidAssassinKidAssassin
    edited March 2005
    ok, sorry, since it was the same problem I decided to post it here, sorry.
Sign In or Register to comment.