What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Annoying 020 Winlogon problem

2 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I can't seem to get rid of my Winlogon problem - see line O20

Logfile of HijackThis v1.99.1
Scan saved at 3:16:37 PM, on 5/29/2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\LEXBCES.EXE
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\CA\eTrust\InoculateIT\InoRpc.exe
C:\Program Files\CA\eTrust\InoculateIT\InoRT.exe
C:\Program Files\CA\eTrust\InoculateIT\InoTask.exe
C:\CA_LIC\LogWatNT.exe
C:\WINNT\System32\mnmsrvc.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\rundll32.exe
C:\Program Files\Outlook Express\MSOE.exe
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\Program Files\Microsoft Office\Office10\EXCEL.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Temp\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.crabtree-evelyn.ca/
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = ctree.net
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = ctree.net
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = ctree.net
O20 - Winlogon Notify: App Management - C:\WINNT\system32\WNNSRV.DLL
O23 - Service: CA License Client (CA_LIC_CLNT) - Computer Associates - C:\CA_LIC\lic98rmt.exe
O23 - Service: CA License Server (CA_LIC_SRVR) - Computer Associates - C:\CA_LIC\lic98rmtd.exe
O23 - Service: Centura SQLBase - Centura Software Corporation - P:\SQLBASE\dbntsrv.exe
O23 - Service: dlbt_device - Dell - C:\WINNT\system32\dlbtcoms.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: eTrust Antivirus RPC Server (InoRPC) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust\InoculateIT\InoRpc.exe
O23 - Service: eTrust Antivirus Realtime Server (InoRT) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust\InoculateIT\InoRT.exe
O23 - Service: eTrust Antivirus Job Server (InoTask) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust\InoculateIT\InoTask.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINNT\system32\LEXBCES.EXE
O23 - Service: Event Log Watch (LogWatch) - Computer Associates - C:\CA_LIC\LogWatNT.exe

Repeated check-marking does not fix it

ANy thoughts would be appreciated
Post #2
Download Look2Me-Destroyer.exe to your desktop.

* Close all windows before continuing.
* Double-click Look2Me-Destroyer.exe to run it.
* Put a check next to Run this program as a task.
* You will receive a message saying Look2Me-Destroyer will close and re-open in approximately 1 minute. Click OK
* When Look2Me-Destroyer re-opens, click the Scan for L2M button, your desktop icons will disappear, this is normal.
* Once it's done scanning, click the Remove L2M button.
* You will receive a Done Scanning message, click OK.
* When completed, you will receive this message: Done removing infected files! Look2Me-Destroyer will now shutdown your computer, click OK.
* Your computer will then shutdown.
* Turn your computer back on.
* Post the contents of Look2Me-Destroyer.txt and a new HiJackThis log.
Post #3
Looking Good!


Look2Me-Destroyer V1.0.12

Scanning for infected files…..
Scan started at 5/29/2006 4:39:07 PM

Infected! C:\WINNT\system32\WNNSRV.DLL
Infected! C:\WINNT\system32\gp0ql3d51.dll
Infected! C:\WINNT\system32\gprml3911.dll
Infected! C:\WINNT\system32\h2j40c1qef.dll
Infected! C:\WINNT\system32\mlpatcha.dll
Infected! C:\WINNT\system32\whspdmod.dll
Infected! C:\WINNT\system32\guard.tmp

Attempting to delete infected files…

Attempting to delete: C:\WINNT\system32\WNNSRV.DLL
C:\WINNT\system32\WNNSRV.DLL Deleted successfully!

Attempting to delete: C:\WINNT\system32\gp0ql3d51.dll
C:\WINNT\system32\gp0ql3d51.dll Deleted successfully!

Attempting to delete: C:\WINNT\system32\gprml3911.dll
C:\WINNT\system32\gprml3911.dll Deleted successfully!

Attempting to delete: C:\WINNT\system32\h2j40c1qef.dll
C:\WINNT\system32\h2j40c1qef.dll Deleted successfully!

Attempting to delete: C:\WINNT\system32\mlpatcha.dll
C:\WINNT\system32\mlpatcha.dll Deleted successfully!

Attempting to delete: C:\WINNT\system32\whspdmod.dll
C:\WINNT\system32\whspdmod.dll Deleted successfully!

Attempting to delete: C:\WINNT\system32\guard.tmp
C:\WINNT\system32\guard.tmp Deleted successfully!

Making registry repairs.

Removing: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Control Panel

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{14A41502-3B4D-48A0-82DC-6314DEE2ED08}"
HKCR\Clsid\{14A41502-3B4D-48A0-82DC-6314DEE2ED08}

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{291A518D-4E32-497C-A4C7-C23D39FE8242}"
HKCR\Clsid\{291A518D-4E32-497C-A4C7-C23D39FE8242}

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{D7FC7E5A-BCAC-40AC-93AD-8BDA83EB67FB}"
HKCR\Clsid\{D7FC7E5A-BCAC-40AC-93AD-8BDA83EB67FB}

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{E6D89A46-FD2D-4152-9052-6C373494597F}"
HKCR\Clsid\{E6D89A46-FD2D-4152-9052-6C373494597F}

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{79B192B6-50F0-48B0-B04F-C8A5088BFAE9}"
HKCR\Clsid\{79B192B6-50F0-48B0-B04F-C8A5088BFAE9}

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{A6E40E61-2D43-4D09-9BF9-4419B6AA2BE0}"
HKCR\Clsid\{A6E40E61-2D43-4D09-9BF9-4419B6AA2BE0}

Restoring Windows certificates.

Replaced hosts file with default windows hosts file


Restoring SeDebugPrivilege for Administrators - Succeeded


Logfile of HijackThis v1.99.1
Scan saved at 4:54:24 PM, on 5/29/2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\LEXBCES.EXE
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\CA\eTrust\InoculateIT\InoRpc.exe
C:\Program Files\CA\eTrust\InoculateIT\InoRT.exe
C:\Program Files\CA\eTrust\InoculateIT\InoTask.exe
C:\CA_LIC\LogWatNT.exe
C:\WINNT\System32\mnmsrvc.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\msiexec.exe
C:\WINNT\Explorer.EXE
C:\Program Files\WindowsUpdate\wuhistv3.exe
C:\Temp\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.crabtree-evelyn.ca/
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = ctree.net
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = ctree.net
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = ctree.net
O23 - Service: CA License Client (CA_LIC_CLNT) - Computer Associates - C:\CA_LIC\lic98rmt.exe
O23 - Service: CA License Server (CA_LIC_SRVR) - Computer Associates - C:\CA_LIC\lic98rmtd.exe
O23 - Service: Centura SQLBase - Centura Software Corporation - P:\SQLBASE\dbntsrv.exe
O23 - Service: dlbt_device - Dell - C:\WINNT\system32\dlbtcoms.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: eTrust Antivirus RPC Server (InoRPC) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust\InoculateIT\InoRpc.exe
O23 - Service: eTrust Antivirus Realtime Server (InoRT) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust\InoculateIT\InoRT.exe
O23 - Service: eTrust Antivirus Job Server (InoTask) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust\InoculateIT\InoTask.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINNT\system32\LEXBCES.EXE
O23 - Service: Event Log Watch (LogWatch) - Computer Associates - C:\CA_LIC\LogWatNT.exe


No pop-ups detected - I am cautiously optomistic. I will wait a day and post the definitive answer.

Thank you
Post #5
Ran ATF Cleaner (neat little program) My Internet Explorer is constantly closing with the "Don't Send" box when I attempt to access TomCoyote. I have downloaded Opera and that is working fine.
Post #8
Download Hoster by Toadbee at http://www.funkytoad.com/hoster.htm
extract it to your desktop and run it. Copy host file to clipboard and paste it here.
Post #9
# Copyright © 1993-1999 Microsoft Corp. # This is a sample HOSTS file used by Microsoft TCP/IP for Windows. # This file contains the mappings of IP addresses to host names. Each # entry should be kept on an individual line. The IP address should # be placed in the first column followed by the corresponding host name. # The IP address and the host name should be separated by at least one # space. # Additionally, comments (such as these) may be inserted on individual # lines or following the machine name denoted by a '#' symbol. # For example: # 102.54.94.97 rhino.acme.com # source server # 38.25.63.10 x.acme.com # x client host 127.0.0.1 localhost A fascinating little problem
Post #10
Flush any DNS caches you have control over. Two examples are routers that act as proxy nameservers, and versions of Windows that support DNS caching. The way to fix the router cache is to power cycle the router. The way to fix XP/Win2K's is to enter the command "ipconfig /flushdns" at a cmd.exe prompt. Click start > all programs >accessories >command prompt and type in ipconfig /flushdns <<

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI