Vx2 Problem -- I Think

HijackThis is running from a temporary folder

Create a new folder called C:HijackThis, move the HijackThis.exe file into the new folder and run it from there. This is necessary to ensure you have backups should anything go wrong.

Make sure that you have no browser windows open as this could prevent the fix from working properly. Open HijackThis, scan and when complete, remove the following entries by checking the box to the left and clicking 'fixed checked':

O4 - HKLM\..\Run: [Narrator] C:\WINDOWS\qvugiw.exe

Click here, for instructions on how to enable hidden files and folders to be visible. After enabling, reboot into Safe Mode by tapping F8 after the BIOS has loaded, find and delete the following:

C:\WINDOWS\qvugiw.exe

Reboot back to Normal Mode when done. Rescan with HJT and post a new log here.

Go here, download, extract the files from the zip:

http://forums.skads.org/index.php?act=Attach&type=post&id=66

Go to the new qoologic folder and run the batch file. Give it time to complete. Look for a log called C:\log.txt - post the contents here.

Log from qooligic: ECHO is off PLEASE NOTE THAT ALL FILES FOUND BY THIS METHOD ARE NOT BAD FILES, THERE MIGHT BE LEGIT FILES LISTED AND PLEASE BE CAREFUL WHILE FIXING. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE. Files Found in system Folder………… ———————— C:\WINDOWS\qvugiw.exe: .aspack C:\WINDOWS\installer.exe: .aspack C:\WINDOWS\gwukap.dat: .aspack Files Found in all users startup Folder………… ———————— C:\WINDOWS\Start Menu\Programs\StartUp\fkgiuh.exe: .aspack Files Found in all users windows Folder………… ———————— C:\WINDOWS\USER.DAT: Qoologic C:\WINDOWS\USER.DAT: QOOLOGIC C:\WINDOWS\USER.DAT: ExtractToC:\Program Files\Qoologic\ C:\WINDOWS\USER.DAT: extract5C:\Program Files\Qoologicq C:\WINDOWS\knconh.dll: excl_urls=adsv2.delfinproject.com,popup.msn.com,i.emarketresearchgroup.com,u.clkoptimizer.com,ezula.com,ads2.revenue.net,banners.pennyweb.com,counters.honesty.com,ads.bidclix.com,oz.valueclick.com,radio.launch.yahoo.com,zone.msn.com,sr.adwave.com,xlime.offeroptimizer.com,clickit.go2net.com,us.update.companion.yahoo.com,kill-pop-ups.com,qksrv.net,clickspring.net,cdn-aimtoday.aol.com,search200.com,servedby.adscpm.com,xanga.com,count.exitexchange.com,jnictech.cjt1.net,xadsq.offeroptimizer.com,paypopup.com,popuptraffic.com,cdn-cf.aol.com,allaboutsearching.com,hotmail.msn.com,adfarm.mediaplex.com,by.optimost.com,amch.questionmarket.com,akapp.whenu.com,newupdates.lzio.com,cfg.mywebsearch.com,searcheffect.com,ads.delfinproject.com,master.mx-targeting.com,hotmail.com,ctl.twain-tech.com,mail.yahoo.com,m2.doubleclick.net,insider.msg.yahoo.com,focusin.ads.targetnet.com,e.rn11.com,jmnad1.com,topicks.com,ad.doubleclick.net,m3.doubleclick.net,as.casalemedia.com,pgq.yahoo.com,webpdp.gator.com,stopzilla.com,ayb.lop.com,xadso.offeroptimizer.com,download.smileycentral.com,mm.delfinproject.com,view.atdmt.com,delfinproject.com,jbns2.cydoor.com,bannerfarm.ace.advertising.com,as.adwave.com,popuppers.com,look2me.com,wisapidata.weatherbug.com,ads.addynamix.com,ar.atwola.com,ad.trafficmp.com,updates.qoologic.com,ads1.revenue.net,weatherbug.com,jicmedia.cjt1.net,games.yahoo.com,adsrv.qoologic.com,servedby.advertising.com,ww2.weatherbug.com,rightmedia.net,bannerserver.gator.com,www4.yesadvertising.com,mmm.media-motor.net,hop.clickbank.net,media76.fastclick.net,websearch.com,isapi60.weatherbug.com,web.tickle.com,messenger.zango.com,wwp.icq.com,smileycentral.com,adserv1.gruvmedia.com,cdn.icq.com,s.clkoptimizer.com,tv.180solutions.com,pops.browseraid.com,download.abetterinternet.com,adserv.internetfuel.com,messenger.msn.com,sr.websearch.com,top-banners.com,advert.runescape.com,join1.winhundred.com,odysseusmarketing.com,v4.windowsupdate.microsoft.com,adverts.lzio.com,windowsupdate.microsoft.com,filter.belkin.com,comcast.net,sc.musicmatch.com,license.hotbar.com,trk.pcsecurityshield.com,web.icq.com,whenusearch.com,jbigpops.cjt1.net,isg05.casalemedia.com,yahoo.com,aol.com,anrdoezrs.net,microsoft.com,target.com,aim-charts.pf.aol.com,download.websearch.com,actualdeals.com,images.trafficmp.com,mydailyhoroscope.net,couponage.com,c5.zedo.com,ekmas.com,ads.mydailyhoroscope.net,creativeby.viewpoint.com,affiliates.4lowrates.com,hits.clickandtrack.net,jcontent.bns1.net,clickserve.cc-dt.com,popups.ad-logics.com,adlog2.lzio.com,host239.ipowerweb.com,bv.channel.aol.com,img2.mailpostdirect.com,dw.dailywinner.net,toprebates.com,trk.bestmagsdirect.com,ads.clickagents.com,a.websponsors.com,sandboxer.com,media.fastclick.net,click2.containsitall.com,ads234.com,http300.edge.ru4.com,adlog.com.com,rs.websearch.com,ads.com.com,server.iad.liveperson.net, C:\WINDOWS\sipnoe.dll: updates.qoologic.com C:\WINDOWS\xluazh.exe: updates.qoologic.com C:\WINDOWS\iluqyc.dll: updates.qoologic.com Finished

Start Killbox, copy and paste each of the following lines into the "Full Path of File to Delete" box in Killbox, and click the red button with the white X on it after each. Keep track of any files it tells you either could not be found or could not be deleted, as you'll need those later:

C:\WINDOWS\qvugiw.exe
C:\WINDOWS\gwukap.dat
C:\WINDOWS\Start Menu\Programs\StartUp\fkgiuh.exe
C:\WINDOWS\knconh.dll
C:\WINDOWS\sipnoe.dll
C:\WINDOWS\xluazh.exe
C:\WINDOWS\iluqyc.dll


For the files that it either couldn't find or couldn't delete, in the killbox again this time, put a mark next to "Delete on Reboot". Copy and paste each file into the file name box, then click the red button with the X after each. It will ask you if you want to reboot each time you click it, answer NO until after you've pasted the last file name, at which time you should answer Yes.

Reboot if it doesn't do so automatically and post a new qoologic log.

New qoologic log: ECHO is off PLEASE NOTE THAT ALL FILES FOUND BY THIS METHOD ARE NOT BAD FILES, THERE MIGHT BE LEGIT FILES LISTED AND PLEASE BE CAREFUL WHILE FIXING. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE. Files Found in system Folder………… ———————— C:\WINDOWS\installer.exe: .aspack Files Found in all users startup Folder………… ———————— Files Found in all users windows Folder………… ———————— C:\WINDOWS\USER.DAT: Qoologic C:\WINDOWS\USER.DAT: QOOLOGIC C:\WINDOWS\USER.DAT: Qoologic C:\WINDOWS\USER.DAT: QOOLOGIC C:\WINDOWS\USER.DAT: qoologic C:\WINDOWS\USER.DAT: QOOLOGIC C:\WINDOWS\USER.DAT: dQoologic log 2-3-05.txt C:\WINDOWS\USER.DAT: Qoologic log 2-3-05.txt.lnk C:\WINDOWS\USER.DAT: ExtractToC:\Program Files\Qoologic\ C:\WINDOWS\USER.DAT: Qoologic log 2-3-05.txt.lnk C:\WINDOWS\USER.DAT: extract5C:\Program Files\Qoologic8 Finished

OK good. Please post a new HJT log.

Make sure that you have no browser windows open as this could prevent the fix from working properly. Open HijackThis, scan and when complete, remove the following entries by checking the box to the left and clicking 'fixed checked':

O4 - HKLM\..\Run: [Narrator] C:\WINDOWS\qvugiw.exe

Reboot. Click here to download vx2fix15.zip. Extract vx2fix15.reg from the zip file and copy it to the desktop of the infected computer. When done, double click the vx2fix15.reg and when asked to merge say yes.

Rescan with HJT and post a final log here. Let me know how it's running now.

Narrator is still hanging in there for some reason. Click here to download eScan's mwav application. Double-click it to run it, select all local drives, scan all files, press 'scan' and when it is completed, anything found will be displayed in the lower pane. Highlight it, CTRL C and paste it in your next reply.

Log file from eScan virus scan: File C:\WINDOWS\QVUGIW.EXE infected by "Trojan-Downloader.Win32.Qoologic.f" Virus. Action Taken: No Action Taken. File C:\WINDOWS\QVUGIW.EXE infected by "Trojan-Downloader.Win32.Qoologic.f" Virus. Action Taken: No Action Taken. File C:\WINDOWS\xluazh.exe infected by "Trojan-Downloader.Win32.Qoologic.d" Virus. Action Taken: No Action Taken. File C:\WINDOWS\qvugiw.exe infected by "Trojan-Downloader.Win32.Qoologic.f" Virus. Action Taken: No Action Taken. File C:\WINDOWS\Start Menu\Programs\StartUp\fkgiuh.exe infected by "Trojan-Downloader.Win32.Qoologic.f" Virus. Action Taken: No Action Taken. File C:\WINDOWS\gwukap.dat infected by "Trojan-Downloader.Win32.Qoologic.f" Virus. Action Taken: No Action Taken. File C:\WINDOWS\appsetup.exe infected by "Trojan-Downloader.Win32.Small.aco" Virus. Action Taken: No Action Taken. File C:\WINDOWS\sipnoe.dll infected by "Trojan-Downloader.Win32.Qoologic.f" Virus. Action Taken: No Action Taken. File C:\WINDOWS\eZinstall.exe infected by "not-a-virus:AdWare.EZula.ak" Virus. Action Taken: No Action Taken. File C:\WINDOWS\woinstall.exe infected by "not-a-virus:AdWare.EZula.ak" Virus. Action Taken: No Action Taken. File C:\WINDOWS\Cxtpls_loader.exe infected by "not-a-virus:AdWare.Apropos.b" Virus. Action Taken: No Action Taken. File C:\WINDOWS\installer.exe infected by "Trojan-Dropper.Win32.Small.kz" Virus. Action Taken: No Action Taken. File C:\WINDOWS\iluqyc.dll infected by "Trojan-Downloader.Win32.Qoologic.d" Virus. Action Taken: No Action Taken. File C:\WINDOWS\SYSTEM\NBTBIOS.DLL infected by "not-a-virus:AdWare.Look2Me.r" Virus. Action Taken: No Action Taken. File C:\WINDOWS\SYSTEM\mqexdlm.srg infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken. File C:\WINDOWS\SYSTEM\javexulm.vxd infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken. File C:\WINDOWS\SYSTEM\msbe.dll infected by "not-a-virus:AdWare.BargainBuddy.l" Virus. Action Taken: No Action Taken. File C:\WINDOWS\SYSTEM\Aaitrap.dll infected by "not-a-virus:AdWare.Look2Me.r" Virus. Action Taken: No Action Taken. File C:\WINDOWS\SYSTEM\exdl0.exe infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken. File C:\WINDOWS\SYSTEM\angelex.exe infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken. File C:\WINDOWS\SYSTEM\exdl1.exe infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken. File C:\WINDOWS\SYSTEM\exul1.exe infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken. File C:\WINDOWS\SYSTEM\netut80ex.vxd infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken. File C:\WINDOWS\SYSTEM\dosync.dll infected by "not-a-virus:AdWare.Couponage.a" Virus. Action Taken: No Action Taken. File C:\WINDOWS\SYSTEM\docore.dll infected by "not-a-virus:AdWare.Couponage.a" Virus. Action Taken: No Action Taken. File C:\WINDOWS\SYSTEM\akupd.dll infected by "Trojan-Downloader.Win32.Agent.br" Virus. Action Taken: No Action Taken. File C:\WINDOWS\TEMP\backups\backup-20050131-183034-918-fkgiuh.exe infected by "Trojan-Downloader.Win32.Qoologic.f" Virus. Action Taken: No Action Taken. File C:\WINDOWS\TEMP\~apropos0\ph.exe infected by "Trojan-Downloader.Win32.Agent.hc" Virus. Action Taken: No Action Taken. File C:\WINDOWS\TEMP\~apropos0\pm.exe infected by "Trojan-Downloader.Win32.Apropo.d" Virus. Action Taken: No Action Taken. File C:\WINDOWS\TEMPOR~1\CONTENT.IE5\8LURK1YF\loader2[1].ocx infected by "Trojan-Downloader.Win32.Agent.ex" Virus. Action Taken: No Action Taken. File C:\WINDOWS\OPTIONS\CABS\OLS\AT&T\ATTKIT.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\WINDOWS\SYSTEM\NBTBIOS.DLL infected by "not-a-virus:AdWare.Look2Me.r" Virus. Action Taken: No Action Taken. File C:\WINDOWS\SYSTEM\mqexdlm.srg infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken. File C:\WINDOWS\SYSTEM\javexulm.vxd infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken. File C:\WINDOWS\SYSTEM\msbe.dll infected by "not-a-virus:AdWare.BargainBuddy.l" Virus. Action Taken: No Action Taken. File C:\WINDOWS\SYSTEM\Aaitrap.dll infected by "not-a-virus:AdWare.Look2Me.r" Virus. Action Taken: No Action Taken. File C:\WINDOWS\SYSTEM\exdl0.exe infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken. File C:\WINDOWS\SYSTEM\angelex.exe infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken. File C:\WINDOWS\SYSTEM\exdl1.exe infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken. File C:\WINDOWS\SYSTEM\exul1.exe infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken. File C:\WINDOWS\SYSTEM\netut80ex.vxd infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken. File C:\WINDOWS\SYSTEM\dosync.dll infected by "not-a-virus:AdWare.Couponage.a" Virus. Action Taken: No Action Taken. File C:\WINDOWS\SYSTEM\docore.dll infected by "not-a-virus:AdWare.Couponage.a" Virus. Action Taken: No Action Taken. File C:\WINDOWS\SYSTEM\akupd.dll infected by "Trojan-Downloader.Win32.Agent.br" Virus. Action Taken: No Action Taken. File C:\WINDOWS\TEMP\backups\backup-20050131-183034-918-fkgiuh.exe infected by "Trojan-Downloader.Win32.Qoologic.f" Virus. Action Taken: No Action Taken. File C:\WINDOWS\TEMP\~apropos0\ph.exe infected by "Trojan-Downloader.Win32.Agent.hc" Virus. Action Taken: No Action Taken. File C:\WINDOWS\TEMP\~apropos0\pm.exe infected by "Trojan-Downloader.Win32.Apropo.d" Virus. Action Taken: No Action Taken. File C:\WINDOWS\SYSTEM32\Process.exe tagged as not-a-virus:RiskWare.Tool.Processor.20. No Action Taken. File C:\WINDOWS\Application Data\Spybot - Search & Destroy\Recovery\eXactAdvertisingBargainsBuddy.zip infected by "Password-protected-EXE" Virus. Action Taken: No Action Taken. File C:\WINDOWS\Start Menu\Programs\StartUp\fkgiuh.exe infected by "Trojan-Downloader.Win32.Qoologic.f" Virus. Action Taken: No Action Taken. File C:\WINDOWS\Downloaded Program Files\loader2.ocx infected by "Trojan-Downloader.Win32.Agent.ex" Virus. Action Taken: No Action Taken. File C:\WINDOWS\Temporary Internet Files\Content.IE5\8LURK1YF\loader2[1].ocx infected by "Trojan-Downloader.Win32.Agent.ex" Virus. Action Taken: No Action Taken. File C:\WINDOWS\gwukap.dat infected by "Trojan-Downloader.Win32.Qoologic.f" Virus. Action Taken: No Action Taken. File C:\WINDOWS\appsetup.exe infected by "Trojan-Downloader.Win32.Small.aco" Virus. Action Taken: No Action Taken. File C:\WINDOWS\sipnoe.dll infected by "Trojan-Downloader.Win32.Qoologic.f" Virus. Action Taken: No Action Taken. File C:\WINDOWS\eZinstall.exe infected by "not-a-virus:AdWare.EZula.ak" Virus. Action Taken: No Action Taken. File C:\WINDOWS\woinstall.exe infected by "not-a-virus:AdWare.EZula.ak" Virus. Action Taken: No Action Taken. File C:\WINDOWS\Cxtpls_loader.exe infected by "not-a-virus:AdWare.Apropos.b" Virus. Action Taken: No Action Taken. File C:\WINDOWS\installer.exe infected by "Trojan-Dropper.Win32.Small.kz" Virus. Action Taken: No Action Taken. File C:\WINDOWS\iluqyc.dll infected by "Trojan-Downloader.Win32.Qoologic.d" Virus. Action Taken: No Action Taken. File C:\Program Files\Encompass\iecustomize.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\Program Files\Encompass\pager-ie.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\Program Files\Online Services\AT&T\ATTSETUP.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\Program Files\hbinst\Hbinst.exe infected by "not-a-virus:AdWare.ToolBar.Hotbar.c" Virus. Action Taken: No Action Taken. File C:\Program Files\Hijack This\backups\backup-20050131-180346-269-fkgiuh.exe infected by "Trojan-Downloader.Win32.Qoologic.f" Virus. Action Taken: No Action Taken. File C:\Program Files\eZula\CHCON.dll infected by "not-a-virus:AdWare.EZula.ae" Virus. Action Taken: No Action Taken. File C:\Program Files\Web Offer\CHPON.dll infected by "not-a-virus:AdWare.EZula.ae" Virus. Action Taken: No Action Taken. File C:\!Submit\USICOWS.DLL infected by "not-a-virus:AdWare.Look2Me.r" Virus. Action Taken: No Action Taken. File C:\!Submit\EIUMFILE.DLL infected by "not-a-virus:AdWare.Look2Me.r" Virus. Action Taken: No Action Taken. File C:\!Submit\PJTORERC.DLL infected by "not-a-virus:AdWare.Look2Me.r" Virus. Action Taken: No Action Taken. File C:\!Submit\CBET16.DLL infected by "not-a-virus:AdWare.Look2Me.r" Virus. Action Taken: No Action Taken. File C:\!Submit\WRWIZDLL.DLL infected by "not-a-virus:AdWare.Look2Me.r" Virus. Action Taken: No Action Taken. File C:\!Submit\DACPROP.DLL infected by "not-a-virus:AdWare.Look2Me.r" Virus. Action Taken: No Action Taken. File C:\!Submit\NA3TWEAK.DLL infected by "not-a-virus:AdWare.Look2Me.r" Virus. Action Taken: No Action Taken. File C:\!Submit\WSW32.DLL infected by "not-a-virus:AdWare.Look2Me.r" Virus. Action Taken: No Action Taken. File C:\!Submit\JBSD400.DLL infected by "not-a-virus:AdWare.Look2Me.r" Virus. Action Taken: No Action Taken. File C:\!Submit\MGSIP32.DLL infected by "not-a-virus:AdWare.Look2Me.r" Virus. Action Taken: No Action Taken. File C:\!Submit\TPUMBVW.DLL infected by "not-a-virus:AdWare.Look2Me.r" Virus. Action Taken: No Action Taken. File C:\!Submit\ONEPRO32.DLL infected by "not-a-virus:AdWare.Look2Me.r" Virus. Action Taken: No Action Taken. File C:\!Submit\DEBAND.DLL infected by "not-a-virus:AdWare.Look2Me.r" Virus. Action Taken: No Action Taken. File C:\!Submit\MZXML3.DLL infected by "not-a-virus:AdWare.Look2Me.r" Virus. Action Taken: No Action Taken. File C:\!Submit\OPBC32.DLL infected by "not-a-virus:AdWare.Look2Me.r" Virus. Action Taken: No Action Taken. File C:\!Submit\EKSEC32.DLL infected by "not-a-virus:AdWare.Look2Me.r" Virus. Action Taken: No Action Taken. File C:\!Submit\LIAVI70N.DLL infected by "not-a-virus:AdWare.Look2Me.r" Virus. Action Taken: No Action Taken. File C:\!Submit\mhuni11.dll infected by "not-a-virus:AdWare.Look2Me.r" Virus. Action Taken: No Action Taken. File C:\!Submit\OBECLI32.DLL infected by "not-a-virus:AdWare.Look2Me.r" Virus. Action Taken: No Action Taken. File C:\!Submit\VDR.DLL infected by "not-a-virus:AdWare.Look2Me.r" Virus. Action Taken: No Action Taken. File C:\!Submit\LJWPG70N.DLL infected by "not-a-virus:AdWare.Look2Me.r" Virus. Action Taken: No Action Taken. File C:\!Submit\SDTUPWBV.DLL infected by "not-a-virus:AdWare.Look2Me.r" Virus. Action Taken: No Action Taken. File C:\!Submit\waadmod.dll infected by "not-a-virus:AdWare.Look2Me.r" Virus. Action Taken: No Action Taken. File C:\!Submit\wvv8dmoe.dll infected by "not-a-virus:AdWare.Look2Me.r" Virus. Action Taken: No Action Taken. File C:\!Submit\PNTORERC.DLL infected by "not-a-virus:AdWare.Look2Me.r" Virus. Action Taken: No Action Taken. File C:\!Submit\ONEXL32.DLL infected by "not-a-virus:AdWare.Look2Me.r" Virus. Action Taken: No Action Taken. File C:\!Submit\PNDLIB32.DLL infected by "not-a-virus:AdWare.Look2Me.r" Virus. Action Taken: No Action Taken. File C:\!Submit\VYAME.DLL infected by "not-a-virus:AdWare.Look2Me.r" Virus. Action Taken: No Action Taken. File C:\!Submit\hxsetup.dll infected by "not-a-virus:AdWare.Look2Me.r" Virus. Action Taken: No Action Taken. File C:\!Submit\LXWPG70N.DLL infected by "not-a-virus:AdWare.Look2Me.r" Virus. Action Taken: No Action Taken. File C:\!Submit\DHIMAN32.DLL infected by "not-a-virus:AdWare.Look2Me.r" Virus. Action Taken: No Action Taken. File C:\!Submit\LR32.DLL infected by "not-a-virus:AdWare.Look2Me.r" Virus. Action Taken: No Action Taken. File C:\!Submit\ipetres.dll infected by "not-a-virus:AdWare.Look2Me.r" Virus. Action Taken: No Action Taken. File C:\!Submit\TJOLHELP.DLL infected by "not-a-virus:AdWare.Look2Me.r" Virus. Action Taken: No Action Taken. File C:\!Submit\CRICONFG.DLL infected by "not-a-virus:AdWare.Look2Me.r" Virus. Action Taken: No Action Taken. File C:\!Submit\mMpi32.dll infected by "not-a-virus:AdWare.Look2Me.r" Virus. Action Taken: No Action Taken. File C:\!Submit\SOROBJ.DLL infected by "not-a-virus:AdWare.Look2Me.r" Virus. Action Taken: No Action Taken. File C:\!Submit\sbrrun.dll infected by "not-a-virus:AdWare.Look2Me.r" Virus. Action Taken: No Action Taken. File C:\!Submit\mVpi32x.dll infected by "not-a-virus:AdWare.Look2Me.r" Virus. Action Taken: No Action Taken. File C:\!Submit\hnrm.dll infected by "not-a-virus:AdWare.Look2Me.r" Virus. Action Taken: No Action Taken. File C:\!Submit\co3230mt.dll infected by "not-a-virus:AdWare.Look2Me.r" Virus. Action Taken: No Action Taken. File C:\!Submit\oybctrac.dll infected by "not-a-virus:AdWare.Look2Me.r" Virus. Action Taken: No Action Taken. File C:\!Submit\mldamg9x.dll infected by "not-a-virus:AdWare.Look2Me.r" Virus. Action Taken: No Action Taken. File C:\!Submit\n20050308.exe infected by "not-a-virus:AdWare.EZula.ah" Virus. Action Taken: No Action Taken. File C:\!Submit\lzelgd.exe infected by "Trojan-Downloader.Win32.Apropo.d" Virus. Action Taken: No Action Taken. File C:\!Submit\AutoUpdate.exe infected by "Trojan-Downloader.Win32.Apropo.g" Virus. Action Taken: No Action Taken. File C:\!Submit\logbvm60.exe infected by "Trojan-Downloader.Win32.Agent.hc" Virus. Action Taken: No Action Taken. File C:\!Submit\gwukap.dat infected by "Trojan-Downloader.Win32.Qoologic.f" Virus. Action Taken: No Action Taken. File C:\!Submit\fkgiuh.exe infected by "Trojan-Downloader.Win32.Qoologic.f" Virus. Action Taken: No Action Taken. File C:\!Submit\sipnoe.dll infected by "Trojan-Downloader.Win32.Qoologic.f" Virus. Action Taken: No Action Taken. File C:\!Submit\xluazh.exe infected by "Trojan-Downloader.Win32.Qoologic.d" Virus. Action Taken: No Action Taken. File C:\!Submit\iluqyc.dll infected by "Trojan-Downloader.Win32.Qoologic.d" Virus. Action Taken: No Action Taken.

Start Killbox, copy and paste each of the following lines into the "Full Path of File to Delete" box in Killbox, and click the red button with the white X on it after each. Keep track of any files it tells you either could not be found or could not be deleted, as you'll need those later:

C:\Program Files\eZula\CHCON.dll
C:\Program Files\hbinst\Hbinst.exe
C:\Program Files\Web Offer\CHPON.dll
C:\WINDOWS\appsetup.exe
C:\WINDOWS\Cxtpls_loader.exe
C:\WINDOWS\Downloaded Program Files\loader2.ocx
C:\WINDOWS\eZinstall.exe
C:\WINDOWS\gwukap.dat
C:\WINDOWS\iluqyc.dll
C:\WINDOWS\installer.exe
C:\WINDOWS\QVUGIW.EXE
C:\WINDOWS\sipnoe.dll
C:\WINDOWS\Start Menu\Programs\StartUp\fkgiuh.exe
C:\WINDOWS\SYSTEM\Aaitrap.dll
C:\WINDOWS\SYSTEM\akupd.dll
C:\WINDOWS\SYSTEM\angelex.exe
C:\WINDOWS\SYSTEM\docore.dll
C:\WINDOWS\SYSTEM\dosync.dll
C:\WINDOWS\SYSTEM\exdl0.exe
C:\WINDOWS\SYSTEM\exdl1.exe
C:\WINDOWS\SYSTEM\exul1.exe
C:\WINDOWS\SYSTEM\javexulm.vxd
C:\WINDOWS\SYSTEM\mqexdlm.srg
C:\WINDOWS\SYSTEM\msbe.dll
C:\WINDOWS\SYSTEM\NBTBIOS.DLL
C:\WINDOWS\SYSTEM\netut80ex.vxd
C:\WINDOWS\TEMP\backups\backup-20050131-183034-918-fkgiuh.exe
C:\WINDOWS\TEMP\~apropos0\ph.exe
C:\WINDOWS\TEMP\~apropos0\pm.exe
C:\WINDOWS\Temporary Internet Files\Content.IE5\8LURK1YF\loader2[1].ocx
C:\WINDOWS\woinstall.exe
C:\WINDOWS\xluazh.exe

For the files that it either couldn't find or couldn't delete, in the killbox again this time, put a mark next to "Delete on Reboot". Copy and paste each file into the file name box, then click the red button with the X after each. It will ask you if you want to reboot each time you click it, answer NO until after you've pasted the last file name, at which time you should answer Yes.

Reboot if it doesn't do so automatically and post a new mwav scan.

Results of latest mwav scan: File C:\WINDOWS\OPTIONS\CABS\OLS\AT&T\ATTKIT.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\WINDOWS\SYSTEM32\Process.exe tagged as not-a-virus:RiskWare.Tool.Processor.20. No Action Taken. File C:\WINDOWS\Application Data\Spybot - Search & Destroy\Recovery\eXactAdvertisingBargainsBuddy.zip infected by "Password-protected-EXE" Virus. Action Taken: No Action Taken. File C:\Program Files\Encompass\iecustomize.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\Program Files\Encompass\pager-ie.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\Program Files\Online Services\AT&T\ATTSETUP.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\Program Files\Hijack This\backups\backup-20050131-180346-269-fkgiuh.exe infected by "Trojan-Downloader.Win32.Qoologic.f" Virus. Action Taken: No Action Taken. File C:\!Submit\USICOWS.DLL infected by "not-a-virus:AdWare.Look2Me.r" Virus. Action Taken: No Action Taken. File C:\!Submit\EIUMFILE.DLL infected by "not-a-virus:AdWare.Look2Me.r" Virus. Action Taken: No Action Taken. File C:\!Submit\PJTORERC.DLL infected by "not-a-virus:AdWare.Look2Me.r" Virus. Action Taken: No Action Taken. File C:\!Submit\CBET16.DLL infected by "not-a-virus:AdWare.Look2Me.r" Virus. Action Taken: No Action Taken. File C:\!Submit\WRWIZDLL.DLL infected by "not-a-virus:AdWare.Look2Me.r" Virus. Action Taken: No Action Taken. File C:\!Submit\DACPROP.DLL infected by "not-a-virus:AdWare.Look2Me.r" Virus. Action Taken: No Action Taken. File C:\!Submit\NA3TWEAK.DLL infected by "not-a-virus:AdWare.Look2Me.r" Virus. Action Taken: No Action Taken. File C:\!Submit\WSW32.DLL infected by "not-a-virus:AdWare.Look2Me.r" Virus. Action Taken: No Action Taken. File C:\!Submit\JBSD400.DLL infected by "not-a-virus:AdWare.Look2Me.r" Virus. Action Taken: No Action Taken. File C:\!Submit\MGSIP32.DLL infected by "not-a-virus:AdWare.Look2Me.r" Virus. Action Taken: No Action Taken. File C:\!Submit\TPUMBVW.DLL infected by "not-a-virus:AdWare.Look2Me.r" Virus. Action Taken: No Action Taken. File C:\!Submit\ONEPRO32.DLL infected by "not-a-virus:AdWare.Look2Me.r" Virus. Action Taken: No Action Taken. File C:\!Submit\DEBAND.DLL infected by "not-a-virus:AdWare.Look2Me.r" Virus. Action Taken: No Action Taken. File C:\!Submit\MZXML3.DLL infected by "not-a-virus:AdWare.Look2Me.r" Virus. Action Taken: No Action Taken. File C:\!Submit\OPBC32.DLL infected by "not-a-virus:AdWare.Look2Me.r" Virus. Action Taken: No Action Taken. File C:\!Submit\EKSEC32.DLL infected by "not-a-virus:AdWare.Look2Me.r" Virus. Action Taken: No Action Taken. File C:\!Submit\LIAVI70N.DLL infected by "not-a-virus:AdWare.Look2Me.r" Virus. Action Taken: No Action Taken. File C:\!Submit\mhuni11.dll infected by "not-a-virus:AdWare.Look2Me.r" Virus. Action Taken: No Action Taken. File C:\!Submit\OBECLI32.DLL infected by "not-a-virus:AdWare.Look2Me.r" Virus. Action Taken: No Action Taken. File C:\!Submit\VDR.DLL infected by "not-a-virus:AdWare.Look2Me.r" Virus. Action Taken: No Action Taken. File C:\!Submit\LJWPG70N.DLL infected by "not-a-virus:AdWare.Look2Me.r" Virus. Action Taken: No Action Taken. File C:\!Submit\SDTUPWBV.DLL infected by "not-a-virus:AdWare.Look2Me.r" Virus. Action Taken: No Action Taken. File C:\!Submit\waadmod.dll infected by "not-a-virus:AdWare.Look2Me.r" Virus. Action Taken: No Action Taken. File C:\!Submit\wvv8dmoe.dll infected by "not-a-virus:AdWare.Look2Me.r" Virus. Action Taken: No Action Taken. File C:\!Submit\PNTORERC.DLL infected by "not-a-virus:AdWare.Look2Me.r" Virus. Action Taken: No Action Taken. File C:\!Submit\ONEXL32.DLL infected by "not-a-virus:AdWare.Look2Me.r" Virus. Action Taken: No Action Taken. File C:\!Submit\PNDLIB32.DLL infected by "not-a-virus:AdWare.Look2Me.r" Virus. Action Taken: No Action Taken. File C:\!Submit\VYAME.DLL infected by "not-a-virus:AdWare.Look2Me.r" Virus. Action Taken: No Action Taken. File C:\!Submit\hxsetup.dll infected by "not-a-virus:AdWare.Look2Me.r" Virus. Action Taken: No Action Taken. File C:\!Submit\LXWPG70N.DLL infected by "not-a-virus:AdWare.Look2Me.r" Virus. Action Taken: No Action Taken. File C:\!Submit\DHIMAN32.DLL infected by "not-a-virus:AdWare.Look2Me.r" Virus. Action Taken: No Action Taken. File C:\!Submit\LR32.DLL infected by "not-a-virus:AdWare.Look2Me.r" Virus. Action Taken: No Action Taken. File C:\!Submit\ipetres.dll infected by "not-a-virus:AdWare.Look2Me.r" Virus. Action Taken: No Action Taken. File C:\!Submit\TJOLHELP.DLL infected by "not-a-virus:AdWare.Look2Me.r" Virus. Action Taken: No Action Taken. File C:\!Submit\CRICONFG.DLL infected by "not-a-virus:AdWare.Look2Me.r" Virus. Action Taken: No Action Taken. File C:\!Submit\mMpi32.dll infected by "not-a-virus:AdWare.Look2Me.r" Virus. Action Taken: No Action Taken. File C:\!Submit\SOROBJ.DLL infected by "not-a-virus:AdWare.Look2Me.r" Virus. Action Taken: No Action Taken. File C:\!Submit\sbrrun.dll infected by "not-a-virus:AdWare.Look2Me.r" Virus. Action Taken: No Action Taken. File C:\!Submit\mVpi32x.dll infected by "not-a-virus:AdWare.Look2Me.r" Virus. Action Taken: No Action Taken. File C:\!Submit\hnrm.dll infected by "not-a-virus:AdWare.Look2Me.r" Virus. Action Taken: No Action Taken. File C:\!Submit\co3230mt.dll infected by "not-a-virus:AdWare.Look2Me.r" Virus. Action Taken: No Action Taken. File C:\!Submit\oybctrac.dll infected by "not-a-virus:AdWare.Look2Me.r" Virus. Action Taken: No Action Taken. File C:\!Submit\mldamg9x.dll infected by "not-a-virus:AdWare.Look2Me.r" Virus. Action Taken: No Action Taken. File C:\!Submit\n20050308.exe infected by "not-a-virus:AdWare.EZula.ah" Virus. Action Taken: No Action Taken. File C:\!Submit\lzelgd.exe infected by "Trojan-Downloader.Win32.Apropo.d" Virus. Action Taken: No Action Taken. File C:\!Submit\AutoUpdate.exe infected by "Trojan-Downloader.Win32.Apropo.g" Virus. Action Taken: No Action Taken. File C:\!Submit\logbvm60.exe infected by "Trojan-Downloader.Win32.Agent.hc" Virus. Action Taken: No Action Taken. File C:\!Submit\CHCON.dll infected by "not-a-virus:AdWare.EZula.ae" Virus. Action Taken: No Action Taken. File C:\!Submit\gwukap.dat infected by "Trojan-Downloader.Win32.Qoologic.f" Virus. Action Taken: No Action Taken. File C:\!Submit\fkgiuh.exe infected by "Trojan-Downloader.Win32.Qoologic.f" Virus. Action Taken: No Action Taken. File C:\!Submit\sipnoe.dll infected by "Trojan-Downloader.Win32.Qoologic.f" Virus. Action Taken: No Action Taken. File C:\!Submit\xluazh.exe infected by "Trojan-Downloader.Win32.Qoologic.d" Virus. Action Taken: No Action Taken. File C:\!Submit\iluqyc.dll infected by "Trojan-Downloader.Win32.Qoologic.d" Virus. Action Taken: No Action Taken. File C:\!Submit\Hbinst.exe infected by "not-a-virus:AdWare.ToolBar.Hotbar.c" Virus. Action Taken: No Action Taken. File C:\!Submit\CHPON.dll infected by "not-a-virus:AdWare.EZula.ae" Virus. Action Taken: No Action Taken. File C:\!Submit\appsetup.exe infected by "Trojan-Downloader.Win32.Small.aco" Virus. Action Taken: No Action Taken. File C:\!Submit\Cxtpls_loader.exe infected by "not-a-virus:AdWare.Apropos.b" Virus. Action Taken: No Action Taken. File C:\!Submit\loader2.ocx infected by "Trojan-Downloader.Win32.Agent.ex" Virus. Action Taken: No Action Taken. File C:\!Submit\eZinstall.exe infected by "not-a-virus:AdWare.EZula.ak" Virus. Action Taken: No Action Taken. File C:\!Submit\installer.exe infected by "Trojan-Dropper.Win32.Small.kz" Virus. Action Taken: No Action Taken. File C:\!Submit\qvugiw.exe infected by "Trojan-Downloader.Win32.Qoologic.f" Virus. Action Taken: No Action Taken. File C:\!Submit\Aaitrap.dll infected by "not-a-virus:AdWare.Look2Me.r" Virus. Action Taken: No Action Taken. File C:\!Submit\akupd.dll infected by "Trojan-Downloader.Win32.Agent.br" Virus. Action Taken: No Action Taken. File C:\!Submit\angelex.exe infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken. File C:\!Submit\docore.dll infected by "not-a-virus:AdWare.Couponage.a" Virus. Action Taken: No Action Taken. File C:\!Submit\dosync.dll infected by "not-a-virus:AdWare.Couponage.a" Virus. Action Taken: No Action Taken. File C:\!Submit\exdl0.exe infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken. File C:\!Submit\exdl1.exe infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken. File C:\!Submit\exul1.exe infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken. File C:\!Submit\javexulm.vxd infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken. File C:\!Submit\mqexdlm.srg infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken. File C:\!Submit\msbe.dll infected by "not-a-virus:AdWare.BargainBuddy.l" Virus. Action Taken: No Action Taken. File C:\!Submit\NBTBIOS.DLL infected by "not-a-virus:AdWare.Look2Me.r" Virus. Action Taken: No Action Taken. File C:\!Submit\netut80ex.vxd infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken. File C:\!Submit\backup-20050131-183034-918-fkgiuh.exe infected by "Trojan-Downloader.Win32.Qoologic.f" Virus. Action Taken: No Action Taken. File C:\!Submit\ph.exe infected by "Trojan-Downloader.Win32.Agent.hc" Virus. Action Taken: No Action Taken. File C:\!Submit\pm.exe infected by "Trojan-Downloader.Win32.Apropo.d" Virus. Action Taken: No Action Taken. File C:\!Submit\loader2[1].ocx infected by "Trojan-Downloader.Win32.Agent.ex" Virus. Action Taken: No Action Taken. File C:\!Submit\woinstall.exe infected by "not-a-virus:AdWare.EZula.ak" Virus. Action Taken: No Action Taken.

That looks OK now - please post a new HJT log.