Auto.search.msn.com, Ieautosearch, Etc

The machine is not disconnected from the network/internet. Here are the HJT and silent runners logs (FindIt and mwavscan logs coming up in the following post): Logfile of HijackThis v1.98.2 Scan saved at 8:57:47 AM, on 12/11/2004 Platform: Windows 2000 SP4 (WinNT 5.00.2195) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINNT\System32\smss.exe c:\winnt\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\System32\termsrv.exe C:\WINNT\system32\svchost.exe C:\WINNT\system32\spoolsv.exe C:\WINNT\System32\msdtc.exe C:\Program Files\Symantec\pcAnywhere\awhost32.exe C:\WINNT\System32\CTsvcCDA.EXE C:\WINNT\System32\svchost.exe C:\Program Files\Expertcity\GoToMyPC\g2svc.exe C:\Program Files\Expertcity\GoToMyPC\g2comm.exe C:\WINNT\System32\llssrv.exe C:\WINNT\system32\regsvc.exe C:\WINNT\system32\MSTask.exe C:\WINNT\system32\stisvc.exe C:\WINNT\System32\WBEM\WinMgmt.exe C:\WINNT\System32\MsPMSPSv.exe C:\WINNT\system32\svchost.exe C:\WINNT\System32\inetsrv\inetinfo.exe C:\WINNT\system32\Dfssvc.exe C:\WINNT\System32\svchost.exe C:\Program Files\Expertcity\GoToMyPC\g2tray.exe c:\winnt\system32\rundll32.exe C:\WINNT\Explorer.EXE C:\WINNT\system32\wicoco.exe C:\Program Files\Babylon\Babylon.exe C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe C:\Program Files\Trillian\trillian.exe C:\Thanksgiving97extra\HijackThis.exe C:\WINNT\system32\svchost.exe C:\Program Files\Expertcity\GoToMyPC\g2mainh.exe C:\Program Files\Expertcity\GoToMyPC\g2host.exe C:\Program Files\Expertcity\GoToMyPC\g2printh.exe C:\DOCUME~1\fnery\LOCALS~1\Temp\mwavscan.com C:\DOCUME~1\fnery\LOCALS~1\Temp\kavss.exe C:\WINNT\system32\taskmgr.exe O1 - Hosts: 69.20.16.183 auto.search.msn.com O1 - Hosts: 69.20.16.183 search.netscape.com O1 - Hosts: 69.20.16.183 ieautosearch O1 - Hosts: 69.20.16.183 ieautosearch O4 - HKLM\..\Run: [PrinTray] C:\WINNT\system32\spool\DRIVERS\W32X86\2\printray.exe O4 - HKLM\..\Run: [GoToMyPC] C:\Program Files\Expertcity\GoToMyPC\g2svc.exe -logon O4 - HKCU\..\Run: [Babylon Translator] C:\Program Files\Babylon\Babylon.exe O4 - HKCU\..\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R O4 - Startup: Trillian.lnk = C:\Program Files\Trillian\trillian.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{314CDDDA-723C-45B2-BBE2-B55E0351E972}: NameServer = 151.203.0.84,151.203.0.85 "Silent Runners.vbs", revision 27, launched at: 09:02 Operating System: Windows 2000 Startup items buried in registry: ——————————— HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ "Babylon Translator" = "C:\Program Files\Babylon\Babylon.exe" ["Babylon Ltd."] "Creative Detector" = "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R" ["Creative Technology Ltd"] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ "PrinTray" = "C:\WINNT\system32\spool\DRIVERS\W32X86\2\printray.exe" ["Lexmark"] "GoToMyPC" = "C:\Program Files\Expertcity\GoToMyPC\g2svc.exe -logon" ["Expertcity"] "Narrator" = "C:\WINNT\system32\wicoco.exe" [null data] HKLM\Software\Microsoft\Active Setup\Installed Components\ ">{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\(Default)" = "" \StubPath = "C:\WINNT\inf\unregmp2.exe /ShowWMP" [MS] "aa8740aa-536f-4f2f-8c58-d4437d45c970\(Default)" = "" \StubPath = "C:\WINNT\system32\hzamam.exe" [null data] "{5945c046-1e7d-11d1-bc44-00c04fd912be}\(Default)" = "MSN Messenger 4.6" \StubPath = "rundll32.exe advpack.dll,LaunchINFSection C:\WINNT\INF\msmsgs.inf,BLC.Remove.PerUser" [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ "Network.ConnectionTray" = "{7007ACCF-3202-11D1-AAD2-00805FC1270E}" -> resolves to: {CLSID}\InprocServer32\(Default) = "C:\WINNT\system32\NETSHELL.dll" [MS] "WebCheck" = "{E6FB5E20-DE35-11CF-9C87-00AA005127ED}" -> resolves to: {CLSID}\InprocServer32\(Default) = ** WARNING – empty or invalid data! ** "SysTray" = "{35CEC8A3-2BE6-11D2-8773-92E220524153}" -> resolves to: {CLSID}\InprocServer32\(Default) = "stobject.dll" [MS] HKLM\System\CurrentControlSet\Control\Session Manager\ INFECTION WARNING! "BootExecute" = "DfsInit" [file not found] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ INFECTION WARNING! "MediaContentIndex\DLLName" = "C:\WINNT\system32\j22qlcf51f2.dll" [null data] INFECTION WARNING! "PCANotify\DLLName" = "PCANotify.dll" ["Symantec Corporation"] Startup items in "fnery" & "All Users" startup folders: ——————————————————- C:\Documents and Settings\fnery\Start Menu\Programs\Startup "Trillian" -> shortcut to: "C:\Program Files\Trillian\trillian.exe" ["Cerulean Studios"] C:\Documents and Settings\All Users\Start Menu\Programs\Startup "huipip.exe" [file not found] Enabled Scheduled Tasks: ———————— "Symantec NetDetect" -> launches: "C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE" ["Symantec Corporation"] Running Services (Display Name, Service Name, Path {Service DLL}): —————————————————————— Alerter, Alerter, "C:\WINNT\System32\services.exe" [MS] Automatic Updates, wuauserv, "C:\WINNT\system32\svchost.exe -k wugroup" {"C:\WINNT\System32\wuauserv.dll" [MS]} Background Intelligent Transfer Service, BITS, "C:\WINNT\system32\svchost.exe -k BITSgroup" {"C:\WINNT\System32\qmgr.dll" [MS]} COM+ Event System, EventSystem, "C:\WINNT\System32\svchost.exe -k netsvcs" {"C:\WINNT\System32\es.dll" [MS]} Computer Browser, Browser, "C:\WINNT\System32\services.exe" [MS] Creative Service for CDROM Access, Creative Service for CDROM Access, "C:\WINNT\System32\CTsvcCDA.EXE" ["Creative Technology Ltd"] DHCP Client, Dhcp, "C:\WINNT\System32\services.exe" [MS] Distributed File System, Dfs, "C:\WINNT\system32\Dfssvc.exe" [MS] Distributed Link Tracking Client, TrkWks, "C:\WINNT\system32\services.exe" [MS] Distributed Transaction Coordinator, MSDTC, "C:\WINNT\System32\msdtc.exe" [MS] DNS Client, Dnscache, "C:\WINNT\System32\services.exe" [MS] Event Log, Eventlog, "C:\WINNT\system32\services.exe" [MS] GoToMyPC, GoToMyPC, ""C:\Program Files\Expertcity\GoToMyPC\g2svc.exe" -service" ["Expertcity"] IIS Admin Service, IISADMIN, "C:\WINNT\System32\inetsrv\inetinfo.exe" [MS] IPSEC Policy Agent, PolicyAgent, "C:\WINNT\System32\lsass.exe" [MS] License Logging Service, LicenseService, "C:\WINNT\System32\llssrv.exe" [MS] Logical Disk Manager, dmserver, "C:\WINNT\System32\services.exe" [MS] Messenger, Messenger, "C:\WINNT\System32\services.exe" [MS] Network Connections, Netman, "C:\WINNT\System32\svchost.exe -k netsvcs" {"C:\WINNT\System32\netman.dll" [MS]} pcAnywhere Host Service, awhost32, "C:\Program Files\Symantec\pcAnywhere\awhost32.exe" ["Symantec Corporation"] Plug and Play, PlugPlay, "C:\WINNT\system32\services.exe" [MS] Print Spooler, Spooler, "C:\WINNT\system32\spoolsv.exe" [MS] Protected Storage, ProtectedStorage, "C:\WINNT\system32\services.exe" [MS] Remote Access Connection Manager, RasMan, "C:\WINNT\System32\svchost.exe -k netsvcs" {"C:\WINNT\System32\rasmans.dll" [MS]} Remote Procedure Call (RPC), RpcSs, "C:\WINNT\system32\svchost -k rpcss" {"C:\WINNT\system32\rpcss.dll" [MS]} Remote Registry Service, RemoteRegistry, "C:\WINNT\system32\regsvc.exe" [MS] Removable Storage, NtmsSvc, "C:\WINNT\System32\svchost.exe -k netsvcs" {"C:\WINNT\System32\NtmsSvc.dll" [MS]} RunAs Service, seclogon, "C:\WINNT\system32\services.exe" [MS] Security Accounts Manager, SamSs, "C:\WINNT\system32\lsass.exe" [MS] Server, lanmanserver, "C:\WINNT\System32\services.exe" [MS] Simple Mail Transport Protocol (SMTP), SMTPSVC, "C:\WINNT\System32\inetsrv\inetinfo.exe" [MS] Still Image Service, StiSvc, "C:\WINNT\system32\stisvc.exe" [MS] System Event Notification, SENS, "C:\WINNT\system32\svchost.exe -k netsvcs" {"C:\WINNT\system32\sens.dll" [MS]} Task Scheduler, Schedule, "C:\WINNT\system32\MSTask.exe" [MS] TCP/IP NetBIOS Helper Service, LmHosts, "C:\WINNT\System32\services.exe" [MS] Telephony, TapiSrv, "C:\WINNT\System32\svchost.exe -k tapisrv" {"C:\WINNT\System32\tapisrv.dll" [MS]} Terminal Services, TermService, "C:\WINNT\System32\termsrv.exe" [MS] Windows Management Instrumentation, WinMgmt, "C:\WINNT\System32\WBEM\WinMgmt.exe" [MS] Windows Management Instrumentation Driver Extensions, Wmi, "C:\WINNT\system32\Services.exe" [MS] WMDM PMSP Service, WMDM PMSP Service, "C:\WINNT\System32\MsPMSPSv.exe" [MS] Workstation, lanmanworkstation, "C:\WINNT\System32\services.exe" [MS] World Wide Web Publishing Service, W3SVC, "C:\WINNT\System32\inetsrv\inetinfo.exe" [MS]

Disabled the network connection (I'll copy logs to floppy and bring over to this machine from now on–sorry, won't happen again).

mwavscan:
Below is what I copied from contents of the lower pane of eScan, which are the lines that have "action taken"

qoologic:
Also below are the contents of c:\win.txt and c:\start.txt. (I realized I hadn't let it finish last time I ran it but this time I did)


mwavscan:
File C:\PROGRA~1\EXPERT~1\GoToMyPC\g2comm.exe tagged as not-a-virus:RiskWare.RemoteAdmin.GotomyPC.a. No Action Taken.
File C:\PROGRA~1\EXPERT~1\GoToMyPC\g2hook.dll tagged as not-a-virus:RiskWare.RemoteAdmin.GotomyPC.a. No Action Taken.
File C:\PROGRA~1\EXPERT~1\GoToMyPC\g2svc.exe tagged as not-a-virus:RiskWare.RemoteAdmin.GotomyPC.a. No Action Taken.
File C:\WINNT\system32\cwqzqz.dll infected by "Trojan-Downloader.Win32.Qoologic.d" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\eonunu.dll infected by "Trojan-Downloader.Win32.Qoologic.e" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\lsp.dll infected by "not-a-virus:AdWare.Sahat.f" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\wicoco.exe infected by "Trojan-Downloader.Win32.Qoologic.e" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\hzamam.exe infected by "Trojan-Downloader.Win32.Qoologic.d" Virus. Action Taken: No Action Taken.
File C:\PROGRA~1\EXPERT~1\GoToMyPC\g2svc.exe tagged as not-a-virus:RiskWare.RemoteAdmin.GotomyPC.a. No Action Taken.
File C:\WINNT\system32\wicoco.exe infected by "Trojan-Downloader.Win32.Qoologic.e" Virus. Action Taken: No Action Taken.
File C:\Documents and Settings\All Users\Start Menu\Programs\Startup\huipip.exe infected by "Trojan-Downloader.Win32.Qoologic.e" Virus. Action Taken: No Action Taken.
File C:\PROGRA~1\EXPERT~1\GoToMyPC\g2svc.exe tagged as not-a-virus:RiskWare.RemoteAdmin.GotomyPC.a. No Action Taken.
File C:\WINNT\autoheal.exe infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken.
File C:\WINNT\iconw.exe infected by "not-a-virus:AdWare.Zestyfind" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\calsp.dll infected by "Trojan-Downloader.Win32.Agent.br" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\cwqzqz.dll infected by "Trojan-Downloader.Win32.Qoologic.d" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\eonunu.dll infected by "Trojan-Downloader.Win32.Qoologic.e" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\exdl1.exe infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\exdl2.exe infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\exdl3.exe infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\gotomon.dll tagged as not-a-virus:RiskWare.RemoteAdmin.GotomyPC.a. No Action Taken.
File C:\WINNT\system32\hzamam.exe infected by "Trojan-Downloader.Win32.Qoologic.d" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\instsrv.exe tagged as not-a-virus:RiskWare.Tool.ServiceRunner.f. No Action Taken.
File C:\WINNT\system32\javex80.vxd infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\kalvdns32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\kalvhlu32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\kalvyza32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\lsp.dll infected by "not-a-virus:AdWare.Sahat.f" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\mac80ex.idf infected by "not-a-virus:AdWare.BargainBuddy.l" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\mqexdlm.srg infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\netut80ex.vxd infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\pakyky.dat infected by "Trojan-Downloader.Win32.Qoologic.e" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\psis80ex.ax infected by "not-a-virus:AdWare.BargainBuddy.l" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\wicoco.exe infected by "Trojan-Downloader.Win32.Qoologic.e" Virus. Action Taken: No Action Taken.
File C:\DOCUME~1\fnery\LOCALS~1\Temp\Ecw93.exe infected by "Trojan-Downloader.Win32.VB.ge" Virus. Action Taken: No Action Taken.
File C:\DOCUME~1\fnery\LOCALS~1\TEMPOR~1\Content.IE5\89ABUDWF\AppWrap[2].exe infected by "Trojan-Dropper.Win32.Small.of" Virus. Action Taken: No Action Taken.
File C:\DOCUME~1\fnery\LOCALS~1\TEMPOR~1\Content.IE5\89ABUDWF\AppWrap[3].exe infected by "Trojan-Dropper.Win32.Small.of" Virus. Action Taken: No Action Taken.
File C:\DOCUME~1\fnery\LOCALS~1\TEMPOR~1\Content.IE5\IJK34N67\AppWrap[1].exe infected by "Trojan-Dropper.Win32.Small.of" Virus. Action Taken: No Action Taken.
File C:\DOCUME~1\fnery\LOCALS~1\TEMPOR~1\Content.IE5\IJK34N67\AppWrap[2].exe infected by "Trojan-Dropper.Win32.Small.of" Virus. Action Taken: No Action Taken.
File C:\DOCUME~1\fnery\LOCALS~1\TEMPOR~1\Content.IE5\IJK34N67\package8033_VENTURAMK3[1].cab infected by "not-a-virus:AdWare.BargainBuddy.l" Virus. Action Taken: No Action Taken.
File C:\DOCUME~1\fnery\LOCALS~1\TEMPOR~1\Content.IE5\IJK34N67\uninst[1].exe infected by "Trojan-Downloader.Win32.VB.ge" Virus. Action Taken: No Action Taken.
File C:\DOCUME~1\fnery\LOCALS~1\TEMPOR~1\Content.IE5\OLI3O5EF\AppWrap[1].exe infected by "Trojan-Dropper.Win32.Small.of" Virus. Action Taken: No Action Taken.
File C:\DOCUME~1\fnery\LOCALS~1\TEMPOR~1\Content.IE5\OLI3O5EF\track[1].htm infected by "Exploit.HTML.Mht" Virus. Action Taken: No Action Taken.
File C:\DOCUME~1\fnery\LOCALS~1\TEMPOR~1\Content.IE5\WXYB8D63\AppWrap[1].exe infected by "Trojan-Dropper.Win32.Small.of" Virus. Action Taken: No Action Taken.
File C:\DOCUME~1\fnery\LOCALS~1\TEMPOR~1\Content.IE5\WXYB8D63\AppWrap[2].exe infected by "not-a-virus:AdWare.Zestyfind" Virus. Action Taken: No Action Taken.
File C:\DOCUME~1\fnery\LOCALS~1\TEMPOR~1\Content.IE5\WXYB8D63\bunSetup[1].cab infected by "not-a-virus:AdWare.Sahat.f" Virus. Action Taken: No Action Taken.
File C:\Documents and Settings\All Users\Start Menu\Programs\Startup\huipip.exe infected by "Trojan-Downloader.Win32.Qoologic.e" Virus. Action Taken: No Action Taken.
File C:\Documents and Settings\fnery\Local Settings\Temp\Ecw93.exe infected by "Trojan-Downloader.Win32.VB.ge" Virus. Action Taken: No Action Taken.
File C:\Documents and Settings\fnery\Local Settings\Temporary Internet Files\Content.IE5\89ABUDWF\AppWrap[2].exe infected by "Trojan-Dropper.Win32.Small.of" Virus. Action Taken: No Action Taken.
File C:\Documents and Settings\fnery\Local Settings\Temporary Internet Files\Content.IE5\89ABUDWF\AppWrap[3].exe infected by "Trojan-Dropper.Win32.Small.of" Virus. Action Taken: No Action Taken.
File C:\Documents and Settings\fnery\Local Settings\Temporary Internet Files\Content.IE5\IJK34N67\AppWrap[1].exe infected by "Trojan-Dropper.Win32.Small.of" Virus. Action Taken: No Action Taken.
File C:\Documents and Settings\fnery\Local Settings\Temporary Internet Files\Content.IE5\IJK34N67\AppWrap[2].exe infected by "Trojan-Dropper.Win32.Small.of" Virus. Action Taken: No Action Taken.
File C:\Documents and Settings\fnery\Local Settings\Temporary Internet Files\Content.IE5\IJK34N67\package8033_VENTURAMK3[1].cab infected by "not-a-virus:AdWare.BargainBuddy.l" Virus. Action Taken: No Action Taken.
File C:\Documents and Settings\fnery\Local Settings\Temporary Internet Files\Content.IE5\IJK34N67\uninst[1].exe infected by "Trojan-Downloader.Win32.VB.ge" Virus. Action Taken: No Action Taken.
File C:\Documents and Settings\fnery\Local Settings\Temporary Internet Files\Content.IE5\OLI3O5EF\AppWrap[1].exe infected by "Trojan-Dropper.Win32.Small.of" Virus. Action Taken: No Action Taken.
File C:\Documents and Settings\fnery\Local Settings\Temporary Internet Files\Content.IE5\OLI3O5EF\track[1].htm infected by "Exploit.HTML.Mht" Virus. Action Taken: No Action Taken.
File C:\Documents and Settings\fnery\Local Settings\Temporary Internet Files\Content.IE5\WXYB8D63\AppWrap[1].exe infected by "Trojan-Dropper.Win32.Small.of" Virus. Action Taken: No Action Taken.
File C:\Documents and Settings\fnery\Local Settings\Temporary Internet Files\Content.IE5\WXYB8D63\AppWrap[2].exe infected by "not-a-virus:AdWare.Zestyfind" Virus. Action Taken: No Action Taken.
File C:\Documents and Settings\fnery\Local Settings\Temporary Internet Files\Content.IE5\WXYB8D63\bunSetup[1].cab infected by "not-a-virus:AdWare.Sahat.f" Virus. Action Taken: No Action Taken.
File C:\Program Files\Expertcity\GoToMyPC\g2comm.exe tagged as not-a-virus:RiskWare.RemoteAdmin.GotomyPC.a. No Action Taken.
File C:\Program Files\Expertcity\GoToMyPC\g2hook.dll tagged as not-a-virus:RiskWare.RemoteAdmin.GotomyPC.a. No Action Taken.
File C:\Program Files\Expertcity\GoToMyPC\g2svc.exe tagged as not-a-virus:RiskWare.RemoteAdmin.GotomyPC.a. No Action Taken.
File C:\Program Files\Expertcity\GoToMyPC\gopcsrv.exe tagged as not-a-virus:RiskWare.RemoteAdmin.GotomyPC.a. No Action Taken.
File C:\Program Files\Expertcity\GoToMyPC\gotomon.dll tagged as not-a-virus:RiskWare.RemoteAdmin.GotomyPC.a. No Action Taken.
File C:\Program Files\Recommended Hotfix - 421701D\v15\RH.DLL infected by "not-a-virus:AdWare.SmartPops" Virus. Action Taken: No Action Taken.
File C:\Program Files\Recommended Hotfix - 421701D\v15\RH.exe infected by "not-a-virus:AdWare.SmartPops" Virus. Action Taken: No Action Taken.
File C:\Program Files\SED\SE.exe infected by "not-a-virus:AdWare.WindowEnhancer" Virus. Action Taken: No Action Taken.
File C:\sidebDD.exe infected by "not-a-virus:AdWare.ToolBar.EliteBar.v" Virus. Action Taken: No Action Taken.
File C:\silent093.exe infected by "not-a-virus:AdWare.ToolBar.EliteBar.q" Virus. Action Taken: No Action Taken.
File C:\Thanksgiving97extra\backups\backup-20041203-041802-938-huipip.exe infected by "Trojan-Downloader.Win32.Qoologic.d" Virus. Action Taken: No Action Taken.
File C:\Thanksgiving97extra\backups\backup-20041204-014729-276-huipip.exe infected by "Trojan-Downloader.Win32.Qoologic.d" Virus. Action Taken: No Action Taken.
File C:\Thanksgiving97extra\backups\backup-20041205-060538-824-huipip.exe infected by "Trojan-Downloader.Win32.Qoologic.d" Virus. Action Taken: No Action Taken.
File C:\Thanksgiving97extra\backups\backup-20041205-064813-181-huipip.exe infected by "Trojan-Downloader.Win32.Qoologic.d" Virus. Action Taken: No Action Taken.
File C:\Thanksgiving97extra\backups\backup-20041205-070027-126.dll infected by "not-a-virus:AdWare.BargainBuddy.l" Virus. Action Taken: No Action Taken.
File C:\Thanksgiving97extra\backups\backup-20041205-070027-275.dll infected by "not-a-virus:AdWare.BargainBuddy.l" Virus. Action Taken: No Action Taken.
File C:\Thanksgiving97extra\backups\backup-20041205-070027-848.dll infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken.
File C:\Thanksgiving97extra\theFiles.zip infected by "Trojan-Downloader.Win32.Qoologic.d" Virus. Action Taken: No Action Taken.
File C:\WINNT\autoheal.exe infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken.
File C:\WINNT\Downloaded Program Files\CONFLICT.1\HDPlugin1015.dll infected by "not-a-virus:AdWare.Gator.1015" Virus. Action Taken: No Action Taken.
File C:\WINNT\Downloaded Program Files\lsp_.dll infected by "not-a-virus:AdWare.Sahat.f" Virus. Action Taken: No Action Taken.
File C:\WINNT\Downloaded Program Files\QDow_AS2.dll infected by "TrojanDownloader.Win32.QDown.l" Virus. Action Taken: No Action Taken.
File C:\WINNT\Downloaded Program Files\WEBInstaller.dll infected by "not-a-virus:AdWare.Sahat.c" Virus. Action Taken: No Action Taken.
File C:\WINNT\iconw.exe infected by "not-a-virus:AdWare.Zestyfind" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\calsp.dll infected by "Trojan-Downloader.Win32.Agent.br" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\cwqzqz.dll infected by "Trojan-Downloader.Win32.Qoologic.d" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\exdl1.exe infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\exdl2.exe infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\exdl3.exe infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\gotomon.dll tagged as not-a-virus:RiskWare.RemoteAdmin.GotomyPC.a. No Action Taken.
File C:\WINNT\system32\instsrv.exe tagged as not-a-virus:RiskWare.Tool.ServiceRunner.f. No Action Taken.
File C:\WINNT\system32\javex80.vxd infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\kalvdns32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\kalvhlu32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\kalvyza32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\lsp.dll infected by "not-a-virus:AdWare.Sahat.f" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\mac80ex.idf infected by "not-a-virus:AdWare.BargainBuddy.l" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\mqexdlm.srg infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\netut80ex.vxd infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\pakyky.dat infected by "Trojan-Downloader.Win32.Qoologic.e" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\psis80ex.ax infected by "not-a-virus:AdWare.BargainBuddy.l" Virus. Action Taken: No Action Taken.
File C:\WINNT\Temp\down.cab infected by "not-a-virus:AdWare.Wintol.p" Virus. Action Taken: No Action Taken.
File C:\WINNT\Temp\nsdtmp09.dll infected by "not-a-virus:AdWare.MetaDirect.a" Virus. Action Taken: No Action Taken.
File C:\WINNT\Temp\wtmp.exe infected by "Trojan-Downloader.Win32.Qoologic.d" Virus. Action Taken: No Action Taken.
File C:\WINNT\Temp\WToolsB.dll infected by "not-a-virus:AdWare.Wintol.p" Virus. Action Taken: No Action Taken.



qoologic:

win.txt:
C:\WINNT\system32\cwqzqz.dll: updates.qoologic.com
C:\WINNT\system32\eonunu.dll: updates.qoologic.com
C:\WINNT\system32\hzamam.exe: updates.qoologic.com
C:\WINNT\system32\pakyky.dat: .aspack
C:\WINNT\system32\wicoco.exe: .aspack

start.txt:
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\huipip.exe: .aspack

1.) wicoco.exe was not in the list of running processes

2.) KillBox: after pasting the last file name and answering Yes to reboot, I got this message:

PendingFileRenameOperations
PendingFileRenameOperations Registry Data has been Removed by External Process!

So I hit OK and rebooted manually.

3.) Below are HJT log, Findit log and the output from the mwavscan. qoologic win and start txts were empty.


Logfile of HijackThis v1.98.2
Scan saved at 10:11:01 AM, on 12/13/2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
c:\winnt\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\System32\termsrv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\msdtc.exe
C:\WINNT\System32\CTsvcCDA.EXE
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\llssrv.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\MsPMSPSv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\inetsrv\inetinfo.exe
C:\WINNT\system32\Dfssvc.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\Thanksgiving97extra\KillBox\KillBox.exe
C:\WINNT\system32\NOTEPAD.EXE
C:\Thanksgiving97extra\HijackThis.exe

O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O4 - HKLM\..\Run: [PrinTray] C:\WINNT\system32\spool\DRIVERS\W32X86\2\printray.exe
O4 - HKLM\..\Run: [GoToMyPC] C:\Program Files\Expertcity\GoToMyPC\g2svc.exe -logon
O4 - HKLM\..\Run: [Narrator] C:\WINNT\system32\wicoco.exe
O4 - HKCU\..\Run: [Babylon Translator] C:\Program Files\Babylon\Babylon.exe
O4 - HKCU\..\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R
O4 - Startup: Trillian.lnk = C:\Program Files\Trillian\trillian.exe
O10 - Broken Internet access because of LSP provider 'c:\winnt\system32\lsp.dll' missing
O17 - HKLM\System\CCS\Services\Tcpip\..\{314CDDDA-723C-45B2-BBE2-B55E0351E972}: NameServer = 151.203.0.84,151.203.0.85




Warning! This utility will find legitimate files in addition to malware.
Do not remove anything unless you are sure you know what you're doing.

——- System Files in System32 Directory ——-

Volume in drive C has no label.
Volume Serial Number is 6410-3FBD

Directory of C:\WINNT\System32

12/13/2004 09:45a 224,353 jt4o07h3e.dll
12/03/2004 01:56a dllcache
1 File(s) 224,353 bytes
1 Dir(s) 1,904,140,288 bytes free

——- Hidden Files in System32 Directory ——-

Volume in drive C has no label.
Volume Serial Number is 6410-3FBD

Directory of C:\WINNT\System32

12/05/2004 06:31a 4,212 zllictbl.dat
12/03/2004 01:56a dllcache
01/09/2001 09:11a GroupPolicy
01/08/2001 06:44p 271 desktop.ini
01/08/2001 06:44p 21,692 folder.htt
3 File(s) 26,175 bytes
2 Dir(s) 1,904,140,288 bytes free

———- Files Named "Guard" ————-

Volume in drive C has no label.
Volume Serial Number is 6410-3FBD

Directory of C:\WINNT\System32


——— Temp Files in System32 Directory ——–

Volume in drive C has no label.
Volume Serial Number is 6410-3FBD

Directory of C:\WINNT\System32

04/25/2002 08:11p 109,568 SET425.tmp
03/05/2002 08:56a 582,656 SET427.tmp
03/04/2002 07:09p 548,864 SET423.tmp
12/07/1999 07:00a 2,577 CONFIG.TMP
4 File(s) 1,243,665 bytes
0 Dir(s) 1,904,140,288 bytes free

—————- User Agent ————

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{737264BE-16FD-421F-BBEC-FDAC4F7C396B}"=""


———— Keys Under Notify ————

REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,72,79,70,74,33,32,2e,64,6c,6c,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,72,79,70,74,6e,65,74,2e,64,6c,6c,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Nls]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINNT\\system32\\guard.tmp"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\PCANotify]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"Unlock"="WLEventUnlock"
"Lock"="WLEventLock"
"Startup"="WLEventStartup"
"DllName"="PCANotify.dll"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,63,6c,67,6e,74,66,79,2e,64,6c,6c,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,6c,6e,6f,74,69,66,79,2e,64,6c,6c,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WebCheck]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINNT\\system32\\jtj6071se.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wzcnotif]
"DLLName"="wzcdlg.dll"
"Logon"="WZCEventLogon"
"Logoff"="WZCEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000000


—————- Xfind Results —————–

C:\WINNT\System32\JT4O07~1.DLL +++ File read error

————– Locate.com Results —————


C:\WINNT\SYSTEM32\
jt4o07~1.dll Mon Dec 13 2004 9:45:28a ..S.R 224,353 219.09 K
zllictbl.dat Sun Dec 5 2004 6:31:12a …H. 4,212 4.11 K

2 items found: 2 files, 0 directories.
Total of file sizes: 228,565 bytes 223.21 K



File C:\PROGRA~1\EXPERT~1\GoToMyPC\g2svc.exe tagged as not-a-virus:RiskWare.RemoteAdmin.GotomyPC.a. No Action Taken.
File C:\PROGRA~1\EXPERT~1\GoToMyPC\g2svc.exe tagged as not-a-virus:RiskWare.RemoteAdmin.GotomyPC.a. No Action Taken.
File C:\WINNT\system32\gotomon.dll tagged as not-a-virus:RiskWare.RemoteAdmin.GotomyPC.a. No Action Taken.
File C:\WINNT\system32\instsrv.exe tagged as not-a-virus:RiskWare.Tool.ServiceRunner.f. No Action Taken.
File C:\WINNT\system32\javex80.vxd infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken.
File C:\!Submit\cwqzqz.dll infected by "Trojan-Downloader.Win32.Qoologic.d" Virus. Action Taken: No Action Taken.
File C:\!Submit\eonunu.dll infected by "Trojan-Downloader.Win32.Qoologic.e" Virus. Action Taken: No Action Taken.
File C:\!Submit\pakyky.dat infected by "Trojan-Downloader.Win32.Qoologic.e" Virus. Action Taken: No Action Taken.
File C:\!Submit\silent093.exe infected by "not-a-virus:AdWare.ToolBar.EliteBar.q" Virus. Action Taken: No Action Taken.
File C:\Program Files\Expertcity\GoToMyPC\g2comm.exe tagged as not-a-virus:RiskWare.RemoteAdmin.GotomyPC.a. No Action Taken.
File C:\Program Files\Expertcity\GoToMyPC\g2hook.dll tagged as not-a-virus:RiskWare.RemoteAdmin.GotomyPC.a. No Action Taken.
File C:\Program Files\Expertcity\GoToMyPC\g2svc.exe tagged as not-a-virus:RiskWare.RemoteAdmin.GotomyPC.a. No Action Taken.
File C:\Program Files\Expertcity\GoToMyPC\gopcsrv.exe tagged as not-a-virus:RiskWare.RemoteAdmin.GotomyPC.a. No Action Taken.
File C:\Program Files\Expertcity\GoToMyPC\gotomon.dll tagged as not-a-virus:RiskWare.RemoteAdmin.GotomyPC.a. No Action Taken.
File C:\Thanksgiving97extra\backups\backup-20041203-041802-938-huipip.exe infected by "Trojan-Downloader.Win32.Qoologic.d" Virus. Action Taken: No Action Taken.
File C:\Thanksgiving97extra\backups\backup-20041204-014729-276-huipip.exe infected by "Trojan-Downloader.Win32.Qoologic.d" Virus. Action Taken: No Action Taken.
File C:\Thanksgiving97extra\backups\backup-20041205-060538-824-huipip.exe infected by "Trojan-Downloader.Win32.Qoologic.d" Virus. Action Taken: No Action Taken.
File C:\Thanksgiving97extra\backups\backup-20041205-064813-181-huipip.exe infected by "Trojan-Downloader.Win32.Qoologic.d" Virus. Action Taken: No Action Taken.
File C:\Thanksgiving97extra\backups\backup-20041205-070027-126.dll infected by "not-a-virus:AdWare.BargainBuddy.l" Virus. Action Taken: No Acti on Taken.
File C:\Thanksgiving97extra\backups\backup-20041205-070027-275.dll infected by "not-a-virus:AdWare.BargainBuddy.l" Virus. Action Taken: No Acti on Taken.
File C:\Thanksgiving97extra\backups\backup-20041205-070027-848.dll infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Acti on Taken.
File C:\Thanksgiving97extra\theFiles.zip infected by "Trojan-Downloader.Win32.Qoologic.d" Virus. Action Taken: No Action Taken.
File C:\WINNT\system32\gotomon.dll tagged as not-a-virus:RiskWare.RemoteAdmin.GotomyPC.a. No Action Taken.
File C:\WINNT\system32\instsrv.exe tagged as not-a-virus:RiskWare.Tool.ServiceRunner.f. No Action Taken.
File C:\WINNT\system32\javex80.vxd infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken.

So you did it, am I right?! Please point me to your tip jar!

Logfile of HijackThis v1.98.2
Scan saved at 1:15:35 AM, on 12/15/2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
c:\winnt\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\System32\termsrv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\msdtc.exe
C:\WINNT\System32\CTsvcCDA.EXE
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\llssrv.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\MsPMSPSv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\inetsrv\inetinfo.exe
C:\WINNT\system32\Dfssvc.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\taskmgr.exe
C:\Thanksgiving97extra\HijackThis.exe

O4 - HKLM\..\Run: [PrinTray] C:\WINNT\system32\spool\DRIVERS\W32X86\2\printray.exe
O4 - HKLM\..\Run: [GoToMyPC] C:\Program Files\Expertcity\GoToMyPC\g2svc.exe -logon
O4 - HKCU\..\Run: [Babylon Translator] C:\Program Files\Babylon\Babylon.exe
O4 - HKCU\..\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R
O4 - Startup: Trillian.lnk = C:\Program Files\Trillian\trillian.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{314CDDDA-723C-45B2-BBE2-B55E0351E972}: NameServer = 151.203.0.84,151.203.0.85