[ssurf]

 hijackthislog.txt   2.25KB   93 downloadsGreetings!
I'm looking for help to remove something called Win32.Qoologic.V, which my ZoneLab Security Sweep tells me that SpySweeper was unable to treat. Is "V" a new variant? I've done the usual scans with Ad-Aware (found nothing), SpyBot S&D (found Unforgettable!.exe), SpySweeper (found ckloptimizer), and Ewido (found nothing).

My HJT log shows the stubborn pieces that keep coming back, mostly notably:
[winsync] iwpaow.exe
[C:\WINDOWS\system32\regsvr 32 /s] hhctrl.exe under a \RunOnce HKLM
and [Unforgettable!.exe] under C:\Program (of course, there is no program in my Folders with Unforgettable) {Spybot SD finds this under Autorun settings HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Unforgettable!}

In addition, my Find-Qoologic batch file found an WINDOWS\system32\nbdgabx.exe which does not sound legitimate.

HKLM\Software\Microsoft\Active Setup\Installed Components\
"45d0549b-b7de-4d57-bfcc-450795e790a4\(Default)" = ""
\StubPath = "C:\WINDOWS\system32\nbdqabx.exe" [file not found]

">{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS\(Default)" = "Browser Customizations"
\StubPath = "RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP" [file not found]

Other things I've noticed:

When restarting Windows, a little shield sometimes shows up in the Taskbar which looks just like the official Windows Update, but the download always says 0%. The little shield icon doesn't always come up, but there are sometimes 2 wuauclt.exe processes running in the Task Manager. Not long after Windows has started up, SpySweeper tells me it has blocked access to webpdp.gator.com

My WindowsUpdate log shows suspicious download activity, one from a "cached cookie" and some copying, renaming, and moving of muweb.dll. I can provide a copy of that log, if necessary.

I've spent 3 days trying to remove these myself via online guides/suggestions, but I haven't seen much of anything on Win32.Qoologic.V as of yet.

P.S. Should there be prefetch files for wuauclt.exe? I have 2.

Edited by ssurf, 14 August 2006 - 12:35 PM.