Winlogon Notifier

[kc7brown]

Last night I thought I was downloading a legitimate file. I scanned it with my antivirus before opening - reported clean. It was NOT! So I got the virus popup, and aborted the connection. Then Spybot went nuts with a "Winlogon Notifier" popup, incessantly! I pulled my DSL cable from the modem, and tried to find the infected file.

I think this is at least one of them: awtttqOf.dll which was in my System32 folder. But access is denied. I ran HiJack this and checked a few things to fix, but they keep coming back on the next scan. I booted into Safe Mode, and still can't fix with HiJack.

I'm at work now, but when I get home I need to take care of this. If I have to reconnect to the Internet to fix it I will. I have two 80gb drives, divided into partitions. Two of the partitions have XP Pro SP2 on them, so I can always boot into a clean drive to post a log online.

Any suggestions on how to proceed? Any help will be appreciated.

[Blade81]

Hi


Download and install TrendMicro HijackThis
* Once installed open HijackThis by clicking Start > Programs > HijackThis and click the button labeled
Do a system scan only

* Click the scan button in the lower left hand corner of the interface and HijackThis will quickly scan your system.
* Once the scan is complete the scan button will now read save log. Click this button to save the log file to your PC. Once you select where you would like to save the file it will open in your systems default text editor. Typically this application is Notepad. Post the log here.

[Blade81]

Due to inactivity, this thread will now be closed.

Note:If it has been five days or more since your last post, and the helper assisting you posted a response to that post to which you did not reply, your topic will not be reopened. At that point, if you still require help, please start a new topic and include a fresh HijackThis log and a link to your previous thread.

If it has been less than five days since your last response and you need the thread re-opened, please send me or MOD a private message (pm). A valid, working link to the closed topic is required.