blocking 3 outgoing ip attempts every 10 minutes

[DickM]

Every 10 mins or so my wife's PC (XP SP3) gets three requests to go out to 95.169.187.63 - a site in Russia with host name ns2.km33805.keymachine.de - Malwarebytes is blocking them.

These requests are being orginated by winlogon.exe located in system32. winlogon is the same size as the one in a pc without any viruses. There are no attempts to go to any other suspicious ports (I checked with cports).

This started when my wife said she was getting unwanted pop-ups and then she couldn't surf the web. I found IE8 and Firefox had the proxy server turned on. I turned it off. I also found a lot of new entries in the windows CryptnetUrlCache folders "content" and "metadata" that occured when she had the problem - I was checking for any files changed or created in that time period. These entries where not in my other PCs. I also found about 15 or so new entries in the "scheduled tasks" folder - named something like tb1, tb2, etc. - which I deleted since she had no scheduled tasks before the virus hit.

I ran MSE then malwarebytes antimalware and finally ESET to get rid of the malware/virus. MSE stopped and deleted multiple viruses and then could find no more, then malwarebytes found three more infections and could find no more, finally ESET could find no infections. But I'm still getting the outgoing requests.

I have Combofix loaded but have not run it yet.

Thanks in advance for any help!

-------------

The Viruses that MSE found and removed are listed below:

Multiple intances of

Kargany.G

Cycbot.G

Unruy.H

Obvod.H

FakeRean

Single instance of

Faret.gfen/C

___

Below is the first malwarebytes log where it found three infections after MSE could find no more:

Malwarebytes' Anti-Malware 1.51.2.1300

www.malwarebytes.org

Database version: 911122405

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

12/25/2011 12:33:05 AM

mbam-log-2011-12-25 (00-33-04).txt

Scan type: Full scan (C:\|E:\|)

Objects scanned: 1123861

Time elapsed: 7 hour(s), 28 minute(s), 46 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 3

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

c:\WINDOWS\Temp\kna0.8408029935952036.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.

c:\WINDOWS\Temp\sghj0.48684557069307377.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.

c:\WINDOWS\Temp\slp8176370282357344548.tmp (Trojan.Zbot.CBCGen) -> Quarantined and deleted successfully.

AFter that it could find no more infections - see log below:

Malwarebytes' Anti-Malware 1.51.2.1300

www.malwarebytes.org

Database version: 911122405

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

12/25/2011 2:36:12 PM

mbam-log-2011-12-25 (14-36-12).txt

Scan type: Quick scan

Objects scanned: 1

Time elapsed: 9 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

-----------

Information from cports:

[DickM]

I managed to fix this problem with Free Virus Scan from Kaspersky Lab

[LDTate]

Since this issue is resolved I will close the thread to prevent others from posting here. If you need assistance please start your own topic and someone will be happy to assist you.