Logonui.exe error

alyoob

alyoob

Member
I have this percestant error when I start the computer Logonui.exe memory cannot be written. I did what you guys told me to do. I scanned my computer with Avg virus program . I used Malwarebytes' Anti-Malware and SUPERAntiSpyware and the results are in the log files. Each time I scan my computer with Malwarebytes' Anti-Malware i keep getting the same infected files over and over again. I deleted the files then restarted my computer did another scan with malwarvyte and I still the get the same results. The trojans that are percestant are listed in the log file Malwarebytes' Anti-Malware . Each time I do a scan with any of these programs I get the same results nothing wants to get clean. In the end it seems that the scanners do not clenan out my infections. Here are my log files. Here are three logs Hijacklog SUPERAntiSpyware Scan Log and Malwarebytes' Anti-Malware is attactched.


SUPERAntiSpyware Scan Log
Generated 02/10/2009 at 09:39 PM

Application Version : 3.3.1020

Core Rules Database Version : 3751
Trace Rules Database Version: 1717

Scan type : Complete Scan
Total Scan Time : 00:32:48

Memory items scanned : 397
Memory threats detected : 0
Registry items scanned : 8383
Registry threats detected : 15
File items scanned : 12953
File threats detected : 36

Trojan.Unknown Origin
HKLM\System\ControlSet001\Services\ngpujnkc
C:\WINDOWS\SYSTEM32\DRIVERS\NGPUJNKC.SYS
HKLM\System\ControlSet002\Services\ngpujnkc
HKLM\System\ControlSet002\Services\Passthru
C:\WINDOWS\SYSTEM32\DRIVERS\NDISIO.SYS
HKLM\System\ControlSet003\Services\ngpujnkc
HKLM\System\ControlSet003\Services\Passthru
HKLM\System\ControlSet004\Services\ngpujnkc
HKLM\System\ControlSet004\Services\Passthru
HKLM\System\ControlSet005\Services\ngpujnkc
HKLM\System\ControlSet005\Services\Passthru
HKLM\System\ControlSet006\Services\ngpujnkc
HKLM\System\ControlSet006\Services\Passthru
HKLM\System\CurrentControlSet\Services\ngpujnkc
HKLM\System\CurrentControlSet\Services\Passthru
C:\DOCUMENTS AND SETTINGS\HP_OWNER.YOUR-03667082DE\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\VNRLKHRD\CAE[1].TXT

Adware.Tracking Cookie
C:\DOCUME~1\HP_OWN~1.YOU\LOCALS~1\Temp\Cookies\hp_owner@atwola[2].txt
C:\DOCUME~1\HP_OWN~1.YOU\LOCALS~1\Temp\Cookies\[email protected][2].txt
C:\DOCUME~1\HP_OWN~1.YOU\LOCALS~1\Temp\Cookies\hp_owner@socialmedia[1].txt
C:\DOCUME~1\HP_OWN~1.YOU\LOCALS~1\Temp\Cookies\[email protected][2].txt
C:\DOCUME~1\HP_OWN~1.YOU\LOCALS~1\Temp\Cookies\[email protected][1].txt
C:\DOCUME~1\HP_OWN~1.YOU\LOCALS~1\Temp\Cookies\hp_owner@chitika[2].txt
C:\DOCUME~1\HP_OWN~1.YOU\LOCALS~1\Temp\Cookies\[email protected][1].txt
C:\DOCUME~1\HP_OWN~1.YOU\LOCALS~1\Temp\Cookies\[email protected][1].txt
C:\DOCUME~1\HP_OWN~1.YOU\LOCALS~1\Temp\Cookies\[email protected][1].txt
C:\Documents and Settings\HP_Owner.YOUR-03667082DE\Cookies\[email protected][1].txt
C:\Documents and Settings\HP_Owner.YOUR-03667082DE\Cookies\[email protected][2].txt
C:\Documents and Settings\HP_Owner.YOUR-03667082DE\Cookies\[email protected][1].txt
C:\Documents and Settings\HP_Owner.YOUR-03667082DE\Cookies\[email protected][2].txt
C:\Documents and Settings\HP_Owner.YOUR-03667082DE\Cookies\[email protected][1].txt
C:\Documents and Settings\HP_Owner.YOUR-03667082DE\Cookies\[email protected][2].txt
C:\Documents and Settings\HP_Owner.YOUR-03667082DE\Cookies\hp_owner@atwola[1].txt
C:\Documents and Settings\HP_Owner.YOUR-03667082DE\Cookies\hp_owner@atwola[2].txt
C:\Documents and Settings\HP_Owner.YOUR-03667082DE\Cookies\hp_owner@crackle[2].txt
C:\Documents and Settings\HP_Owner.YOUR-03667082DE\Cookies\[email protected][1].txt
C:\Documents and Settings\HP_Owner.YOUR-03667082DE\Cookies\[email protected][2].txt
C:\Documents and Settings\HP_Owner.YOUR-03667082DE\Cookies\[email protected][1].txt
C:\Documents and Settings\HP_Owner.YOUR-03667082DE\Cookies\hp_owner@socialmedia[1].txt
C:\Documents and Settings\HP_Owner.YOUR-03667082DE\Cookies\[email protected][1].txt
C:\Documents and Settings\HP_Owner.YOUR-03667082DE\Cookies\hp_owner@www.****edupthumbs[1].txt
C:\Documents and Settings\HP_Owner.YOUR-03667082DE\Local Settings\temp\Cookies\[email protected][1].txt
C:\Documents and Settings\HP_Owner.YOUR-03667082DE\Local Settings\temp\Cookies\[email protected][1].txt
C:\Documents and Settings\HP_Owner.YOUR-03667082DE\Local Settings\temp\Cookies\[email protected][2].txt
C:\Documents and Settings\HP_Owner.YOUR-03667082DE\Local Settings\temp\Cookies\[email protected][1].txt
C:\Documents and Settings\HP_Owner.YOUR-03667082DE\Local Settings\temp\Cookies\hp_owner@atwola[2].txt
C:\Documents and Settings\HP_Owner.YOUR-03667082DE\Local Settings\temp\Cookies\hp_owner@chitika[2].txt
C:\Documents and Settings\HP_Owner.YOUR-03667082DE\Local Settings\temp\Cookies\[email protected][1].txt
C:\Documents and Settings\HP_Owner.YOUR-03667082DE\Local Settings\temp\Cookies\[email protected][2].txt
C:\Documents and Settings\HP_Owner.YOUR-03667082DE\Local Settings\temp\Cookies\hp_owner@socialmedia[1].txt

Trojan.Dropper/RS32Net
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run#rs32net [ C:\WINDOWS\System32\rs32net.exe ]
HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run#rs32net [ C:\WINDOWS\System32\rs32net.exe ]



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:07:12 PM, on 2009-02-10
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\LSI SoftModem\agrsmsvc.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\WINDOWS\Explorer.EXE
C:\HP\KBD\KBD.EXE
C:\WINDOWS\ALCXMNTR.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\IObit\Advanced SystemCare 3\Sup_SmartRAM.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\trend Micro\HijackThis.exe\sniper.exe.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://search.yahoo.com/search?fr=mcafee&p=%s
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 127.0.0.1:5222
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\Documents and Settings\HP_Owner.YOUR-03667082DE\ujw.exe \s,C:\WINDOWS\system32\i386kd.exe,C:\WINDOWS\system32\vmware-ufad.exe,C:\WINDOWS\system32\undname.exe,C:\WINDOWS\system32\ndetect.exe,C:\WINDOWS\system32\c++.exe,C:\WINDOWS\system32\deviceemulator.exe,C:\WINDOWS\system32\idaw64.exe,
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn6\yt.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn6\yt.dll
O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O3 - Toolbar: &Crawler Toolbar - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Crawler\ctbr.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL Toolbar\aoltb.dll
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SmartRAM] "C:\Program Files\IObit\Advanced SystemCare 3\Sup_SmartRAM.exe" /m
O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [jrfvdszh.exe] C:\WINDOWS\jrfvdszh.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\Office12\REFIEBAR.DLL
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/betapit/PCPitStop.CAB
O16 - DPF: {10ECCE17-29B5-4880-A8F5-EAD298611484} (ReiEngine Class) - http://cdnrep.reimage.com/reix1219.cab
O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} (Citrix ICA Client) - http://a516.g.akamai.net/f/516/25175/7d/runaware.download.akamai.com/25175/citrix/wficat-no-eula.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {49232000-16E4-426C-A231-62846947304B} (SysData Class) - https://wimpro2.cce.hp.com/ChatEntry/downloads/sysinfo.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {B1E2B96C-12FE-45E2-BEF1-44A219113CDD} (SABScanProcesses Class) - http://www.superadblocker.com/activex/sabspx.cab
O16 - DPF: {EEC9DBCC-04AD-4A1B-BEA7-C6DAD9515D5A} -
O16 - DPF: {FFB3A759-98B1-446F-BDA9-909C6EB18CC7} (PCPitstop Exam) - http://utilities.pcpitstop.com/Optimize2/pcpitstop2.dll
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Crawler\ctbr.dll
O20 - Winlogon Notify: piesnsjj - C:\WINDOWS\SYSTEM32\qwcsbcv.dll
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Program Files\LSI SoftModem\agrsmsvc.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: PACSPTISVR - Unknown owner - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Software Jukebox v2.0 Service - Unknown owner - C:\Program Files\Common Files\MSJB NA02D Shared\Service\Software Jukebox v2.0 Service File.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe

--
End of file - 8988 bytes
 

Attachments

Hello:

Download and Run ComboFix
If you already have Combofix, please delete this copy and download it again as it's being updated regularly.
Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall

Combofix should never take more that 20 minutes including the reboot if malware is detected.
If it does, open Task Manager then Processes tab (press ctrl, alt and del at the same time) and end any processes of findstr, find, sed or swreg, then combofix should continue.
If that happened we want to know, and also what process you had to end.

Please download and post a log with HiJackThis.

Click here to download HJTsetup.exe
  • Save HJTsetup.exe to your desktop.
  • Double click on the HJTsetup.exe icon on your desktop.
  • By default it will install to C:\Program Files\Hijack This.
  • Continue to click Next in the setup dialogue boxes until you get to the Select Additional Tasks dialogue.
  • Put a check by Create a desktop icon then click Next again.
  • Continue to follow the rest of the prompts from there.
  • At the final dialogue box click Finish and it will launch Hijack This.
  • Click on the Do a system scan and save a log file button. It will scan and then ask you to save the log.
  • Click Save to save the log file and then the log will open in notepad.
  • Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.
  • Come back here to this thread and Paste the log in your next reply.
  • DO NOT have Hijack This fix anything yet. Most of what it finds will be harmless or even required.

In your next reply i will need:
  • The ComboFix log
  • The HiJackThis log
  • An update on how your computer is running
 
when I use combofix to scan my computer I AM currently using my computer in safe mode. The combofix scanner, scans my computer until step 50 it stalls and does not produce the log file, then I have to logoff then log back in, into safe mode again. My computer does not work in normal mode beacuse I get this error the screen resolution and color depth are at a very low level, then the computer shuts down.
 
Last edited:
You must log in or register to reply here.
Back
Top