Cant find the spyware

Question

taylorjt4 0 Junior Poster in Training

18 Years Ago

Hey everyone, this forum helped alot before so unfortunantely i am back again with more pop ups. Here is my hijack this log:

Logfile of HijackThis v1.99.1
Scan saved at 11:51:29 AM, on 6/28/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\unlazl.exe
C:\Program Files\America Online 9.0d\waol.exe
C:\Program Files\America Online 9.0d\shellmon.exe
C:\Documents and Settings\Owner\My Documents\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://channels.aimtoday.com/search/aimtoolbar.jsp
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/ie/defaults/sp/ymsgr6/*http://www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/ie/defaults/sb/ymsgr6/*http://www.yahoo.com/ext/search/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ie/defaults/su/ymsgr6/*http://www.yahoo.com
R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O2 - BHO: (no name) - {27EC7A73-1DAE-2286-3EC4-DE9CB9B786A9} - (no file)
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O2 - BHO: (no name) - {89FA1EB2-08ED-7251-FB49-5488A62EF444} - (no file)
O2 - BHO: (no name) - {E344A1E5-30C3-CC52-D301-FC6F53F6E17C} - (no file)
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [KavSvc] C:\WINDOWS\system32\unlazl.exe reg_run
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [AOL Fast Start] "C:\Program Files\America Online 9.0d\AOL.EXE" -b
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: &AOL Toolbar Search - res://c:\program files\aol\aol toolbar 2.0\aoltbhtml.dll/search.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O12 - Plugin for .tga: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin6.dll
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache/funwebproducts/ei-2/CursorManiaFWBInitialSetup1.0.0.8-2.cab
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com/computercheckup/qdiagcc.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.av.aol.com/molbin/shared/mcinsctl/en-us/4,0,0,83/mcinsctl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1102309385562
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.av.aol.com/molbin/shared/mcgdmgr/en-us/1,0,0,20/mcgdmgr.cab
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\\aolserv.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - Networks Associates Technology, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

thanks for your help in advance.
John

windows-virus

2 Contributors
14 Replies
364 Views
1 Week Discussion Span
Latest Post 18 Years Ago Latest Post by DMR

All 14 Replies

DMR 152 Wombat At Large

18 Years Ago

You are infected with a variant of the Qoologic trojan downloader. Please do the following:

Download the FindQoologic-Narrator.zip and save it to your Desktop.
http://forums.net-integration.net/index.php?act=Attach&type=post&id=134981

1. Extract (unzip) the files inside into their own folder called FindQoologic.
2. Open the FindQoologic folder.
3. Locate and double-click the Activesetup.vbs file to run it.
Please wait until a "Finished" message appears.

* When the set-up is complete a file named "Activesetup components[Machine ID][date].txt" will have been saved in the FindQoologic folder.

4. Locate and double-click the Find-Qoologic.bat to run it.

* The tool will open a DOS window and begin to check your system.
When it is finished a text file will open in Notepad called "file.txt".
* Save this text file in the FindQoologic folder.

5. Open the "Activesetup components[Machine ID][date].txt" file and the file you saved and copy / paste their contents to this thread (as a reply).

DMR 152 Wombat At Large

18 Years Ago

Hi John,

Please try to be patient. This particular forum is very busy, and we're more than a bit short-handed in terms of troubleshooters. Also, those of us who do help out do so on a purely volunteer basis, and real life responsibilites such as jobs, family, or school sometimes don't leave us with much free time to dedicate to our efforts here.

You will need to disconnect from the Internet for most of the following procedures, so you should print out these instructions or save them into a text file using Notepad.

1. Download the Killbox utility and save it to your desktop, but don't run it yet.

2. Run HijackThis again and have it fix:

O2 - BHO: (no name) - {27EC7A73-1DAE-2286-3EC4-DE9CB9B786A9} - (no file)
O2 - BHO: (no name) - {89FA1EB2-08ED-7251-FB49-5488A62EF444} - (no file)
O2 - BHO: (no name) - {E344A1E5-30C3-CC52-D301-FC6F53F6E17C} - (no file)
O4 - HKLM\..\Run: [KavSvc] C:\WINDOWS\system32\unlazl.exe reg_run

3. Reboot into safe mode (you get to the safe mode boot option by hitting the F8 key as your computer is starting up)

- Open Windows Explorer, and in the Folder Options->View settings under the Tools menu, select "show hidden files and folders", and uncheck "Hide protected operating system files" and "Hide extentions for known file types".

- Run the Killbox. In the "Full Path of File to Delete" box, copy and paste each of the following lines one at a time, select the "Standard File Kill" option, and then click on the button with the red circle with the X in the middle after you enter each file.
It will ask for confirmation to delete the file. Click Yes. Continue with that same procedure until you have copied and pasted all of these in the "Paste Full Path of File to Delete" box:

C:\WINDOWS\System32\UNLAZL.EXE
C:\WINDOWS\System32\DOXQAXO.EXE
C:\WINDOWS\System32\2SCENI~1.EXE
C:\WINDOWS\System32\3SCENI~1.EXE
C:\WINDOWS\System32\JEBACTBC.EXE
C:\WINDOWS\SSK_B5.EXE

- Repeat the above procedure for these files as well, with the following modification: in addition to selecting the "Standard File Kill" option, also select "Unregister dll Before Deleting" before clicking the red X (delete) button:

C:\WINDOWS\System32\LPIZUI.DLL
C:\WINDOWS\System32\ODSQM.DLL
C:\WINDOWS\System32\OGNBXNG.DLL
C:\WINDOWS\System32\SUPDATE.DLL

If you are unable to delete a file, just note its name and continue with the rest of deletions.

4. Reboot normally.
- run HJT and FindQoologic-Narrator again and post the new log from each.

DMR 152 Wombat At Large

18 Years Ago

Didn't forget; just the holiday weekend and all that.

The particular Qoologic variant that you have seems to be one of the newer and nastier versions; very difficult to remove.

Please do the following:

1. Download the trial version of Ewido Security Suite from here:
http://www.ewido.net/en/download/

Install it, and while installing, under Additional Options, uncheck Install background guard and Install scan via context menu.

From the main Ewido screen, click on Update in the left menu, and then click the Start update button. After the update finishes (the status bar at the bottom will display Update successful), close the program (don't scan yet). If you have problems updating see here:
http://www.ewido.net/en/download/updates/

Note -- When you do run Ewido for the first time, you will get a warning Database could not be found!, click OK when you do; the message is non-critical.

2. Reboot into Safe Mode and run a full scan with ewido. Save the log it generates; you'll need to post it in your next response here.

3. Run HJT and have it fix:

O2 - BHO: (no name) - {27EC7A73-1DAE-2286-3EC4-DE9CB9B786A9} - (no file)
O2 - BHO: (no name) - {89FA1EB2-08ED-7251-FB49-5488A62EF444} - (no file)
O2 - BHO: (no name) - {E344A1E5-30C3-CC52-D301-FC6F53F6E17C} - (no file)
O4 - HKLM\..\Run: [KavSvc] C:\WINDOWS\system32\unlazl.exe reg_run

4. While still in Safe Mode, Run the Killbox.

- In the "Full Path of File to Delete" box, copy and paste each of the following lines one at a time, select the "Replace on reboot" and "Use Dummy options.

- Click on the button with the red circle with the X in the middle after you enter each file.

- Click Yes at the Replace on Reboot confirmation prompt.

- Click No at the request to reboot.

C:\WINDOWS\System32\UNLAZL.EXE
C:\WINDOWS\System32\DOXQAXO.EXE
C:\WINDOWS\System32\REDIT.CPL

- Repeat the above procedure for these files as well, with the following modification: in addition to selecting the "Replace on reboot" option, also select "Unregister dll Before Deleting" before clicking the red X (delete) button:

C:\WINDOWS\System32\ODSQM.DLL
C:\WINDOWS\System32\OGNBXNG.DLL

- This time, after you enter the second dll, click Yes at the request to reboot. Let the system reboot normally.

5. Post the ewido scan log, as well as a new log from HJT.

DMR 152 Wombat At Large

18 Years Ago

Yes- I still see a couple of infections in your log, but they're pieces of a new variant which is proving very difficult to kill. I'll need to ask around and see if someone has developed a reliable fix for these. Please bear with me; I'll post that information as soon as I can find it.

Reply to this topic

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.

taylorjt4 0 Junior Poster in Training · Answer 1 · 2005-06-29T14:02:59+00:00

Here is the file:
PLEASE NOTE THAT ALL FILES FOUND BY THIS METHOD ARE NOT BAD FILES, There WILL be LEGIT FILES LISTED PLEASE BE CAREFUL WHILE FIXING. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.
some examples are MRT.EXE NTDLL.DLL.
»»»»»»»»»»»»»»»»»»»»»»»» Files found »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

* qoologic C:\WINDOWS\System32\LPIZUI.DLL
* KavSvc C:\WINDOWS\System32\UNLAZL.EXE
* KavSvc C:\WINDOWS\System32\ODSQM.DLL
* KavSvc C:\WINDOWS\System32\OGNBXNG.DLL
* KavSvc C:\WINDOWS\System32\SUPDATE.DLL
* aspack C:\WINDOWS\System32\DOXQAXO.EXE
* aspack C:\WINDOWS\System32\MRT.EXE
* aspack C:\WINDOWS\System32\NTDLL.DLL
* aspack C:\WINDOWS\System32\REDIT.CPL
* UPX! C:\WINDOWS\System32\2SCENI~1.EXE
* UPX! C:\WINDOWS\System32\3SCENI~1.EXE
* UPX! C:\WINDOWS\System32\JEBACTBC.EXE
* UPX! C:\WINDOWS\System32\UNLAZL.EXE
* UPX! C:\WINDOWS\System32\OGNBXNG.DLL
* UPX! C:\WINDOWS\System32\SUPDATE.DLL
* aspack C:\WINDOWS\FLASHAX.EXE
* UPX! C:\WINDOWS\SSK_B5.EXE
»»»»»»»»»»»»»»»»»»»»»»»» startup files»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

* exe C:\docume~1\alluse~1\startm~1\programs\startup\STRINGS.EXE

»»»»»»»»»»»»»»»»»»»»»»»» Checking Global Startup »»»»»»»»»»»»»»»»»»»»»»

(fstarts by IMM - test ver. 0.001) NOT using address check -- 0x7c90df5e

Global Startup:
C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup
.
..
desktop.ini
rtuc.exe

User Startup:
C:\Documents and Settings\Owner\Start Menu\Programs\Startup
.
..
desktop.ini

»»»»»»»»»»»»»»»»»»»»»»»» Registry Entries Found »»»»»»»»»»»»»»»»»»»»»»»

! REG.EXE VERSION 3.0

HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers
<NO NAME> REG_SZ

HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\mqskys
<NO NAME> REG_SZ {09532973-723e-4616-abfc-8b7b371f69bf}

HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\mqskysqg
<NO NAME> REG_SZ {558a08ec-7319-4423-be0b-4ec9bf1687c3}

HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Offline Files
<NO NAME> REG_SZ {750fdf0e-2a26-11d1-a3ea-080036587f03}

HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Open With
<NO NAME> REG_SZ {09799AFB-AD67-11d1-ABCD-00C04FC30936}

HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Open With EncryptionMenu
<NO NAME> REG_SZ {A470F8CF-A1E8-4f65-8335-227475AA5C46}

HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\WinRAR
<NO NAME> REG_SZ {B41DB860-8EE4-11D2-9906-E49FADC173CA}

HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\WinZip
<NO NAME> REG_SZ {E0D79304-84BE-11CE-9641-444553540000}

HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Yahoo! Mail
<NO NAME> REG_SZ {5464D816-CF16-4784-B9F3-75C0DB52B499}

HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\{a2a9545d-a0c2-42b4-9708-a0b2badd77c8}
<NO NAME> REG_SZ Start Menu Pin

HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\{CFC7205E-2792-4378-9591-3879CC6C9022}

thanks
John

taylorjt4 0 Junior Poster in Training · Answer 2 · 2005-06-30T21:33:54+00:00

taylorjt4 0 Junior Poster in Training

18 Years Ago

hello, anyone out there?

taylorjt4 0 Junior Poster in Training · Answer 3 · 2005-07-01T07:33:23+00:00

Okay here are the files:

PLEASE NOTE THAT ALL FILES FOUND BY THIS METHOD ARE NOT BAD FILES, There WILL be LEGIT FILES LISTED PLEASE BE CAREFUL WHILE FIXING. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.
some examples are MRT.EXE NTDLL.DLL.
»»»»»»»»»»»»»»»»»»»»»»»» Files found »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

* KavSvc C:\WINDOWS\System32\UNLAZL.EXE
* KavSvc C:\WINDOWS\System32\ODSQM.DLL
* KavSvc C:\WINDOWS\System32\OGNBXNG.DLL
* aspack C:\WINDOWS\System32\DOXQAXO.EXE
* aspack C:\WINDOWS\System32\MRT.EXE
* aspack C:\WINDOWS\System32\NTDLL.DLL
* aspack C:\WINDOWS\System32\REDIT.CPL
* UPX! C:\WINDOWS\System32\UNLAZL.EXE
* UPX! C:\WINDOWS\System32\OGNBXNG.DLL
* aspack C:\WINDOWS\FLASHAX.EXE
»»»»»»»»»»»»»»»»»»»»»»»» startup files»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»