Hijack This Log

Discussion in 'adware, spyware & hijack cleaning' started by brentrobinson_3, May 2, 2004.

Thread Status:
Not open for further replies.
  1. brentrobinson_3

    brentrobinson_3 Registered Member

    Joined:
    May 2, 2004
    Posts:
    5
    When I startup Windows 98, I'm bombarded with a series of "missing shortcut" boxes, saying that the shortcut that points to various .EXE files is missing. It goes through maybe 15-20 boxes, before normal activities can resume. I presume it's spyware-related and I've heard there is a way to disable it from coming up. I've already ran Spybot search and destroy but that didn't work. I also get bombarded with pop-up ads. Any help would be greatly appreciated

    Thanks

    Logfile of HijackThis v1.97.7
    Scan saved at 11:01:33 AM, on 5/2/04
    Platform: Windows 98 SE (Win9x 4.10.2222A)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\SYSTEM\KERNEL32.DLL
    C:\WINDOWS\SYSTEM\MSGSRV32.EXE
    C:\WINDOWS\SYSTEM\MPREXE.EXE
    C:\WINDOWS\SYSTEM\mmtask.tsk
    C:\WINDOWS\SYSTEM\MSTASK.EXE
    C:\PROGRAM FILES\GRISOFT\AVG6\AVGSERV9.EXE
    C:\WINDOWS\TASKMON.EXE
    C:\WINDOWS\SYSTEM\SYSTRAY.EXE
    C:\WINDOWS\STARTER.EXE
    C:\PROGRAM FILES\VOYETRA\AUDIOSTATION2\VTRAY.EXE
    C:\PROGRAM FILES\NORTON ANTIVIRUS\NAVAPW32.EXE
    C:\PROGRAM FILES\COMMON FILES\ADAPTEC SHARED\CREATECD\CREATECD50.EXE
    C:\PROGRAM FILES\ADAPTEC\EASY CD CREATOR 5\DIRECTCD\DIRECTCD.EXE
    C:\WINDOWS\SYSTEM\P2P NETWORKING\P2P NETWORKING.EXE
    C:\PROGRAM FILES\GRISOFT\AVG6\AVGCC32.EXE
    C:\WINDOWS\SYSTEM\WMIEXE.EXE
    C:\PROGRAM FILES\AIM\AIM.EXE
    C:\WINDOWS\SYSTEM\RNAAPP.EXE
    C:\WINDOWS\EXPLORER.EXE
    C:\WINDOWS\SYSTEM\TAPISRV.EXE
    C:\WINDOWS\HH3PWB4P.EXE
    C:\WINDOWS\SYSTEM\DDHELP.EXE
    C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
    C:\MY DOCUMENTS\HIJACK\HIJACKTHIS.EXE

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
    O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
    O2 - BHO: (no name) - {000020DD-C72E-4113-AF77-DD56626C6C42} - C:\WINDOWS\TWAINTEC.DLL
    O2 - BHO: (no name) - {B549456D-F5D0-4641-BCED-8648A0C13D83} - C:\WINDOWS\BrowserHelper.dll
    O2 - BHO: IE Agent - {00000000-0000-0000-0000-000000000221} - C:\PROGRAM FILES\LYCOS\IEAGENT\CSIE.DLL
    O2 - BHO: (no name) - {0019C3E2-DD48-4A6D-ABCD-8D32436323D9} - C:\WINDOWS\BXXS5.DLL
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
    O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
    O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
    O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
    O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
    O4 - HKLM\..\Run: [EnsoniqMixer] starter.exe
    O4 - HKLM\..\Run: [VoyetraTray] C:\PROGRAM FILES\VOYETRA\AUDIOSTATION2\VTRAY.EXE /s
    O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\NAVAPW32.EXE
    O4 - HKLM\..\Run: [CreateCD50] "C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe" -r
    O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
    O4 - HKLM\..\Run: [P2P NETWORKING] C:\WINDOWS\SYSTEM\P2P NETWORKING\P2P NETWORKING.EXE /AUTOSTART
    O4 - HKLM\..\Run: [bxxs5] RunDLL32.EXE C:\WINDOWS\BXXS5.DLL,DllRun
    O4 - HKLM\..\Run: [SOUNDD] C:\WINDOWS\SYSTEM\SOUNDD.exe
    O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\GRISOFT\AVG6\avgcc32.exe /STARTUP
    O4 - HKLM\..\Run: [HH3PWB4P.EXE] C:\WINDOWS\HH3PWB4P.EXE /dk
    O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
    O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
    O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
    O4 - HKLM\..\RunServices: [Avgserv9.exe] C:\PROGRA~1\GRISOFT\AVG6\Avgserv9.exe
    O4 - HKCU\..\Run: [AIM] C:\PROGRAM FILES\AIM\aim.exe -cnetwait.odl
    O4 - HKCU\..\Run: [HH3PWB4P.EXE] C:\WINDOWS\HH3PWB4P.EXE /dk
    O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O4 - Startup: MORZE5.lnk = C:\WINDOWS\morze5.exe
    O4 - Startup: T0DECCEU.lnk = C:\WINDOWS\t0decceu.exe
    O4 - Startup: W61Z94M0.lnk = C:\WINDOWS\w61z94m0.exe
    O4 - Startup: Z4HT6RRR.lnk = C:\WINDOWS\z4ht6rrr.exe
    O4 - Startup: L08QAWP9.lnk = C:\WINDOWS\l08qawp9.exe
    O4 - Startup: Q0BGH0LR.lnk = C:\WINDOWS\q0bgh0lr.exe
    O4 - Startup: MORZE1.lnk = C:\WINDOWS\morze1.exe
    O4 - Startup: 6PNPK7OX.lnk = C:\WINDOWS\6pnpk7ox.exe
    O4 - Startup: 77TM5WCD.lnk = C:\WINDOWS\77tm5wcd.exe
    O4 - Startup: DQV9DGZR.lnk = C:\WINDOWS\dqv9dgzr.exe
    O4 - Startup: 09N76IL3.lnk = C:\WINDOWS\09n76il3.exe
    O4 - Startup: RC5IQVZP.lnk = C:\WINDOWS\rc5iqvzp.exe
    O4 - Startup: 9CQBKXZ0.lnk = C:\WINDOWS\9cqbkxz0.exe
    O4 - Startup: RBUIM9E0.lnk = C:\WINDOWS\rbuim9e0.exe
    O4 - Startup: EV0EFBLA.lnk = C:\WINDOWS\ev0efbla.exe
    O4 - Startup: XRPQDZGL.lnk = C:\WINDOWS\xrpqdzgl.exe
    O4 - Startup: 0J5ICENJ.lnk = C:\WINDOWS\0j5icenj.exe
    O4 - Startup: QU94OW9K.lnk = C:\WINDOWS\qu94ow9k.exe
    O4 - Startup: F6C10627.lnk = C:\WINDOWS\f6c10627.exe
    O4 - Startup: VQ0VIX2B.lnk = ?
    O4 - Startup: 06ME15M3.lnk = C:\WINDOWS\06me15m3.exe
    O4 - Startup: F55B4OQT.lnk = C:\WINDOWS\f55b4oqt.exe
    O4 - Startup: A5QJ1B9P.lnk = C:\WINDOWS\a5qj1b9p.exe
    O4 - Startup: X8IWJA8D.lnk = C:\WINDOWS\x8iwja8d.exe
    O4 - Startup: D060ABHI.lnk = C:\WINDOWS\d060abhi.exe
    O4 - Startup: GJOUI5OC.lnk = C:\WINDOWS\gjoui5oc.exe
    O4 - Startup: GVVZZPNU.lnk = C:\WINDOWS\gvvzzpnu.exe
    O4 - Startup: 096GP2QF.lnk = C:\WINDOWS\096gp2qf.exe
    O4 - Startup: EH2P6M9G.lnk = C:\WINDOWS\eh2p6m9g.exe
    O4 - Startup: ZNBF8JLG.lnk = C:\WINDOWS\znbf8jlg.exe
    O4 - Startup: 25PIQUTG.lnk = C:\WINDOWS\25piqutg.exe
    O4 - Startup: F35481QW.lnk = C:\WINDOWS\f35481qw.exe
    O4 - Startup: KC5NL0RV.lnk = C:\WINDOWS\kc5nl0rv.exe
    O4 - Startup: JT020KHU.lnk = C:\WINDOWS\jt020khu.exe
    O4 - Startup: JPKT6YB9.lnk = C:\WINDOWS\jpkt6yb9.exe
    O4 - Startup: 9X0ZVF0F.lnk = C:\WINDOWS\9x0zvf0f.exe
    O4 - Startup: YGVDX9XX.lnk = C:\WINDOWS\ygvdx9xx.exe
    O4 - Startup: WXA2TDY4.lnk = C:\WINDOWS\wxa2tdy4.exe
    O4 - Startup: 27FW36AM.lnk = C:\WINDOWS\27fw36am.exe
    O4 - Startup: R36GL3XE.lnk = C:\WINDOWS\r36gl3xe.exe
    O4 - Startup: OM1OBNF5.lnk = C:\WINDOWS\om1obnf5.exe
    O4 - Startup: D08ZIIAO.lnk = C:\WINDOWS\d08ziiao.exe
    O4 - Startup: DB20GY2G.lnk = C:\WINDOWS\db20gy2g.exe
    O4 - Startup: 03RL99YE.lnk = C:\WINDOWS\03rl99ye.exe
    O4 - Startup: 0TAC2986.lnk = C:\WINDOWS\0tac2986.exe
    O4 - Startup: TG001RA3.lnk = C:\WINDOWS\tg001ra3.exe
    O4 - Startup: BORQ0UAX.lnk = C:\WINDOWS\borq0uax.exe
    O4 - Startup: C6QUTCDM.lnk = C:\WINDOWS\c6qutcdm.exe
    O4 - Startup: G1QWZBQB.lnk = C:\WINDOWS\g1qwzbqb.exe
    O4 - Startup: W9XK79FZ.lnk = C:\WINDOWS\w9xk79fz.exe
    O4 - Startup: 2VHR40VE.lnk = C:\WINDOWS\2vhr40ve.exe
    O4 - Startup: 18UG8N0A.lnk = C:\WINDOWS\18ug8n0a.exe
    O4 - Startup: Y2ABV0IQ.lnk = C:\WINDOWS\y2abv0iq.exe
    O4 - Startup: MQTLK5KG.lnk = C:\WINDOWS\mqtlk5kg.exe
    O4 - Startup: ZC5FHW7Y.lnk = C:\WINDOWS\zc5fhw7y.exe
    O4 - Startup: M99T4KOG.lnk = C:\WINDOWS\m99t4kog.exe
    O4 - Startup: HV2FKIKI.lnk = C:\WINDOWS\hv2fkiki.exe
    O4 - Startup: GWLF7P0W.lnk = C:\WINDOWS\gwlf7p0w.exe
    O4 - Startup: 5H20Z3YV.lnk = C:\WINDOWS\5h20z3yv.exe
    O4 - Startup: FRDHZHM0.lnk = C:\WINDOWS\frdhzhm0.exe
    O4 - Startup: O845RNAI.lnk = C:\WINDOWS\o845rnai.exe
    O4 - Startup: 84068HUN.lnk = C:\WINDOWS\84068hun.exe
    O4 - Startup: T7V99MLP.lnk = C:\WINDOWS\t7v99mlp.exe
    O4 - Startup: 5T0X58WH.lnk = C:\WINDOWS\5t0x58wh.exe
    O4 - Startup: XNCHBZFF.lnk = C:\WINDOWS\xnchbzff.exe
    O4 - Startup: 6ACPEPUW.lnk = C:\WINDOWS\6acpepuw.exe
    O4 - Startup: YQQRX0UB.lnk = C:\WINDOWS\yqqrx0ub.exe
    O4 - Startup: MYHKHDPM.lnk = C:\WINDOWS\myhkhdpm.exe
    O4 - Startup: 548V0M1Y.lnk = C:\WINDOWS\548v0m1y.exe
    O4 - Startup: 0J4J3WRG.lnk = C:\WINDOWS\0j4j3wrg.exe
    O4 - Startup: ZCPK08XW.lnk = C:\WINDOWS\zcpk08xw.exe
    O4 - Startup: B00YX69G.lnk = C:\WINDOWS\b00yx69g.exe
    O4 - Startup: OCM9A1HN.lnk = C:\WINDOWS\ocm9a1hn.exe
    O4 - Startup: U77POL74.lnk = C:\WINDOWS\u77pol74.exe
    O4 - Startup: AVRDICOI.lnk = C:\WINDOWS\avrdicoi.exe
    O4 - Startup: U1OKLKL1.lnk = C:\WINDOWS\u1oklkl1.exe
    O4 - Startup: BG10U833.lnk = C:\WINDOWS\bg10u833.exe
    O4 - Startup: 0XMI57A8.lnk = C:\WINDOWS\0xmi57a8.exe
    O4 - Startup: 0Z0IPBCA.lnk = C:\WINDOWS\0z0ipbca.exe
    O4 - Startup: 6FTJV6LK.lnk = C:\WINDOWS\6ftjv6lk.exe
    O4 - Startup: LK4M1JXV.lnk = C:\WINDOWS\lk4m1jxv.exe
    O4 - Startup: FB30JNTJ.lnk = C:\WINDOWS\fb30jntj.exe
    O4 - Startup: 91K32I9U.lnk = C:\WINDOWS\91k32i9u.exe
    O4 - Startup: DWCTQD00.lnk = C:\WINDOWS\dwctqd00.exe
    O4 - Startup: FPDWU2VC.lnk = C:\WINDOWS\fpdwu2vc.exe
    O4 - Startup: PYVT3XCA.lnk = C:\WINDOWS\pyvt3xca.exe
    O4 - Startup: 28610XUY.lnk = C:\WINDOWS\28610xuy.exe
    O4 - Startup: QOJOWXUT.lnk = C:\WINDOWS\qojowxut.exe
    O4 - Startup: U8D04V4V.lnk = C:\WINDOWS\u8d04v4v.exe
    O4 - Startup: MI8IH1I7.lnk = C:\WINDOWS\mi8ih1i7.exe
    O4 - Startup: OAZ9J63W.lnk = C:\WINDOWS\oaz9j63w.exe
    O4 - Startup: 13NT4TGC.lnk = C:\WINDOWS\13nt4tgc.exe
    O4 - Startup: YF89L13V.lnk = C:\WINDOWS\yf89l13v.exe
    O4 - Startup: 008AXINQ.lnk = C:\WINDOWS\008axinq.exe
    O4 - Startup: GJE0JNH2.lnk = C:\WINDOWS\gje0jnh2.exe
    O4 - Startup: 1HD9P0KN.lnk = C:\WINDOWS\1hd9p0kn.exe
    O4 - Startup: CUZMPWH1.lnk = C:\WINDOWS\cuzmpwh1.exe
    O4 - Startup: 0BWCVKIH.lnk = C:\WINDOWS\0bwcvkih.exe
    O4 - Startup: OOFATBX4.lnk = C:\WINDOWS\oofatbx4.exe
    O4 - Startup: Q19T0VJR.lnk = C:\WINDOWS\q19t0vjr.exe
    O4 - Startup: NUR4D7TZ.lnk = C:\WINDOWS\nur4d7tz.exe
    O4 - Startup: E1K5K29Y.lnk = C:\WINDOWS\e1k5k29y.exe
    O4 - Startup: HRFRHBP4.lnk = C:\WINDOWS\hrfrhbp4.exe
    O4 - Startup: GWEWLHHO.lnk = C:\WINDOWS\gwewlhho.exe
    O4 - Startup: 8V5IG0BJ.lnk = C:\WINDOWS\8v5ig0bj.exe
    O4 - Startup: B3AX2ZVC.lnk = C:\WINDOWS\b3ax2zvc.exe
    O4 - Startup: O2OPDK83.lnk = C:\WINDOWS\o2opdk83.exe
    O4 - Startup: 1DWYK0VE.lnk = C:\WINDOWS\1dwyk0ve.exe
    O4 - Startup: FTOVT9VX.lnk = C:\WINDOWS\ftovt9vx.exe
    O4 - Startup: O0O4EODP.lnk = C:\WINDOWS\o0o4eodp.exe
    O4 - Startup: 3JOA06FI.lnk = C:\WINDOWS\3joa06fi.exe
    O4 - Startup: YWLDODAL.lnk = C:\WINDOWS\ywldodal.exe
    O4 - Startup: BRQHX0GY.lnk = C:\WINDOWS\brqhx0gy.exe
    O4 - Startup: W0O4HB6Z.lnk = C:\WINDOWS\w0o4hb6z.exe
    O4 - Startup: KXP9794P.lnk = C:\WINDOWS\kxp9794p.exe
    O4 - Startup: B042O0RC.lnk = C:\WINDOWS\b042o0rc.exe
    O4 - Startup: 0YJ9LWM2.lnk = C:\WINDOWS\0yj9lwm2.exe
    O4 - Startup: U0OTLYIN.lnk = C:\WINDOWS\u0otlyin.exe
    O4 - Startup: 0PW48W5O.lnk = C:\WINDOWS\0pw48w5o.exe
    O4 - Startup: VI9A7U1M.lnk = C:\WINDOWS\vi9a7u1m.exe
    O4 - Startup: C01I0FKA.lnk = C:\WINDOWS\c01i0fka.exe
    O4 - Startup: Y80WN0VK.lnk = C:\WINDOWS\y80wn0vk.exe
    O4 - Startup: 32YE8LEO.lnk = C:\WINDOWS\32ye8leo.exe
    O4 - Startup: GJY6GH07.lnk = C:\WINDOWS\gjy6gh07.exe
    O4 - Startup: ZTQVPHQU.lnk = C:\WINDOWS\ztqvphqu.exe
    O4 - Startup: HAE34ZF3.lnk = C:\WINDOWS\hae34zf3.exe
    O4 - Startup: TQX91KVG.lnk = C:\WINDOWS\tqx91kvg.exe
    O4 - Startup: P340LY0V.lnk = C:\WINDOWS\p340ly0v.exe
    O4 - Startup: B5PBB3Z7.lnk = C:\WINDOWS\b5pbb3z7.exe
    O4 - Startup: JI890BXP.lnk = C:\WINDOWS\ji890bxp.exe
    O4 - Startup: AAV590W5.lnk = C:\WINDOWS\aav590w5.exe
    O4 - Startup: DEHVH10N.lnk = C:\WINDOWS\dehvh10n.exe
    O4 - Startup: V5TWTH98.lnk = C:\WINDOWS\v5twth98.exe
    O4 - Startup: FF9T7YTW.lnk = C:\WINDOWS\ff9t7ytw.exe
    O4 - Startup: Z0J0ATW3.lnk = C:\WINDOWS\z0j0atw3.exe
    O4 - Startup: 5V4KG5BA.lnk = C:\WINDOWS\5v4kg5ba.exe
    O4 - Startup: P7CBQHHZ.lnk = C:\WINDOWS\p7cbqhhz.exe
    O4 - Startup: D2XQOYIQ.lnk = C:\WINDOWS\d2xqoyiq.exe
    O4 - Startup: 538Q7LGU.lnk = C:\WINDOWS\538q7lgu.exe
    O4 - Startup: I9KBM8OT.lnk = C:\WINDOWS\i9kbm8ot.exe
    O4 - Startup: 3G8ZB2YQ.lnk = C:\WINDOWS\3g8zb2yq.exe
    O4 - Startup: GO9Z7L8L.lnk = C:\WINDOWS\go9z7l8l.exe
    O4 - Startup: 36A51FDY.lnk = C:\WINDOWS\36a51fdy.exe
    O4 - Startup: 4ZYB4QU7.lnk = C:\WINDOWS\4zyb4qu7.exe
    O4 - Startup: LDC8ZXQO.lnk = C:\WINDOWS\ldc8zxqo.exe
    O4 - Startup: VNYYZIRG.lnk = C:\WINDOWS\vnyyzirg.exe
    O4 - Startup: 4HEY509Z.lnk = C:\WINDOWS\4hey509z.exe
    O4 - Startup: QA7KAV1U.lnk = C:\WINDOWS\qa7kav1u.exe
    O4 - Startup: TLOHGA38.lnk = C:\WINDOWS\tlohga38.exe
    O4 - Startup: 79Y0A9TX.lnk = C:\WINDOWS\79y0a9tx.exe
    O4 - Startup: G1X30I06.lnk = C:\WINDOWS\g1x30i06.exe
    O4 - Startup: JL0ACWZM.lnk = C:\WINDOWS\jl0acwzm.exe
    O4 - Startup: PDQIQG2K.lnk = C:\WINDOWS\pdqiqg2k.exe
    O4 - Startup: AQ39LURG.lnk = C:\WINDOWS\aq39lurg.exe
    O4 - Startup: RGKCB9B2.lnk = C:\WINDOWS\rgkcb9b2.exe
    O4 - Startup: R5UERUNU.lnk = C:\WINDOWS\r5uerunu.exe
    O4 - Startup: W0LRL8Y4.lnk = C:\WINDOWS\w0lrl8y4.exe
    O4 - Startup: VKV009QB.lnk = C:\WINDOWS\vkv009qb.exe
    O4 - Startup: B6QC3U8H.lnk = C:\WINDOWS\b6qc3u8h.exe
    O4 - Startup: U5OBG7DE.lnk = C:\WINDOWS\u5obg7de.exe
    O4 - Startup: VL3MM0PA.lnk = C:\WINDOWS\vl3mm0pa.exe
    O4 - Startup: 7T760J1N.lnk = C:\WINDOWS\7t760j1n.exe
    O4 - Startup: CT0LI2QU.lnk = C:\WINDOWS\ct0li2qu.exe
    O4 - Startup: HH3PWB4P.lnk = C:\WINDOWS\hh3pwb4p.exe
    O4 - Global Startup: MORZE5.lnk = C:\WINDOWS\tlohga38.exe
    O4 - Global Startup: T0DECCEU.lnk = C:\WINDOWS\r36gl3xe.exe
    O4 - Global Startup: W61Z94M0.lnk = C:\WINDOWS\w61z94m0.exe
    O4 - Global Startup: Z4HT6RRR.lnk = C:\WINDOWS\z4ht6rrr.exe
    O4 - Global Startup: L08QAWP9.lnk = C:\WINDOWS\l08qawp9.exe
    O4 - Global Startup: Q0BGH0LR.lnk = C:\WINDOWS\q0bgh0lr.exe
    O4 - Global Startup: MORZE1.lnk = C:\WINDOWS\morze1.exe
    O4 - Global Startup: 6PNPK7OX.lnk = C:\WINDOWS\6pnpk7ox.exe
    O4 - Global Startup: 77TM5WCD.lnk = C:\WINDOWS\77tm5wcd.exe
    O4 - Global Startup: DQV9DGZR.lnk = C:\WINDOWS\dqv9dgzr.exe
    O4 - Global Startup: 09N76IL3.lnk = C:\WINDOWS\09n76il3.exe
    O4 - Global Startup: RC5IQVZP.lnk = C:\WINDOWS\rc5iqvzp.exe
    O4 - Global Startup: 9CQBKXZ0.lnk = C:\WINDOWS\9cqbkxz0.exe
    O4 - Global Startup: RBUIM9E0.lnk = C:\WINDOWS\rbuim9e0.exe
    O4 - Global Startup: EV0EFBLA.lnk = C:\WINDOWS\ev0efbla.exe
    O4 - Global Startup: XRPQDZGL.lnk = C:\WINDOWS\xrpqdzgl.exe
    O4 - Global Startup: 0J5ICENJ.lnk = C:\WINDOWS\0j5icenj.exe
    O4 - Global Startup: QU94OW9K.lnk = C:\WINDOWS\qu94ow9k.exe
    O4 - Global Startup: F6C10627.lnk = C:\WINDOWS\f6c10627.exe
    O4 - Global Startup: VQ0VIX2B.lnk = C:\WINDOWS\vq0vix2b.exe
    O4 - Global Startup: 06ME15M3.lnk = C:\WINDOWS\06me15m3.exe
    O4 - Global Startup: F55B4OQT.lnk = C:\WINDOWS\f55b4oqt.exe
    O4 - Global Startup: A5QJ1B9P.lnk = C:\WINDOWS\a5qj1b9p.exe
    O4 - Global Startup: X8IWJA8D.lnk = C:\WINDOWS\x8iwja8d.exe
    O4 - Global Startup: D060ABHI.lnk = C:\WINDOWS\d060abhi.exe
    O4 - Global Startup: GJOUI5OC.lnk = C:\WINDOWS\gjoui5oc.exe
    O4 - Global Startup: GVVZZPNU.lnk = C:\WINDOWS\gvvzzpnu.exe
    O4 - Global Startup: 096GP2QF.lnk = C:\WINDOWS\096gp2qf.exe
    O4 - Global Startup: EH2P6M9G.lnk = C:\WINDOWS\eh2p6m9g.exe
    O4 - Global Startup: ZNBF8JLG.lnk = C:\WINDOWS\znbf8jlg.exe
    O4 - Global Startup: 25PIQUTG.lnk = C:\WINDOWS\25piqutg.exe
    O4 - Global Startup: F35481QW.lnk = C:\WINDOWS\f35481qw.exe
    O4 - Global Startup: KC5NL0RV.lnk = C:\WINDOWS\kc5nl0rv.exe
    O4 - Global Startup: JT020KHU.lnk = C:\WINDOWS\jt020khu.exe
    O4 - Global Startup: JPKT6YB9.lnk = C:\WINDOWS\jpkt6yb9.exe
    O4 - Global Startup: 9X0ZVF0F.lnk = C:\WINDOWS\9x0zvf0f.exe
    O4 - Global Startup: YGVDX9XX.lnk = C:\WINDOWS\ygvdx9xx.exe
    O4 - Global Startup: WXA2TDY4.lnk = C:\WINDOWS\wxa2tdy4.exe
    O4 - Global Startup: 27FW36AM.lnk = C:\WINDOWS\27fw36am.exe
    O4 - Global Startup: R36GL3XE.lnk = C:\WINDOWS\r36gl3xe.exe
    O4 - Global Startup: OM1OBNF5.lnk = C:\WINDOWS\om1obnf5.exe
    O4 - Global Startup: D08ZIIAO.lnk = C:\WINDOWS\d08ziiao.exe
    O4 - Global Startup: DB20GY2G.lnk = C:\WINDOWS\db20gy2g.exe
    O4 - Global Startup: 03RL99YE.lnk = C:\WINDOWS\03rl99ye.exe
    O4 - Global Startup: 0TAC2986.lnk = C:\WINDOWS\0tac2986.exe
    O4 - Global Startup: TG001RA3.lnk = C:\WINDOWS\tg001ra3.exe
    O4 - Global Startup: BORQ0UAX.lnk = C:\WINDOWS\borq0uax.exe
    O4 - Global Startup: C6QUTCDM.lnk = C:\WINDOWS\c6qutcdm.exe
    O4 - Global Startup: G1QWZBQB.lnk = C:\WINDOWS\g1qwzbqb.exe
    O4 - Global Startup: W9XK79FZ.lnk = C:\WINDOWS\w9xk79fz.exe
    O4 - Global Startup: 2VHR40VE.lnk = C:\WINDOWS\2vhr40ve.exe
    O4 - Global Startup: 18UG8N0A.lnk = C:\WINDOWS\18ug8n0a.exe
    O4 - Global Startup: Y2ABV0IQ.lnk = C:\WINDOWS\y2abv0iq.exe
    O4 - Global Startup: MQTLK5KG.lnk = C:\WINDOWS\mqtlk5kg.exe
    O4 - Global Startup: ZC5FHW7Y.lnk = C:\WINDOWS\zc5fhw7y.exe
    O4 - Global Startup: M99T4KOG.lnk = C:\WINDOWS\m99t4kog.exe
    O4 - Global Startup: HV2FKIKI.lnk = C:\WINDOWS\hv2fkiki.exe
    O4 - Global Startup: GWLF7P0W.lnk = C:\WINDOWS\gwlf7p0w.exe
    O4 - Global Startup: 5H20Z3YV.lnk = C:\WINDOWS\5h20z3yv.exe
    O4 - Global Startup: FRDHZHM0.lnk = C:\WINDOWS\frdhzhm0.exe
    O4 - Global Startup: O845RNAI.lnk = C:\WINDOWS\o845rnai.exe
    O4 - Global Startup: 84068HUN.lnk = C:\WINDOWS\84068hun.exe
    O4 - Global Startup: T7V99MLP.lnk = C:\WINDOWS\t7v99mlp.exe
    O4 - Global Startup: 5T0X58WH.lnk = C:\WINDOWS\5t0x58wh.exe
    O4 - Global Startup: XNCHBZFF.lnk = C:\WINDOWS\xnchbzff.exe
    O4 - Global Startup: 6ACPEPUW.lnk = C:\WINDOWS\6acpepuw.exe
    O4 - Global Startup: YQQRX0UB.lnk = C:\WINDOWS\yqqrx0ub.exe
    O4 - Global Startup: MYHKHDPM.lnk = C:\WINDOWS\myhkhdpm.exe
    O4 - Global Startup: 548V0M1Y.lnk = C:\WINDOWS\548v0m1y.exe
    O4 - Global Startup: 0J4J3WRG.lnk = C:\WINDOWS\0j4j3wrg.exe
    O4 - Global Startup: ZCPK08XW.lnk = C:\WINDOWS\zcpk08xw.exe
    O4 - Global Startup: B00YX69G.lnk = C:\WINDOWS\b00yx69g.exe
    O4 - Global Startup: OCM9A1HN.lnk = C:\WINDOWS\ocm9a1hn.exe
    O4 - Global Startup: U77POL74.lnk = C:\WINDOWS\u77pol74.exe
    O4 - Global Startup: AVRDICOI.lnk = C:\WINDOWS\avrdicoi.exe
    O4 - Global Startup: U1OKLKL1.lnk = C:\WINDOWS\u1oklkl1.exe
    O4 - Global Startup: BG10U833.lnk = C:\WINDOWS\bg10u833.exe
    O4 - Global Startup: 0XMI57A8.lnk = C:\WINDOWS\0xmi57a8.exe
    O4 - Global Startup: 0Z0IPBCA.lnk = C:\WINDOWS\0z0ipbca.exe
    O4 - Global Startup: 6FTJV6LK.lnk = C:\WINDOWS\6ftjv6lk.exe
    O4 - Global Startup: LK4M1JXV.lnk = C:\WINDOWS\lk4m1jxv.exe
    O4 - Global Startup: FB30JNTJ.lnk = C:\WINDOWS\fb30jntj.exe
    O4 - Global Startup: 91K32I9U.lnk = C:\WINDOWS\91k32i9u.exe
    O4 - Global Startup: DWCTQD00.lnk = C:\WINDOWS\dwctqd00.exe
    O4 - Global Startup: FPDWU2VC.lnk = C:\WINDOWS\fpdwu2vc.exe
    O4 - Global Startup: PYVT3XCA.lnk = C:\WINDOWS\pyvt3xca.exe
    O4 - Global Startup: 28610XUY.lnk = C:\WINDOWS\28610xuy.exe
    O4 - Global Startup: QOJOWXUT.lnk = C:\WINDOWS\qojowxut.exe
    O4 - Global Startup: U8D04V4V.lnk = C:\WINDOWS\u8d04v4v.exe
    O4 - Global Startup: MI8IH1I7.lnk = C:\WINDOWS\mi8ih1i7.exe
    O4 - Global Startup: OAZ9J63W.lnk = C:\WINDOWS\oaz9j63w.exe
    O4 - Global Startup: YF89L13V.lnk = C:\WINDOWS\yf89l13v.exe
    O4 - Global Startup: 13NT4TGC.lnk = C:\WINDOWS\13nt4tgc.exe
    O4 - Global Startup: 008AXINQ.lnk = C:\WINDOWS\008axinq.exe
    O4 - Global Startup: GJE0JNH2.lnk = C:\WINDOWS\gje0jnh2.exe
    O4 - Global Startup: 1HD9P0KN.lnk = C:\WINDOWS\1hd9p0kn.exe
    O4 - Global Startup: CUZMPWH1.lnk = C:\WINDOWS\cuzmpwh1.exe
    O4 - Global Startup: 0BWCVKIH.lnk = C:\WINDOWS\0bwcvkih.exe
    O4 - Global Startup: OOFATBX4.lnk = C:\WINDOWS\oofatbx4.exe
    O4 - Global Startup: Q19T0VJR.lnk = C:\WINDOWS\q19t0vjr.exe
    O4 - Global Startup: NUR4D7TZ.lnk = C:\WINDOWS\nur4d7tz.exe
    O4 - Global Startup: E1K5K29Y.lnk = C:\WINDOWS\e1k5k29y.exe
    O4 - Global Startup: HRFRHBP4.lnk = C:\WINDOWS\hrfrhbp4.exe
    O4 - Global Startup: GWEWLHHO.lnk = C:\WINDOWS\gwewlhho.exe
    O4 - Global Startup: 8V5IG0BJ.lnk = C:\WINDOWS\8v5ig0bj.exe
    O4 - Global Startup: B3AX2ZVC.lnk = C:\WINDOWS\b3ax2zvc.exe
    O4 - Global Startup: O2OPDK83.lnk = C:\WINDOWS\o2opdk83.exe
    O4 - Global Startup: 1DWYK0VE.lnk = C:\WINDOWS\1dwyk0ve.exe
    O4 - Global Startup: FTOVT9VX.lnk = C:\WINDOWS\ftovt9vx.exe
    O4 - Global Startup: O0O4EODP.lnk = C:\WINDOWS\o0o4eodp.exe
    O4 - Global Startup: 3JOA06FI.lnk = C:\WINDOWS\3joa06fi.exe
    O4 - Global Startup: YWLDODAL.lnk = C:\WINDOWS\ywldodal.exe
    O4 - Global Startup: BRQHX0GY.lnk = C:\WINDOWS\brqhx0gy.exe
    O4 - Global Startup: W0O4HB6Z.lnk = C:\WINDOWS\w0o4hb6z.exe
    O4 - Global Startup: KXP9794P.lnk = C:\WINDOWS\kxp9794p.exe
    O4 - Global Startup: B042O0RC.lnk = C:\WINDOWS\b042o0rc.exe
    O4 - Global Startup: 0YJ9LWM2.lnk = C:\WINDOWS\0yj9lwm2.exe
    O4 - Global Startup: U0OTLYIN.lnk = C:\WINDOWS\u0otlyin.exe
    O4 - Global Startup: 0PW48W5O.lnk = C:\WINDOWS\0pw48w5o.exe
    O4 - Global Startup: VI9A7U1M.lnk = C:\WINDOWS\vi9a7u1m.exe
    O4 - Global Startup: C01I0FKA.lnk = C:\WINDOWS\c01i0fka.exe
    O4 - Global Startup: Y80WN0VK.lnk = C:\WINDOWS\y80wn0vk.exe
    O4 - Global Startup: 32YE8LEO.lnk = C:\WINDOWS\32ye8leo.exe
    O4 - Global Startup: GJY6GH07.lnk = C:\WINDOWS\gjy6gh07.exe
    O4 - Global Startup: ZTQVPHQU.lnk = C:\WINDOWS\ztqvphqu.exe
    O4 - Global Startup: HAE34ZF3.lnk = C:\WINDOWS\hae34zf3.exe
    O4 - Global Startup: TQX91KVG.lnk = C:\WINDOWS\tqx91kvg.exe
    O4 - Global Startup: P340LY0V.lnk = C:\WINDOWS\p340ly0v.exe
    O4 - Global Startup: B5PBB3Z7.lnk = C:\WINDOWS\b5pbb3z7.exe
    O4 - Global Startup: JI890BXP.lnk = C:\WINDOWS\ji890bxp.exe
    O4 - Global Startup: AAV590W5.lnk = C:\WINDOWS\aav590w5.exe
    O4 - Global Startup: DEHVH10N.lnk = C:\WINDOWS\dehvh10n.exe
    O4 - Global Startup: V5TWTH98.lnk = C:\WINDOWS\v5twth98.exe
    O4 - Global Startup: FF9T7YTW.lnk = C:\WINDOWS\ff9t7ytw.exe
    O4 - Global Startup: Z0J0ATW3.lnk = C:\WINDOWS\z0j0atw3.exe
    O4 - Global Startup: 5V4KG5BA.lnk = C:\WINDOWS\5v4kg5ba.exe
    O4 - Global Startup: P7CBQHHZ.lnk = C:\WINDOWS\p7cbqhhz.exe
    O4 - Global Startup: D2XQOYIQ.lnk = C:\WINDOWS\d2xqoyiq.exe
    O4 - Global Startup: 538Q7LGU.lnk = C:\WINDOWS\538q7lgu.exe
    O4 - Global Startup: I9KBM8OT.lnk = C:\WINDOWS\i9kbm8ot.exe
    O4 - Global Startup: 3G8ZB2YQ.lnk = C:\WINDOWS\3g8zb2yq.exe
    O4 - Global Startup: GO9Z7L8L.lnk = C:\WINDOWS\go9z7l8l.exe
    O4 - Global Startup: 36A51FDY.lnk = C:\WINDOWS\36a51fdy.exe
    O4 - Global Startup: 4ZYB4QU7.lnk = C:\WINDOWS\4zyb4qu7.exe
    O4 - Global Startup: LDC8ZXQO.lnk = C:\WINDOWS\ldc8zxqo.exe
    O4 - Global Startup: VNYYZIRG.lnk = C:\WINDOWS\vnyyzirg.exe
    O4 - Global Startup: 4HEY509Z.lnk = C:\WINDOWS\4hey509z.exe
    O4 - Global Startup: QA7KAV1U.lnk = C:\WINDOWS\qa7kav1u.exe
    O4 - Global Startup: TLOHGA38.lnk = C:\WINDOWS\tlohga38.exe
    O4 - Global Startup: 79Y0A9TX.lnk = C:\WINDOWS\79y0a9tx.exe
    O4 - Global Startup: G1X30I06.lnk = C:\WINDOWS\g1x30i06.exe
    O4 - Global Startup: JL0ACWZM.lnk = C:\WINDOWS\jl0acwzm.exe
    O4 - Global Startup: PDQIQG2K.lnk = C:\WINDOWS\pdqiqg2k.exe
    O4 - Global Startup: AQ39LURG.lnk = C:\WINDOWS\aq39lurg.exe
    O4 - Global Startup: RGKCB9B2.lnk = C:\WINDOWS\rgkcb9b2.exe
    O4 - Global Startup: R5UERUNU.lnk = C:\WINDOWS\r5uerunu.exe
    O4 - Global Startup: W0LRL8Y4.lnk = C:\WINDOWS\w0lrl8y4.exe
    O4 - Global Startup: VKV009QB.lnk = C:\WINDOWS\vkv009qb.exe
    O4 - Global Startup: B6QC3U8H.lnk = C:\WINDOWS\b6qc3u8h.exe
    O4 - Global Startup: U5OBG7DE.lnk = C:\WINDOWS\u5obg7de.exe
    O4 - Global Startup: VL3MM0PA.lnk = C:\WINDOWS\vl3mm0pa.exe
    O4 - Global Startup: 7T760J1N.lnk = C:\WINDOWS\7t760j1n.exe
    O4 - Global Startup: CT0LI2QU.lnk = C:\WINDOWS\ct0li2qu.exe
    O4 - Global Startup: HH3PWB4P.lnk = C:\WINDOWS\hh3pwb4p.exe
    O9 - Extra button: Related (HKLM)
    O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
    O9 - Extra button: AIM (HKLM)
    O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
    O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?38040.5460763889
    O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
    O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/7d90ae05585062/housecall.antivirus.com/housecall/xscan53.cab
    O9 - Extra button: Related (HKLM)
    O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
    O9 - Extra button: AIM (HKLM)
    O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
    O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?38040.5460763889
    O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
    O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/7d90ae05585062/housecall.antivirus.com/housecall/xscan53.cab
     
    Last edited: May 2, 2004
    brentrobinson_3, May 2, 2004
    #1
  2. Jooske

    Jooske Registered Member

    Joined:
    Feb 12, 2002
    Posts:
    9,713
    Location:
    Netherlands, EU near the sea
    Jooske, May 2, 2004
    #2
  3. dvk01

    dvk01 Global Moderator

    Joined:
    Oct 9, 2003
    Posts:
    3,131
    Location:
    Loughton, Essex. UK
    definitely an adtomi hijack

    download this file (Adtomi Cleanup.zip).
    https://www.wilderssecurity.com/attachments/9x_Adtomi_Cleanup.zip for 98 or ME
    https://www.wilderssecurity.com/attachments/XPAdtomi_Cleanup.zip for XP

    or alternatively from
    http://www.thespykiller.co.uk/downloads.htm

    It was created by Mosaic1 and is available here with her kind permission
    And follow the instructions carefully.

    First If you have a Script Blocking Program enabled, disable it so the scripts will run.

    Unzip it to C:\Windows

    See if there is an Adtomi or yahoo stocks icon in your system tray , it might be a red ?? and if so right click and select remove , you must be online for this part
    --A web page from Adtomi would appear "-uninstall was succesful!"
    then go off line
    (note not all infections have this icon, so if it isn't there then don't worry, just continue to the next step)

    next press ctrl+ ALT+DEL once to bring up task manager, look in applications for the funny named file with 8 assorted letters & numbers, that will be listed towards the bottom of the running process list in your hijackthis log, If it isn't listed in the applications, then look in processes tab.

    In your case the file/ process to stop is : C:\WINDOWS\HH3PWB4P.EXE
    then press end task or end process and make sure that entry has disapeared from the list.
    if you can't stop it running, then DO NOT CONTINUE, please ask for more help first and there might also be morze1 running, if so end that process as well.

    Now locate and Double Click Cleanup.bat that is in the folder you unzipped ( C:\Windows\Adtomi Cleanup )

    ***Do not Touch the VBS files. The bat file will run the scripts.

    Make sure all Browser and folder windows are closed and it will do everything automatically for you.

    It will remove the Adtomi Spyware files from the Windows Folder
    Clean the Startup Folders
    Create Backups of the Adtomi exe files it deletes and save them in this folder
    Create a list of all oddly named files deleted from the Windows Folder
    Uninstall the BHO
    Start HijackThis and give you directions on what to remove.

    When you have finished please restart the computer.

    Run HijackThis again and post the contents of your new log and the contents of Adtomi.txt in your next reply in your Forum Topic.


    in your email you mentioned that you no longer have an unzipping utility, this file needs it as it uses a few files in the folder to do it's work

    you can download a new version of winzip free from http://www.winzip.com/downwzeval.htm which gives you a 21 day trial which is long enough to sort out your problems
     
    dvk01, May 2, 2004
    #3
  4. dvk01

    dvk01 Global Moderator

    Joined:
    Oct 9, 2003
    Posts:
    3,131
    Location:
    Loughton, Essex. UK
    after cleaning adtomi you have a lot of others that need cleaning so

    Download and unzip or install these programs/applications if you haven't already got them. If you have them, then make sure they are updated and configured as described

    Spybot - Search & Destroy from http://security.kolla.de
    AdAware 6 from http://www.lavasoft.de/support/download

    Run Sybot S&D

    After installing, first press Online, press search for updates, then tick the updates it finds, then press download updates. Beside the download button is a little down pointed arrow, select one of the servers listed. If it doesn't work or you get an error message then try a different server

    Next, close all Internet Explorer and OE windows, press 'Check for Problems', and have SpyBot remove all it finds that is marked in RED.

    then reboot &

    Run ADAWARE

    Before you scan with AdAware, check for updates of the reference file by using the "webupdate".
    the current ref file should read at least 01R300 28.04.2004 or a higher number/later date

    Then ........

    Make sure the following settings are made and on -------"ON=GREEN"
    From main window :Click "Start" then " Activate in-depth scan"

    then......

    click "Use custom scanning options>Customize" and have these options on: "Scan within archives" ,"Scan active processes","Scan registry", "Deep scan registry" ,"Scan my IE Favorites for banned URL" and "Scan my host-files"

    then.........

    go to settings(the gear on top of AdAware)>Tweak>Scanning engine and tick "Unload recognized processes during scanning" ...........then........"Cleaning engine" and "Let windows remove files in use at next reboot"

    then...... click "proceed" to save your settings.

    Now to scan it´s just to click the "Scan" button.

    When scan is finished, mark everything for removal and get rid of it. (Right-click the window and choose"select all" from the drop down menu) then press next and then say yes to the prompt, do you want to remove all these entries.

    reboot again

    then post a new hijackthis log to check what is left
     
    dvk01, May 2, 2004
    #4
  5. brentrobinson_3

    brentrobinson_3 Registered Member

    Joined:
    May 2, 2004
    Posts:
    5
    For some reason or another my computer will no long unzip a file. I tried to download the adtomi cleanup.zip file but I can't get it too unzip. Any suggestions?
     
    brentrobinson_3, May 2, 2004
    #5
  6. dvk01

    dvk01 Global Moderator

    Joined:
    Oct 9, 2003
    Posts:
    3,131
    Location:
    Loughton, Essex. UK
    i'll send you it unzipped and see if it will work

    there are 7 files, move them all into one folder, they have to be in the samne folder to work

    Unfortunately you might find that hotmail might reject it or strip the files as some are scripts and the hotmail filters see them as bad

    if that doesn't work let me know and I'll upload to a webspace for you to download as an unzipped folder
     
    dvk01, May 2, 2004
    #6
  7. brentrobinson_3

    brentrobinson_3 Registered Member

    Joined:
    May 2, 2004
    Posts:
    5
    ok...i was able to download the free evaluation from winzip...sorry didn't read the whole way to the end of your post the first time. Anyway i was able to unzip and run adtomi cleanup.zip

    I also ran spy bot and adware....below is my new hijack this log


    Logfile of HijackThis v1.97.7
    Scan saved at 5:11:15 PM, on 5/2/04
    Platform: Windows 98 SE (Win9x 4.10.2222A)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\SYSTEM\KERNEL32.DLL
    C:\WINDOWS\SYSTEM\MSGSRV32.EXE
    C:\WINDOWS\SYSTEM\MPREXE.EXE
    C:\WINDOWS\SYSTEM\mmtask.tsk
    C:\WINDOWS\EXPLORER.EXE
    C:\WINDOWS\SYSTEM\RNAAPP.EXE
    C:\WINDOWS\SYSTEM\TAPISRV.EXE
    C:\WINDOWS\SYSTEM\P2P NETWORKING\P2P NETWORKING.EXE
    C:\WINDOWS\STARTER.EXE
    C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
    C:\WINDOWS\SYSTEM\DDHELP.EXE
    C:\WINDOWS\SYSTEM\PSTORES.EXE
    C:\MY DOCUMENTS\HIJACK\HIJACKTHIS.EXE

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
    R3 - Default URLSearchHook is missing
    O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
    O4 - HKLM\..\Run: [P2P NETWORKING] C:\WINDOWS\SYSTEM\P2P NETWORKING\P2P NETWORKING.EXE /AUTOSTART
    O4 - HKLM\..\Run: [EnsoniqMixer] starter.exe
    O9 - Extra button: AIM (HKLM)
    O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
    O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?38040.5460763889
    O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
    O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/7d90ae05585062/housecall.antivirus.com/housecall/xscan53.cab
     
    brentrobinson_3, May 2, 2004
    #7
  8. puff-m-d

    puff-m-d Registered Member

    Joined:
    Feb 13, 2002
    Posts:
    5,703
    Location:
    North Carolina, USA
    Hi brentrobinson_3,

    Welcome to Wilders.

    First of all, remove P2P NETWORKING via your Add or Remove Programs Control Panel as it is a gateway for infestations to enter your computer.

    Check the following items in HijackThis.
    Close all windows except HijackThis and click Fix checked:

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank

    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
    R3 - Default URLSearchHook is missing

    O4 - HKLM\..\Run: [P2P NETWORKING] C:\WINDOWS\SYSTEM\P2P NETWORKING\P2P NETWORKING.EXE /AUTOSTART

    O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -

    There also may be hidden files. See HERE for how to show hidden files.

    Then reboot into safe mode and delete:

    C:\WINDOWS\SYSTEM\P2P NETWORKING\

    Reboot and then post a fresh HijackThis log.

    Regards,
    Kent
     
    puff-m-d, May 2, 2004
    #8
  9. brentrobinson_3

    brentrobinson_3 Registered Member

    Joined:
    May 2, 2004
    Posts:
    5
    When i rebooted into safe mode to delete c:\windows\system\p2p networking\ i was unable to delete it because i had already removed it via the add/remove programs control panel...that was the first this i was too do right?

    below is my new Hijack This log

    Thanks for the help


    Logfile of HijackThis v1.97.7
    Scan saved at 1:50:01 PM, on 5/3/04
    Platform: Windows 98 SE (Win9x 4.10.2222A)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\SYSTEM\KERNEL32.DLL
    C:\WINDOWS\SYSTEM\MSGSRV32.EXE
    C:\WINDOWS\SYSTEM\MPREXE.EXE
    C:\WINDOWS\SYSTEM\mmtask.tsk
    C:\WINDOWS\EXPLORER.EXE
    C:\WINDOWS\SYSTEM\RNAAPP.EXE
    C:\WINDOWS\SYSTEM\TAPISRV.EXE
    C:\WINDOWS\STARTER.EXE
    C:\PROGRAM FILES\GRISOFT\AVG6\AVGCC32.EXE
    C:\WINDOWS\SYSTEM\SYSTRAY.EXE
    C:\PROGRAM FILES\AIM\AIM.EXE
    C:\WINDOWS\SYSTEM\MSTASK.EXE
    C:\WINDOWS\SYSTEM\WMIEXE.EXE
    C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
    C:\WINDOWS\SYSTEM\DDHELP.EXE
    C:\WINDOWS\SYSTEM\PSTORES.EXE
    C:\MY DOCUMENTS\HIJACK\HIJACKTHIS.EXE

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
    O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
    O4 - HKLM\..\Run: [EnsoniqMixer] starter.exe
    O4 - HKLM\..\Run: [AVG_CC] C:\PROGRAM FILES\GRISOFT\AVG6\avgcc32.exe /startup
    O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
    O4 - HKLM\..\Run: [CriticalUpdate] C:\WINDOWS\SYSTEM\wucrtupd.exe -startup
    O4 - HKCU\..\Run: [AIM] C:\PROGRAM FILES\AIM\aim.exe -cnetwait.odl
    O9 - Extra button: AIM (HKLM)
    O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
    O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?38040.5460763889
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
    O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/7d90ae05585062/housecall.antivirus.com/housecall/xscan53.cab
     
    brentrobinson_3, May 3, 2004
    #9
  10. dvk01

    dvk01 Global Moderator

    Joined:
    Oct 9, 2003
    Posts:
    3,131
    Location:
    Loughton, Essex. UK
    that looks fine now

    many times uninstalling P2P from control panel doesn't work, that is why we suggest the other way, you were obviously one of the lucky ones

    make sure you do any needed updates
    go here, click Scan for updates in the main frame, and download and install all CRITICAL updates recommended.

    and
    Read here https://www.wilderssecurity.com/showthread.php?t=27971 for info on how to tighten your security settings and how to help prevent future attacks.
     
    dvk01, May 3, 2004
    #10
  11. brentrobinson_3

    brentrobinson_3 Registered Member

    Joined:
    May 2, 2004
    Posts:
    5
    I have a question....the folder where i have Hijack This...there is a whole bunch of backup files....Can i delete those files?
     
    brentrobinson_3, May 3, 2004
    #11
  12. dvk01

    dvk01 Global Moderator

    Joined:
    Oct 9, 2003
    Posts:
    3,131
    Location:
    Loughton, Essex. UK
    it's safer to keep them for a few weeks then when you are sure that nothing vital has been accidentally removed , open HJt, config/backups, select them and press delete
     
    dvk01, May 3, 2004
    #12
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...