You're doing just fine. Qoologic basically had nothing to report, which is a good thing. Now, stay on the path here and you'll get cleaned up.
===========
Please print out or copy this page to Notepad. Make sure to work through the fixes in the exact order it is mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes. You should
not have any open browsers when you are following the procedures below.
Download KillBox (
http://www.greyknight17.com/spy/KillBox.exe). Don't run it yet.
Go to
My Computer->Tools/View->Folder Options->View tab and uncheck 'Hide protected operating system files'.
Reboot into Safe Mode (hit F8 key until menu shows up). Make sure to close any open browsers. Go into HijackThis->Config->Misc. Tools->Open process manager. Select the following and click
Kill process for each one if they are still listed (they shouldn't be - but double check it):
C:\WINNT\system32\yrrvwk.exe
Using Notepad, open this file for editing:
C:\WINNT\Wininit.ini
Delete all of the lines in the file. Save it and close Notepad.
Go to Start->Run and type in regedit and hit OK. Go to File->Export and save the registry somewhere as a backup. While in the Registry Editor, navigate to:
A) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\
and delete each of the following keys:
appuq.exe =
3.tmp =
Web Service =
3.tmp.exe =
wF8h3mR =
kalvsys =
Dvx =
ffis =
kbmfudvu =
secure =
SpySpotter =
C:\WINNT\zfvgm.exe =
saie =
{12EE7A5E-0674-42f9-A76B-000000004D00} =
A70F6A1D-0195-42a2-934C-D8AC0F7C08EB =
98D0CE0C16B1 =
B) HKEY_LOCAL_MACHINE\Software\Microsoft\Active Setup\Installed Components\
and delete each of the folowing keys:
[1ef5b2c3-29ea-4037-9222-dc7669d0059f]
[{08B0E5C0-4FCB-11CF-AAA5-00401C608500}]
C) HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\
and delete the
"gshjqlv.exe" key.
Close the Registry Editor now.
Run KillBox and check the box that says 'End Explorer Shell While Killing File'. Next click on 'Delete on Reboot'. For each of the following files below, check the box that says 'Unregister .dll Before Deleting' if it's not grayed out. Copy and paste each of the following into KillBox (hitting the X button for each file - choose NO when it asks if you want to reboot):
C:\WINNT\zfvgm.exe
C:\WINNT\system\gshjqlv.exe
C:\WINNT\SYSTEM32\dn2q01~1.dll
C:\WINNT\SYSTEM32\gppql3~1.dll
C:\WINNT\SYSTEM32\h80qli~1.dll
C:\WINNT\SYSTEM32\hr6m05~1.dll
C:\WINNT\SYSTEM32\i006la~1.dll
C:\WINNT\SYSTEM32\j02q0a~1.dll
C:\WINNT\SYSTEM32\j8j60i~1.dll
C:\WINNT\SYSTEM32\l42sle~1.dll
C:\WINNT\SYSTEM32\lv0409~1.dll
C:\WINNT\SYSTEM32\mkhtml.dll
C:\WINNT\SYSTEM32\mv02l9~1.dll
C:\WINNT\SYSTEM32\mvp6l9~1.dll
C:\WINNT\SYSTEM32\mvr4l9~1.dll
C:\WINNT\system32\pwwlhq.exe
C:\WINNT\SYSTEM32\rfocurs.dll
C:\WINNT\system32\soft.exe
c:\winnt\system32\yrrvwk.exe
If you have Windows XP, go to C:\Windows\Prefetch and delete everything inside that Prefetch folder.
Run the CleanUp program now and choose Yes when it asks if you want to log off.
Restart and run these programs/scripts again - HijackThis (both the scan log and the StartupList), Silent Runners, Find-qoologic, DllCompare and Find-It. Post those new logs here.