win32.qoologic.bj

I am trying to clean up my neighbors Win 2000, sp4 computer. Ran through Norton Antivirus, Microsoft Antispyware, Lavasoft Ad-aware, and spybot and cleaned up most of it. Left with one I cannot get rid of. Kaspersky online scan:
-------------------------------------------------------------------------------
KASPERSKY ON-LINE SCANNER REPORT
Sunday, April 09, 2006 1:00:33 PM
Operating System: Microsoft Windows 2000 Professional, Service Pack 4 (Build 2195)
Kaspersky On-line Scanner version: 5.0.78.0
Kaspersky Anti-Virus database last update: 9/04/2006
Kaspersky Anti-Virus database records: 175796
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: standard
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\

Scan Statistics:
Total number of scanned objects: 11788
Number of viruses found: 1
Number of infected objects: 6
Number of suspicious objects: 0
Duration of the scan process: 00:39:50

Infected Object Name / Virus Name / Last Action

C:\WINNT\system32\ytvja.dat Infected: Trojan-Downloader.Win32.Qoologic.bj skipped

Scan process completed.
--------------------
tried booting to safe mode an deleting the file. I thought I had, but after I rebooted - from the way the computer acted after it rebooted I knew I still had problems.
from the Qoologic/Winsync/Kavsvc special removal procedures on this forum I was told to download and run FindQool, RKFiles Tool, and WinPFind. Then to run FindQool and RKFiles tool, and post the results on this forum.
--------------- FindQool report.txt --------------------
Sun 04/09/2006
Running from: C:\FindQool
PLEASE NOTE: LEGIT FILES MIGHT BE LISTED. IF YOU ARE UNSURE OF WHAT IS LISTED LEAVE THEM ALONE.

Known file names

MD5 Check....
C:\WINNT\system32\ytvja.dat
C:\WINNT\system32\tvhfnf.exe
C:\WINNT\system32\kfxjn.exe
C:\WINNT\system32\adggfnw.dll
C:\WINNT\system32\ubfnxkl.exe

Files found with locate com.
C:\WINNT\SYSTEM32\UBFNXKL.EXE
C:\WINNT\SYSTEM32\ADGGFNW.DLL
C:\WINNT\SYSTEM32\YTVJA.DAT
C:\WINNT\SYSTEM32\TVHFNF.EXE
C:\WINNT\SYSTEM32\KFXJN.EXE
C:\DOCUME~1\ALLUSE~1\STARTM~1\PROGRAMS\STARTUP\MDSGU.EXE
Re-check using dir /a:-d
C:\Documents and Settings\All Users\Start Menu\Programs\Startup
...

HKEY_LOCAL_MACHINE\software\qstat
HKEY_LOCAL_MACHINE\software\classes\folder\shellex\columnhandlers\{ce3a44d8-bc88-4d62-a890-42d96245f8d6}

...
Runs, Listed here as a Doublecheck for the locate com results
HKLM
"snlwnd"="C:\\WINNT\\system32\\tvhfnf.exe reg_run"
HKCU
"pkryo"="C:\\WINNT\\system32\\tvhfnf.exe reg_run"
...

Files In Winlogon shell and userinit
Listed here as a Doublecheck for the locate com results
shell REG_SZ Explorer.exe, C:\WINNT\system32\kfxjn.exe
userinit REG_SZ C:\WINNT\SYSTEM32\Userinit.exe,ubfnxkl.exe
...
SWReg utility
Written by Bobbi Flekman © 2005
Findqool edited 4/05/2006
-----------------------------
tried deleting the files listed, dir and del cannot find the files, but attrib can - shows everyone of them exists, with an 'A' flag only, no S, H, or R.
-----------------------------
--------------- RKFiles tool log.txt -------------------------
C:\rkfiles

PLEASE NOTE THAT ALL FILES FOUND BY THIS METHOD ARE NOT BAD FILES, THERE MIGHT BE LEGIT FILES LISTED AND PLEASE BE CAREFUL WHILE FIXING. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.
Files Found in system Folder............
------------------------

Files Found in all users startup Folder............
------------------------
Files Found in all users windows Folder............
------------------------
C:\WINNT\icont.exe: UPX!
Finished
bye
-----------------------------------------
How DO I get this silly thing out?

Bigshybear

 

Here's the HijackThis log.

Edit by chaslang: Inline HJT log from safe mode removed