What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Thankful For Any Help You Can Give Me

5 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
My computer has had several problems for a couple of months. I tried to fix the problems with some advice I received after emailing HP. I have also tried to download spybot search and destroy in the past, but my computer kept freezing up. Now, I have Spysweeper installed. Currently, my main problem is with the startup files. I cannot open windows unless I push "alternate, control, delete" to close many programs trying to startup. Morze1.exe is a window that keeps popping up (says missing shortcut). HP said that this was a malicious hijacker. They referred me to this site. I hope you can help me! Thank you.

Logfile of HijackThis v1.97.7
Scan saved at 12:33:52 PM, on 6/9/04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSGLOOP.EXE
C:\PROGRAM FILES\NETROPA\ONE-TOUCH MULTIMEDIA KEYBOARD\MMKEYBD.EXE
C:\WINDOWS\SYSTEM\MSG32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\PROGRAM FILES\NETROPA\ONE-TOUCH MULTIMEDIA KEYBOARD\KEYBDMGR.EXE
C:\PROGRAM FILES\NETROPA\ONSCREEN DISPLAY\OSD.EXE
C:\PROGRAM FILES\NETROPA\ONE-TOUCH MULTIMEDIA KEYBOARD\MMUSBKB2.EXE
C:\PROGRAM FILES\DIRECTCD\DIRECTCD.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\NAVAPW32.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\POPROXY.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\WEBROOT\SPY SWEEPER\SPYSWEEPER.EXE
C:\WINDOWS\RunDLL.exe
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\HPZSTATX.EXE
C:\WINDOWS\TEMPORARY INTERNET FILES\CONTENT.IE5\8TQB8LEJ\HIJACKTHIS[1].EXE
C:\WINDOWS\SYSTEM\MSCONFIG.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://kconline.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://kconline.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://server224.smartbotpro.net/7search/?new-hklm
O2 - BHO: My Search BHO - {014DA6C1-189F-421a-88CD-07CFE51CFF10} - C:\PROGRAM FILES\MYSEARCH\BAR\1.BIN\S4BAR.DLL
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: (no name) - {D537A3D0-8C07-4D62-953F-162207F5090D} - C:\WINDOWS\SYSTEM\regsvrac32.dll
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: My &Search Bar - {014DA6C9-189F-421a-88CD-07CFE51CFF10} - C:\PROGRAM FILES\MYSEARCH\BAR\1.BIN\S4BAR.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [Adaptec DirectCD] C:\Program Files\DirectCD\DIRECTCD.EXE
O4 - HKLM\..\Run: [Norton Auto-Protect] C:\PROGRA~1\NORTON~1\NAVAPW32.EXE /LOADQUIET
O4 - HKLM\..\Run: [Norton eMail Protect] C:\Program Files\Norton AntiVirus\POPROXY.EXE
O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] c:\windows\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [SpybotSnD] "C:\PROGRAM FILES\SPYBOT - SEARCH & DESTROY\SPYBOTSD.EXE" /autofix /autoclose
O4 - HKLM\..\Run: [HPScanPatch] C:\WINDOWS\SYSTEM\HPScanFix.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [stcinstaller] c:\installer\id53.exe
O4 - HKLM\..\Run: [Xex7x] C:\WINDOWS\TEMP\XEX7X.EXE
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
O4 - HKLM\..\RunServices: [Keyboard Manager] C:\Program Files\Netropa\One-touch Multimedia Keyboard\MMKeybd.exe
O4 - HKLM\..\RunServices: [TVWakeup] C:\Progra~1\TVView~1\tvwakeup.exe
O4 - HKLM\..\RunServices: [Announcements] C:\Program Files\TV Viewer\annclist.exe
O4 - HKLM\..\RunServices: [VidSvr]
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [Encompass_ENCMONTR] C:\Program Files\Easy Internet\ENCMONTR.EXE
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SPYSWEEPER.EXE" /1
O4 - HKCU\..\Run: [Taskbar Display Controls] RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\Money Express.exe"
O4 - HKCU\..\Run: [Weather] C:\PROGRAM FILES\AWS\WEATHERBUG\WEATHER.EXE 1
O4 - HKLM\..\RunOnce: [MARGO1C.EXE] C:\WINDOWS\MARGO1C.EXE
O4 - HKCU\..\RunOnce: [MARGO1C.EXE] C:\WINDOWS\MARGO1C.EXE
O4 - Global Startup: NP09XYLP.lnk = C:\WINDOWS\np09xylp.exe
O4 - Global Startup: MORZE1.lnk = C:\WINDOWS\morze1.exe
O4 - Global Startup: 4Y35R24K.lnk = C:\WINDOWS\4y35r24k.exe
O4 - Global Startup: NALBT6PB.lnk = C:\WINDOWS\rue59yzo.exe
O4 - Global Startup: 6JAI620U.lnk = C:\WINDOWS\rue59yzo.exe
O4 - Global Startup: FFITY0OR.lnk = C:\WINDOWS\unrex093.exe
O4 - Global Startup: DJ00UJFD.lnk = C:\WINDOWS\lz733vpw.exe
O4 - Global Startup: DG1N2OE5.lnk = C:\WINDOWS\x98405kz.exe
O4 - Global Startup: ZN5818FA.lnk = C:\WINDOWS\x98405kz.exe
O4 - Global Startup: QU2ERZT4.lnk = C:\WINDOWS\wib297j2.exe
O4 - Global Startup: X98405KZ.lnk = C:\WINDOWS\x98405kz.exe
O4 - Global Startup: FLQ3TFV2.lnk = C:\WINDOWS\mewcrm1a.exe
O4 - Global Startup: JN417M86.lnk = C:\WINDOWS\3imq92vc.exe
O4 - Global Startup: MIIQLY9F.lnk = C:\WINDOWS\mewcrm1a.exe
O4 - Global Startup: 1O216ALL.lnk = C:\WINDOWS\mewcrm1a.exe
O4 - Global Startup: DH2BPKF2.lnk = C:\WINDOWS\mewcrm1a.exe
O4 - Global Startup: 7831G0OB.lnk = C:\WINDOWS\mewcrm1a.exe
O4 - Global Startup: QJEXLIPR.lnk = C:\WINDOWS\mewcrm1a.exe
O4 - Global Startup: HTBMKJY3.lnk = C:\WINDOWS\mewcrm1a.exe
O4 - Global Startup: GE5269Y9.lnk = C:\WINDOWS\mewcrm1a.exe
O4 - Global Startup: NYRIO55O.lnk = C:\WINDOWS\mewcrm1a.exe
O4 - Global Startup: MKMRP9MN.lnk = C:\WINDOWS\mkmrp9mn.exe
O4 - Global Startup: H1IHNCOE.lnk = C:\WINDOWS\h1ihncoe.exe
O4 - Global Startup: RA9EEXDK.lnk = C:\WINDOWS\ra9eexdk.exe
O4 - Global Startup: 16VT0C4Z.lnk = C:\WINDOWS\16vt0c4z.exe
O4 - Global Startup: 5W1BDQQ5.lnk = C:\WINDOWS\945tnqj9.exe
O4 - Global Startup: 5XY09H5E.lnk = C:\WINDOWS\5xy09h5e.exe
O4 - Global Startup: U2G98U5U.lnk = C:\WINDOWS\u2g98u5u.exe
O4 - Global Startup: 3G75RQUB.lnk = C:\WINDOWS\3g75rqub.exe
O4 - Global Startup: MEWCRM1A.lnk = C:\WINDOWS\mewcrm1a.exe
O4 - Global Startup: IM2NTRVK.lnk = C:\WINDOWS\im2ntrvk.exe
O4 - Global Startup: 945TNQJ9.lnk = C:\WINDOWS\945tnqj9.exe
O4 - Global Startup: UNREX093.lnk = C:\WINDOWS\unrex093.exe
O4 - Global Startup: MJR2Z29W.lnk = C:\WINDOWS\wib297j2.exe
O4 - Global Startup: WIB297J2.lnk = C:\WINDOWS\wib297j2.exe
O4 - Global Startup: XKEJ3Z48.lnk = C:\WINDOWS\xkej3z48.exe
O4 - Global Startup: 5WB3LNEE.lnk = C:\WINDOWS\5wb3lnee.exe
O4 - Global Startup: W4QTPJIK.lnk = C:\WINDOWS\w4qtpjik.exe
O4 - Global Startup: RUE59YZO.lnk = C:\WINDOWS\rue59yzo.exe
O4 - Global Startup: WP71LI65.lnk = C:\WINDOWS\wp71li65.exe
O4 - Global Startup: 3TJWQH9H.lnk = C:\WINDOWS\3tjwqh9h.exe
O4 - Global Startup: 71TIR0YZ.lnk = C:\WINDOWS\71tir0yz.exe
O4 - Global Startup: ROC8D9EW.lnk = C:\WINDOWS\roc8d9ew.exe
O4 - Global Startup: LZ733VPW.lnk = C:\WINDOWS\lz733vpw.exe
O4 - Global Startup: QILYHG64.lnk = C:\WINDOWS\qilyhg64.exe
O4 - Global Startup: 6Y0GHHQ1.lnk = C:\WINDOWS\6y0ghhq1.exe
O4 - Global Startup: FDAHJR12.lnk = C:\WINDOWS\fdahjr12.exe
O4 - Global Startup: EVKGXJT0.lnk = C:\WINDOWS\evkgxjt0.exe
O4 - Global Startup: QTD3H82Y.lnk = C:\WINDOWS\qtd3h82y.exe
O4 - Global Startup: 09223Z68.lnk = C:\WINDOWS\09223z68.exe
O4 - Global Startup: MHW98YER.lnk = C:\WINDOWS\mhw98yer.exe
O4 - Global Startup: RPB3AGAV.lnk = C:\WINDOWS\rpb3agav.exe
O4 - Global Startup: F27UEVVW.lnk = C:\WINDOWS\f27uevvw.exe
O4 - Global Startup: X3CP23Z4.lnk = C:\WINDOWS\x3cp23z4.exe
O4 - Global Startup: 6CFWYH1V.lnk = C:\WINDOWS\6cfwyh1v.exe
O4 - Global Startup: 511YYV07.lnk = C:\WINDOWS\511yyv07.exe
O4 - Global Startup: IO2D5YE7.lnk = C:\WINDOWS\io2d5ye7.exe
O4 - Global Startup: KE4IDARO.lnk = C:\WINDOWS\ke4idaro.exe
O4 - Global Startup: U042NX0V.lnk = C:\WINDOWS\u042nx0v.exe
O4 - Global Startup: 7CVNWW4N.lnk = C:\WINDOWS\7cvnww4n.exe
O4 - Global Startup: RVYE0UTV.lnk = C:\WINDOWS\rvye0utv.exe
O4 - Global Startup: 49FIPVBT.lnk = C:\WINDOWS\49fipvbt.exe
O4 - Global Startup: G1R53GYE.lnk = C:\WINDOWS\g1r53gye.exe
O4 - Global Startup: YUGWT7C8.lnk = C:\WINDOWS\yugwt7c8.exe
O4 - Global Startup: 7RTD5TKB.lnk = C:\WINDOWS\7rtd5tkb.exe
O4 - Global Startup: HM5QXHCU.lnk = C:\WINDOWS\hm5qxhcu.exe
O4 - Global Startup: 06QPF2I4.lnk = C:\WINDOWS\06qpf2i4.exe
O4 - Global Startup: NY7LCPFU.lnk = C:\WINDOWS\ny7lcpfu.exe
O4 - Global Startup: M281PLTU.lnk = C:\WINDOWS\m281pltu.exe
O4 - Global Startup: 01C7PARZ.lnk = C:\WINDOWS\01c7parz.exe
O4 - Global Startup: 6UVPBD3V.lnk = C:\WINDOWS\6uvpbd3v.exe
O4 - Global Startup: 3IMQ92VC.lnk = C:\WINDOWS\3imq92vc.exe
O4 - Global Startup: YN4LDURI.lnk = C:\WINDOWS\yn4lduri.exe
O4 - Global Startup: MLBHWI4V.lnk = C:\WINDOWS\mlbhwi4v.exe
O4 - Global Startup: KPNXUQH5.lnk = C:\WINDOWS\kpnxuqh5.exe
O4 - Global Startup: Z3N962B2.lnk = C:\WINDOWS\z3n962b2.exe
O4 - Global Startup: 2R5DD51X.lnk = C:\WINDOWS\2r5dd51x.exe
O4 - Global Startup: RDVTL9EV.lnk = C:\WINDOWS\rdvtl9ev.exe
O4 - Global Startup: HGRJR0XV.lnk = C:\WINDOWS\hgrjr0xv.exe
O4 - Global Startup: 7W961NB0.lnk = C:\WINDOWS\7w961nb0.exe
O4 - Global Startup: UK09N43D.lnk = C:\WINDOWS\uk09n43d.exe
O4 - Global Startup: 0OIJFUXR.lnk = C:\WINDOWS\0oijfuxr.exe
O4 - Global Startup: 8LNCI9BH.lnk = C:\WINDOWS\8lnci9bh.exe
O4 - Global Startup: IK79C8Q6.lnk = C:\WINDOWS\ik79c8q6.exe
O4 - Global Startup: 9NMQYII9.lnk = C:\WINDOWS\9nmqyii9.exe
O4 - Global Startup: 5FN9FDH7.lnk = C:\WINDOWS\5fn9fdh7.exe
O4 - Global Startup: M1BHU7LZ.lnk = C:\WINDOWS\m1bhu7lz.exe
O4 - Global Startup: 9MN3FJJ9.lnk = C:\WINDOWS\9mn3fjj9.exe
O4 - Global Startup: KMZXOBD1.lnk = C:\WINDOWS\kmzxobd1.exe
O4 - Global Startup: LOXAHTXQ.lnk = C:\WINDOWS\loxahtxq.exe
O4 - Global Startup: YR7I14WC.lnk = C:\WINDOWS\yr7i14wc.exe
O4 - Global Startup: JY0BY8JG.lnk = C:\WINDOWS\jy0by8jg.exe
O4 - Global Startup: 8IJYNBNK.lnk = C:\WINDOWS\8ijynbnk.exe
O4 - Global Startup: 3DFYXEU7.lnk = C:\WINDOWS\3dfyxeu7.exe
O4 - Global Startup: LAGNC8I8.lnk = C:\WINDOWS\lagnc8i8.exe
O4 - Global Startup: ILJH66GD.lnk = C:\WINDOWS\iljh66gd.exe
O4 - Global Startup: LXJ4CZ27.lnk = C:\WINDOWS\lxj4cz27.exe
O4 - Global Startup: UP1RJGG3.lnk = C:\WINDOWS\up1rjgg3.exe
O4 - Global Startup: 0V052OBL.lnk = C:\WINDOWS\0v052obl.exe
O4 - Global Startup: 67BFWYT6.lnk = C:\WINDOWS\67bfwyt6.exe
O4 - Global Startup: 907Y799A.lnk = C:\WINDOWS\907y799a.exe
O4 - Global Startup: JJ6R5W1M.lnk = C:\WINDOWS\jj6r5w1m.exe
O4 - Global Startup: 6QAF5UT2.lnk = C:\WINDOWS\6qaf5ut2.exe
O4 - Global Startup: PMJQ4E30.lnk = C:\WINDOWS\pmjq4e30.exe
O4 - Global Startup: GQ4PIPKY.lnk = C:\WINDOWS\gq4pipky.exe
O4 - Global Startup: AY0FO72M.lnk = C:\WINDOWS\ay0fo72m.exe
O4 - Global Startup: P32A54EF.lnk = C:\WINDOWS\p32a54ef.exe
O4 - Global Startup: IV58OYD2.lnk = C:\WINDOWS\iv58oyd2.exe
O4 - Global Startup: VK2LZUB0.lnk = C:\WINDOWS\vk2lzub0.exe
O4 - Global Startup: YXCXN0FX.lnk = C:\WINDOWS\mewcrm1a.exe
O4 - Global Startup: ILK89Q1X.lnk = C:\WINDOWS\mewcrm1a.exe
O4 - Global Startup: 4G89R3C6.lnk = C:\WINDOWS\mewcrm1a.exe
O4 - Global Startup: EEZDP7UE.lnk = C:\WINDOWS\eezdp7ue.exe
O4 - Global Startup: NLQ041C4.lnk = C:\WINDOWS\nlq041c4.exe
O4 - Global Startup: LBEHREDU.lnk = C:\WINDOWS\lbehredu.exe
O4 - Global Startup: IN0MQKVW.lnk = C:\WINDOWS\in0mqkvw.exe
O4 - Global Startup: 66KA87DF.lnk = C:\WINDOWS\66ka87df.exe
O4 - Global Startup: JJDDVWQI.lnk = C:\WINDOWS\jjddvwqi.exe
O4 - Global Startup: LY1PGKE2.lnk = C:\WINDOWS\ly1pgke2.exe
O4 - Global Startup: A78NBG2T.lnk = C:\WINDOWS\a78nbg2t.exe
O4 - Global Startup: IM7UBJKP.lnk = C:\WINDOWS\im7ubjkp.exe
O4 - Global Startup: W0UGLGRE.lnk = C:\WINDOWS\w0uglgre.exe
O4 - Global Startup: YFTXATF9.lnk = C:\WINDOWS\yftxatf9.exe
O4 - Global Startup: 1UNNH0VV.lnk = C:\WINDOWS\1unnh0vv.exe
O4 - Global Startup: 10HZ0XC9.lnk = C:\WINDOWS\10hz0xc9.exe
O4 - Global Startup: UOHKV4BT.lnk = C:\WINDOWS\uohkv4bt.exe
O4 - Global Startup: OWQ72I17.lnk = C:\WINDOWS\owq72i17.exe
O4 - Global Startup: MORZE5.lnk = C:\WINDOWS\roc8d9ew.exe
O8 - Extra context menu item: &Google Search - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmsearch.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmcache.html
O8 - Extra context menu item: Si&milar Pages - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmsimilar.html
O8 - Extra context menu item: Backward &Links - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmbacklinks.html
O8 - Extra context menu item: Translate into English - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmtrans.html
O9 - Extra button: RealGuide (HKLM)
O9 - Extra button: WeatherBug (HKCU)
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…s/yinst0401.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://active.macromedia.com/flash2/cabs/swflash.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2003120…all/xscan53.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/…8077.1460763889
O16 - DPF: {2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} (MiniBugTransporterX Class) - http://download.weatherbug.com/minibug/tri…Transporter.cab?
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
Post #2
Welcome to the forum.
You really have a mess there, but we'll try to get rid of it.

First:

Download to and run from your desktop CW-Shredder, hit the FIX button and let it run and fix what it finds. Make sure you have all browser windows closed.

Also available here:
http://www.aumha.org/freeware.htm
http://www.lurkhere.com/~nicefiles/


Next:
Do you have a Yahoo Stock Ticker icon in your task bar, if so rightclick on it, and choose remove - while being online

A web page from Adtomi will appear and should say "-uninstall was succesful!"
Also look in the Control Panel, add/remove programs for Adtomi (this is what is causing all the problems). If it's there, uninstall it.


Next:
Download and unzip this file to a folder.

http://homepage.ntlworld.com/dvk01uk/files…omi_Cleanup.zip


Next:
Bring up your task manager (ctrl, alt, delete) and end task on any funny looking files like this, MARGO1C.EXE, it may have a /dk after it and end task on it. This is important for the fix to work. Inside the adtomi folder is a readme.txt, please look at it.

Then make sure you have all folders closed and off the net

Open up the Adtomi folder and double click Cleanup.bat
After you start the batch file don't forget to close the Adtomi Cleanup folder too. Then follow the prompts on the screen

NOTE: Do not Touch the VBS files. The bat file will run the scripts all by itself.

It will:

- remove the Adtomi Spyware files from the Windows Folder
- Clean the Startup Folders
- Create Backups of the Adtomi exe files it deletes and save them in this folder
- Create a list of all oddly named files deleted from the Windows Folder
- Uninstall the Browserhelper.dll browser plugin
- Start HijackThis and give you directions on what to remove.

Reboot and post a fresh HJT log, MrC
Post #3
Thank you for your help. This is what I got so far. I used the shredder and it said 2 problems were fixed. I didn't have the yahoo stock ticker icon. I think I saw it there a couple months ago and got rid of it right away. That's when I remember starting to have all these problems. I did download the cleanup adtomi folder and unzipped it. I hope I used it correctly. Here is the second log I just scanned. Could you please advise me what to fix/eliminate next? Thanks!

Logfile of HijackThis v1.97.7
Scan saved at 9:54:39 AM, on 6/11/04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\PROGRAM FILES\NETROPA\ONE-TOUCH MULTIMEDIA KEYBOARD\MMKEYBD.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\PROGRAM FILES\TV VIEWER\TVWAKEUP.EXE
C:\PROGRAM FILES\TV VIEWER\ANNCLIST.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAM FILES\EASY INTERNET\ENCMONTR.EXE
C:\PROGRAM FILES\NETROPA\ONE-TOUCH MULTIMEDIA KEYBOARD\KEYBDMGR.EXE
C:\PROGRAM FILES\NETROPA\ONE-TOUCH MULTIMEDIA KEYBOARD\MMUSBKB2.EXE
C:\WINDOWS\EXPLORER.EXE
C:\PROGRAM FILES\DIRECTCD\DIRECTCD.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\NAVAPW32.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\POPROXY.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\HPSYSDRV.EXE
C:\WINDOWS\TEMP\XEX7X.EXE
C:\WINDOWS\RunDLL.exe
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\WINZIP\WZQKPICK.EXE
C:\UNZIPPED\HIJACKTHIS[1]\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://kconline.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://kconline.com
O2 - BHO: My Search BHO - {014DA6C1-189F-421a-88CD-07CFE51CFF10} - C:\PROGRAM FILES\MYSEARCH\BAR\1.BIN\S4BAR.DLL
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: (no name) - {D537A3D0-8C07-4D62-953F-162207F5090D} - C:\WINDOWS\SYSTEM\regsvrac32.dll
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: My &Search Bar - {014DA6C9-189F-421a-88CD-07CFE51CFF10} - C:\PROGRAM FILES\MYSEARCH\BAR\1.BIN\S4BAR.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [Adaptec DirectCD] C:\Program Files\DirectCD\DIRECTCD.EXE
O4 - HKLM\..\Run: [Norton Auto-Protect] C:\PROGRA~1\NORTON~1\NAVAPW32.EXE /LOADQUIET
O4 - HKLM\..\Run: [Norton eMail Protect] C:\Program Files\Norton AntiVirus\POPROXY.EXE
O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] c:\windows\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [SpybotSnD] "C:\PROGRAM FILES\SPYBOT - SEARCH & DESTROY\SPYBOTSD.EXE" /autofix /autoclose
O4 - HKLM\..\Run: [HPScanPatch] C:\WINDOWS\SYSTEM\HPScanFix.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [stcinstaller] c:\installer\id53.exe
O4 - HKLM\..\Run: [Xex7x] C:\WINDOWS\TEMP\XEX7X.EXE
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
O4 - HKLM\..\RunServices: [Keyboard Manager] C:\Program Files\Netropa\One-touch Multimedia Keyboard\MMKeybd.exe
O4 - HKLM\..\RunServices: [TVWakeup] C:\Progra~1\TVView~1\tvwakeup.exe
O4 - HKLM\..\RunServices: [Announcements] C:\Program Files\TV Viewer\annclist.exe
O4 - HKLM\..\RunServices: [VidSvr]
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [Encompass_ENCMONTR] C:\Program Files\Easy Internet\ENCMONTR.EXE
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SPYSWEEPER.EXE" /1
O4 - HKCU\..\Run: [Taskbar Display Controls] RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY
O4 - HKCU\..\Run: [Weather] C:\PROGRAM FILES\AWS\WEATHERBUG\WEATHER.EXE 1
O4 - HKLM\..\RunOnce: [MARGO1C.EXE] C:\WINDOWS\MARGO1C.EXE
O4 - HKCU\..\RunOnce: [MARGO1C.EXE] C:\WINDOWS\MARGO1C.EXE
O4 - Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O4 - Global Startup: NALBT6PB.lnk = C:\WINDOWS\rue59yzo.exe
O4 - Global Startup: 6JAI620U.lnk = C:\WINDOWS\rue59yzo.exe
O4 - Global Startup: MORZE1.lnk = C:\WINDOWS\morze1.exe
O4 - Global Startup: FFITY0OR.lnk = C:\WINDOWS\unrex093.exe
O4 - Global Startup: DJ00UJFD.lnk = C:\WINDOWS\lz733vpw.exe
O4 - Global Startup: DG1N2OE5.lnk = C:\WINDOWS\x98405kz.exe
O4 - Global Startup: ZN5818FA.lnk = C:\WINDOWS\x98405kz.exe
O4 - Global Startup: QU2ERZT4.lnk = C:\WINDOWS\wib297j2.exe
O4 - Global Startup: X98405KZ.lnk = C:\WINDOWS\x98405kz.exe
O4 - Global Startup: FLQ3TFV2.lnk = C:\WINDOWS\mewcrm1a.exe
O4 - Global Startup: JN417M86.lnk = C:\WINDOWS\3imq92vc.exe
O4 - Global Startup: MIIQLY9F.lnk = C:\WINDOWS\mewcrm1a.exe
O4 - Global Startup: 1O216ALL.lnk = C:\WINDOWS\mewcrm1a.exe
O4 - Global Startup: DH2BPKF2.lnk = C:\WINDOWS\mewcrm1a.exe
O4 - Global Startup: 7831G0OB.lnk = C:\WINDOWS\mewcrm1a.exe
O4 - Global Startup: QJEXLIPR.lnk = C:\WINDOWS\mewcrm1a.exe
O4 - Global Startup: HTBMKJY3.lnk = C:\WINDOWS\mewcrm1a.exe
O4 - Global Startup: GE5269Y9.lnk = C:\WINDOWS\mewcrm1a.exe
O4 - Global Startup: NYRIO55O.lnk = C:\WINDOWS\mewcrm1a.exe
O4 - Global Startup: MKMRP9MN.lnk = C:\WINDOWS\mkmrp9mn.exe
O4 - Global Startup: H1IHNCOE.lnk = C:\WINDOWS\h1ihncoe.exe
O4 - Global Startup: RA9EEXDK.lnk = C:\WINDOWS\ra9eexdk.exe
O4 - Global Startup: 16VT0C4Z.lnk = C:\WINDOWS\16vt0c4z.exe
O4 - Global Startup: 5W1BDQQ5.lnk = C:\WINDOWS\945tnqj9.exe
O4 - Global Startup: 5XY09H5E.lnk = C:\WINDOWS\5xy09h5e.exe
O4 - Global Startup: U2G98U5U.lnk = C:\WINDOWS\u2g98u5u.exe
O4 - Global Startup: 3G75RQUB.lnk = C:\WINDOWS\3g75rqub.exe
O4 - Global Startup: MEWCRM1A.lnk = C:\WINDOWS\mewcrm1a.exe
O4 - Global Startup: IM2NTRVK.lnk = C:\WINDOWS\im2ntrvk.exe
O4 - Global Startup: 945TNQJ9.lnk = C:\WINDOWS\945tnqj9.exe
O4 - Global Startup: UNREX093.lnk = C:\WINDOWS\unrex093.exe
O4 - Global Startup: MJR2Z29W.lnk = C:\WINDOWS\wib297j2.exe
O4 - Global Startup: WIB297J2.lnk = C:\WINDOWS\wib297j2.exe
O4 - Global Startup: XKEJ3Z48.lnk = C:\WINDOWS\xkej3z48.exe
O4 - Global Startup: 5WB3LNEE.lnk = C:\WINDOWS\5wb3lnee.exe
O4 - Global Startup: W4QTPJIK.lnk = C:\WINDOWS\w4qtpjik.exe
O4 - Global Startup: RUE59YZO.lnk = C:\WINDOWS\rue59yzo.exe
O4 - Global Startup: WP71LI65.lnk = C:\WINDOWS\wp71li65.exe
O4 - Global Startup: 3TJWQH9H.lnk = C:\WINDOWS\3tjwqh9h.exe
O4 - Global Startup: 71TIR0YZ.lnk = C:\WINDOWS\71tir0yz.exe
O4 - Global Startup: ROC8D9EW.lnk = C:\WINDOWS\roc8d9ew.exe
O4 - Global Startup: LZ733VPW.lnk = C:\WINDOWS\lz733vpw.exe
O4 - Global Startup: QILYHG64.lnk = C:\WINDOWS\qilyhg64.exe
O4 - Global Startup: 6Y0GHHQ1.lnk = C:\WINDOWS\6y0ghhq1.exe
O4 - Global Startup: FDAHJR12.lnk = C:\WINDOWS\fdahjr12.exe
O4 - Global Startup: EVKGXJT0.lnk = C:\WINDOWS\evkgxjt0.exe
O4 - Global Startup: QTD3H82Y.lnk = C:\WINDOWS\qtd3h82y.exe
O4 - Global Startup: 09223Z68.lnk = C:\WINDOWS\09223z68.exe
O4 - Global Startup: MHW98YER.lnk = C:\WINDOWS\mhw98yer.exe
O4 - Global Startup: RPB3AGAV.lnk = C:\WINDOWS\rpb3agav.exe
O4 - Global Startup: F27UEVVW.lnk = C:\WINDOWS\f27uevvw.exe
O4 - Global Startup: X3CP23Z4.lnk = C:\WINDOWS\x3cp23z4.exe
O4 - Global Startup: 6CFWYH1V.lnk = C:\WINDOWS\6cfwyh1v.exe
O4 - Global Startup: 511YYV07.lnk = C:\WINDOWS\511yyv07.exe
O4 - Global Startup: IO2D5YE7.lnk = C:\WINDOWS\io2d5ye7.exe
O4 - Global Startup: U042NX0V.lnk = C:\WINDOWS\u042nx0v.exe
O4 - Global Startup: 7CVNWW4N.lnk = C:\WINDOWS\7cvnww4n.exe
O4 - Global Startup: RVYE0UTV.lnk = C:\WINDOWS\rvye0utv.exe
O4 - Global Startup: 49FIPVBT.lnk = C:\WINDOWS\49fipvbt.exe
O4 - Global Startup: YUGWT7C8.lnk = C:\WINDOWS\yugwt7c8.exe
O4 - Global Startup: 7RTD5TKB.lnk = C:\WINDOWS\7rtd5tkb.exe
O4 - Global Startup: HM5QXHCU.lnk = C:\WINDOWS\hm5qxhcu.exe
O4 - Global Startup: 06QPF2I4.lnk = C:\WINDOWS\06qpf2i4.exe
O4 - Global Startup: NY7LCPFU.lnk = C:\WINDOWS\ny7lcpfu.exe
O4 - Global Startup: M281PLTU.lnk = C:\WINDOWS\m281pltu.exe
O4 - Global Startup: 6UVPBD3V.lnk = C:\WINDOWS\6uvpbd3v.exe
O4 - Global Startup: 3IMQ92VC.lnk = C:\WINDOWS\3imq92vc.exe
O4 - Global Startup: YN4LDURI.lnk = C:\WINDOWS\yn4lduri.exe
O4 - Global Startup: MLBHWI4V.lnk = C:\WINDOWS\mlbhwi4v.exe
O4 - Global Startup: KPNXUQH5.lnk = C:\WINDOWS\kpnxuqh5.exe
O4 - Global Startup: Z3N962B2.lnk = C:\WINDOWS\z3n962b2.exe
O4 - Global Startup: 2R5DD51X.lnk = C:\WINDOWS\2r5dd51x.exe
O4 - Global Startup: RDVTL9EV.lnk = C:\WINDOWS\rdvtl9ev.exe
O4 - Global Startup: HGRJR0XV.lnk = C:\WINDOWS\hgrjr0xv.exe
O4 - Global Startup: 7W961NB0.lnk = C:\WINDOWS\7w961nb0.exe
O4 - Global Startup: UK09N43D.lnk = C:\WINDOWS\uk09n43d.exe
O4 - Global Startup: 0OIJFUXR.lnk = C:\WINDOWS\0oijfuxr.exe
O4 - Global Startup: 8LNCI9BH.lnk = C:\WINDOWS\8lnci9bh.exe
O4 - Global Startup: IK79C8Q6.lnk = C:\WINDOWS\ik79c8q6.exe
O4 - Global Startup: 9NMQYII9.lnk = C:\WINDOWS\9nmqyii9.exe
O4 - Global Startup: 5FN9FDH7.lnk = C:\WINDOWS\5fn9fdh7.exe
O4 - Global Startup: M1BHU7LZ.lnk = C:\WINDOWS\m1bhu7lz.exe
O4 - Global Startup: 9MN3FJJ9.lnk = C:\WINDOWS\9mn3fjj9.exe
O4 - Global Startup: KMZXOBD1.lnk = C:\WINDOWS\kmzxobd1.exe
O4 - Global Startup: LOXAHTXQ.lnk = C:\WINDOWS\loxahtxq.exe
O4 - Global Startup: YR7I14WC.lnk = C:\WINDOWS\yr7i14wc.exe
O4 - Global Startup: JY0BY8JG.lnk = C:\WINDOWS\jy0by8jg.exe
O4 - Global Startup: 8IJYNBNK.lnk = C:\WINDOWS\8ijynbnk.exe
O4 - Global Startup: 3DFYXEU7.lnk = C:\WINDOWS\3dfyxeu7.exe
O4 - Global Startup: LAGNC8I8.lnk = C:\WINDOWS\lagnc8i8.exe
O4 - Global Startup: ILJH66GD.lnk = C:\WINDOWS\iljh66gd.exe
O4 - Global Startup: LXJ4CZ27.lnk = C:\WINDOWS\lxj4cz27.exe
O4 - Global Startup: UP1RJGG3.lnk = C:\WINDOWS\up1rjgg3.exe
O4 - Global Startup: 0V052OBL.lnk = C:\WINDOWS\0v052obl.exe
O4 - Global Startup: 67BFWYT6.lnk = C:\WINDOWS\67bfwyt6.exe
O4 - Global Startup: 907Y799A.lnk = C:\WINDOWS\907y799a.exe
O4 - Global Startup: JJ6R5W1M.lnk = C:\WINDOWS\jj6r5w1m.exe
O4 - Global Startup: 6QAF5UT2.lnk = C:\WINDOWS\6qaf5ut2.exe
O4 - Global Startup: PMJQ4E30.lnk = C:\WINDOWS\pmjq4e30.exe
O4 - Global Startup: GQ4PIPKY.lnk = C:\WINDOWS\gq4pipky.exe
O4 - Global Startup: AY0FO72M.lnk = C:\WINDOWS\ay0fo72m.exe
O4 - Global Startup: P32A54EF.lnk = C:\WINDOWS\p32a54ef.exe
O4 - Global Startup: IV58OYD2.lnk = C:\WINDOWS\iv58oyd2.exe
O4 - Global Startup: VK2LZUB0.lnk = C:\WINDOWS\vk2lzub0.exe
O4 - Global Startup: YXCXN0FX.lnk = C:\WINDOWS\mewcrm1a.exe
O4 - Global Startup: ILK89Q1X.lnk = C:\WINDOWS\mewcrm1a.exe
O4 - Global Startup: 4G89R3C6.lnk = C:\WINDOWS\mewcrm1a.exe
O4 - Global Startup: NP09XYLP.lnk = C:\WINDOWS\np09xylp.exe
O4 - Global Startup: EEZDP7UE.lnk = C:\WINDOWS\eezdp7ue.exe
O4 - Global Startup: NLQ041C4.lnk = C:\WINDOWS\nlq041c4.exe
O4 - Global Startup: LBEHREDU.lnk = C:\WINDOWS\lbehredu.exe
O4 - Global Startup: IN0MQKVW.lnk = C:\WINDOWS\in0mqkvw.exe
O4 - Global Startup: 66KA87DF.lnk = C:\WINDOWS\66ka87df.exe
O4 - Global Startup: JJDDVWQI.lnk = C:\WINDOWS\jjddvwqi.exe
O4 - Global Startup: LY1PGKE2.lnk = C:\WINDOWS\ly1pgke2.exe
O4 - Global Startup: A78NBG2T.lnk = C:\WINDOWS\a78nbg2t.exe
O4 - Global Startup: IM7UBJKP.lnk = C:\WINDOWS\im7ubjkp.exe
O4 - Global Startup: 4Y35R24K.lnk = C:\WINDOWS\4y35r24k.exe
O4 - Global Startup: W0UGLGRE.lnk = C:\WINDOWS\w0uglgre.exe
O4 - Global Startup: YFTXATF9.lnk = C:\WINDOWS\yftxatf9.exe
O4 - Global Startup: 1UNNH0VV.lnk = C:\WINDOWS\1unnh0vv.exe
O4 - Global Startup: 10HZ0XC9.lnk = C:\WINDOWS\10hz0xc9.exe
O4 - Global Startup: UOHKV4BT.lnk = C:\WINDOWS\uohkv4bt.exe
O4 - Global Startup: OWQ72I17.lnk = C:\WINDOWS\owq72i17.exe
O4 - Global Startup: MORZE5.lnk = C:\WINDOWS\roc8d9ew.exe
O8 - Extra context menu item: &Google Search - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmsearch.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmcache.html
O8 - Extra context menu item: Si&milar Pages - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmsimilar.html
O8 - Extra context menu item: Backward &Links - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmbacklinks.html
O8 - Extra context menu item: Translate into English - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmtrans.html
O9 - Extra button: RealGuide (HKLM)
O9 - Extra button: WeatherBug (HKCU)
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…s/yinst0401.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://active.macromedia.com/flash2/cabs/swflash.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2003120…all/xscan53.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/…8077.1460763889
O16 - DPF: {2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} (MiniBugTransporterX Class) - http://download.weatherbug.com/minibug/tri…Transporter.cab?
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
Post #4
No, it's still there. Did you bring up your task manager (ctrl, alt, delete) and end task on any of the funny random files before running the fix? This is important for the fix to work. If you didn't, try it again, if you did let me know and we'll try a different approach, MrC
Post #5
OK, I tried again. I know starting up was easier this time, but still having problems.



Logfile of HijackThis v1.97.7
Scan saved at 2:34:45 PM, on 6/11/04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\PROGRAM FILES\TV VIEWER\TVWAKEUP.EXE
C:\PROGRAM FILES\TV VIEWER\ANNCLIST.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAM FILES\NETROPA\ONE-TOUCH MULTIMEDIA KEYBOARD\KEYBDMGR.EXE
C:\PROGRAM FILES\NETROPA\ONE-TOUCH MULTIMEDIA KEYBOARD\MMUSBKB2.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\NAVAPW32.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\HPSYSDRV.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\WINDOWS\EXPLORER.EXE
C:\UNZIPPED\HIJACKTHIS[1]\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://kconline.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://kconline.com
O2 - BHO: My Search BHO - {014DA6C1-189F-421a-88CD-07CFE51CFF10} - C:\PROGRAM FILES\MYSEARCH\BAR\1.BIN\S4BAR.DLL
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: (no name) - {D537A3D0-8C07-4D62-953F-162207F5090D} - C:\WINDOWS\SYSTEM\regsvrac32.dll
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: My &Search Bar - {014DA6C9-189F-421a-88CD-07CFE51CFF10} - C:\PROGRAM FILES\MYSEARCH\BAR\1.BIN\S4BAR.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [Adaptec DirectCD] C:\Program Files\DirectCD\DIRECTCD.EXE
O4 - HKLM\..\Run: [Norton Auto-Protect] C:\PROGRA~1\NORTON~1\NAVAPW32.EXE /LOADQUIET
O4 - HKLM\..\Run: [Norton eMail Protect] C:\Program Files\Norton AntiVirus\POPROXY.EXE
O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] c:\windows\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [SpybotSnD] "C:\PROGRAM FILES\SPYBOT - SEARCH & DESTROY\SPYBOTSD.EXE" /autofix /autoclose
O4 - HKLM\..\Run: [HPScanPatch] C:\WINDOWS\SYSTEM\HPScanFix.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [stcinstaller] c:\installer\id53.exe
O4 - HKLM\..\Run: [Xex7x] C:\WINDOWS\TEMP\XEX7X.EXE
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
O4 - HKLM\..\RunServices: [Keyboard Manager] C:\Program Files\Netropa\One-touch Multimedia Keyboard\MMKeybd.exe
O4 - HKLM\..\RunServices: [TVWakeup] C:\Progra~1\TVView~1\tvwakeup.exe
O4 - HKLM\..\RunServices: [Announcements] C:\Program Files\TV Viewer\annclist.exe
O4 - HKLM\..\RunServices: [VidSvr]
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [Encompass_ENCMONTR] C:\Program Files\Easy Internet\ENCMONTR.EXE
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SPYSWEEPER.EXE" /1
O4 - HKCU\..\Run: [Taskbar Display Controls] RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY
O4 - HKCU\..\Run: [Weather] C:\PROGRAM FILES\AWS\WEATHERBUG\WEATHER.EXE 1
O4 - HKLM\..\RunOnce: [MARGO1C.EXE] C:\WINDOWS\MARGO1C.EXE
O4 - HKCU\..\RunOnce: [MARGO1C.EXE] C:\WINDOWS\MARGO1C.EXE
O4 - Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Google Search - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmsearch.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmcache.html
O8 - Extra context menu item: Si&milar Pages - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmsimilar.html
O8 - Extra context menu item: Backward &Links - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmbacklinks.html
O8 - Extra context menu item: Translate into English - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmtrans.html
O9 - Extra button: RealGuide (HKLM)
O9 - Extra button: WeatherBug (HKCU)
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…s/yinst0401.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://active.macromedia.com/flash2/cabs/swflash.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2003120…all/xscan53.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/…8077.1460763889
O16 - DPF: {2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} (MiniBugTransporterX Class) - http://download.weatherbug.com/minibug/tri…Transporter.cab?
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
Post #6
GOOD JOB !!! :thumbup: ;) You got the worst of it.

Now with just HJT running fix these:

O2 - BHO: My Search BHO - {014DA6C1-189F-421a-88CD-07CFE51CFF10} - C:\PROGRAM FILES\MYSEARCH\BAR\1.BIN\S4BAR.DLL

O2 - BHO: (no name) - {D537A3D0-8C07-4D62-953F-162207F5090D} - C:\WINDOWS\SYSTEM\regsvrac32.dll

O3 - Toolbar: My &Search Bar - {014DA6C9-189F-421a-88CD-07CFE51CFF10} - C:\PROGRAM FILES\MYSEARCH\BAR\1.BIN\S4BAR.DLL

O4 - HKLM\..\Run: [stcinstaller] c:\installer\id53.exe

O4 - HKLM\..\Run: [Xex7x] C:\WINDOWS\TEMP\XEX7X.EXE

O4 - HKLM\..\RunOnce: [MARGO1C.EXE] C:\WINDOWS\MARGO1C.EXE

O4 - HKCU\..\RunOnce: [MARGO1C.EXE] C:\WINDOWS\MARGO1C.EXE

Reboot into SafeMode and delete these files:
HowToShowHiddenFiles - if needed
Use ctrl, alt and delete to bring up your task manager and end task on any of these files if they are listed before you delete them.


c:\installer\id53.exe

c:\installer <–doesn't look like a valid Windows folder, if not delete folder

C:\WINDOWS\TEMP\XEX7X.EXE

C:\WINDOWS\MARGO1C.EXE

Reboot and post a fresh log. MrC
Post #7
I fixed those entries you advised. I then went to safe mode and to the hidden files but did not find any of the entries you mentioned that I might find there. Are there any more processes I need to fix/delete? Also before I forget, what would you recommend to keep this from happening again? I'm not sure how I even got the mess I had. I have Norton Antivirus 2001, but I know I need to update it soon. Thanks so much for your help!


Logfile of HijackThis v1.97.7
Scan saved at 10:55:18 PM, on 6/11/04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSGLOOP.EXE
C:\PROGRAM FILES\NETROPA\ONE-TOUCH MULTIMEDIA KEYBOARD\MMKEYBD.EXE
C:\WINDOWS\SYSTEM\MSG32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\PROGRAM FILES\TV VIEWER\TVWAKEUP.EXE
C:\PROGRAM FILES\TV VIEWER\ANNCLIST.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAM FILES\EASY INTERNET\ENCMONTR.EXE
C:\WINDOWS\EXPLORER.EXE
C:\PROGRAM FILES\NETROPA\ONE-TOUCH MULTIMEDIA KEYBOARD\KEYBDMGR.EXE
C:\PROGRAM FILES\NETROPA\ONSCREEN DISPLAY\OSD.EXE
C:\PROGRAM FILES\DIRECTCD\DIRECTCD.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\NAVAPW32.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\POPROXY.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\NETROPA\ONE-TOUCH MULTIMEDIA KEYBOARD\MMUSBKB2.EXE
C:\WINDOWS\SYSTEM\HPSYSDRV.EXE
C:\PROGRAM FILES\WEBROOT\SPY SWEEPER\SPYSWEEPER.EXE
C:\WINDOWS\RunDLL.exe
C:\PROGRAM FILES\AWS\WEATHERBUG\WEATHER.EXE
C:\PROGRAM FILES\WINZIP\WZQKPICK.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\UNZIPPED\HIJACKTHIS[1]\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://kconline.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://kconline.com
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [Adaptec DirectCD] C:\Program Files\DirectCD\DIRECTCD.EXE
O4 - HKLM\..\Run: [Norton Auto-Protect] C:\PROGRA~1\NORTON~1\NAVAPW32.EXE /LOADQUIET
O4 - HKLM\..\Run: [Norton eMail Protect] C:\Program Files\Norton AntiVirus\POPROXY.EXE
O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] c:\windows\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [SpybotSnD] "C:\PROGRAM FILES\SPYBOT - SEARCH & DESTROY\SPYBOTSD.EXE" /autofix /autoclose
O4 - HKLM\..\Run: [HPScanPatch] C:\WINDOWS\SYSTEM\HPScanFix.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
O4 - HKLM\..\RunServices: [Keyboard Manager] C:\Program Files\Netropa\One-touch Multimedia Keyboard\MMKeybd.exe
O4 - HKLM\..\RunServices: [TVWakeup] C:\Progra~1\TVView~1\tvwakeup.exe
O4 - HKLM\..\RunServices: [Announcements] C:\Program Files\TV Viewer\annclist.exe
O4 - HKLM\..\RunServices: [VidSvr]
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [Encompass_ENCMONTR] C:\Program Files\Easy Internet\ENCMONTR.EXE
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SPYSWEEPER.EXE" /1
O4 - HKCU\..\Run: [Taskbar Display Controls] RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY
O4 - HKCU\..\Run: [Weather] C:\PROGRAM FILES\AWS\WEATHERBUG\WEATHER.EXE 1
O4 - Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Google Search - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmsearch.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmcache.html
O8 - Extra context menu item: Si&milar Pages - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmsimilar.html
O8 - Extra context menu item: Backward &Links - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmbacklinks.html
O8 - Extra context menu item: Translate into English - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmtrans.html
O9 - Extra button: RealGuide (HKLM)
O9 - Extra button: WeatherBug (HKCU)
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…s/yinst0401.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://active.macromedia.com/flash2/cabs/swflash.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2003120…all/xscan53.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/…8077.1460763889
O16 - DPF: {2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} (MiniBugTransporterX Class) - http://download.weatherbug.com/minibug/tri…Transporter.cab?
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
Post #8
Looks Good!! :thumbup: You did a Good Job!! ;)

Some preventive maintenance:

Don't open e-mail attachments without first scanning them with an up-to-date
anti virus program, even after doing that I would be very careful. Don't click on any executables in e-mails or any other links that you're not sure of.
Watch your surfing habits, don't click on or download anything you're not sure of. Don't install a program that hasn't been recommended by a reputable organization.

Visit Windows Update and install all the lastest critical updates.

Install these two free programs, they sit in the backround and protect your system from spy and adware being installed on your system, also from your browser being hijacked. Check for updates weekly.

SpywareBlaster

SpywareGuard

Need a free anti virus?
AVG*free
(check for updates - daily)

How about a firewall?
ZoneAlarm*free
DirectDownload ZA 4.5.594.000 <—use this version for now

Free spyware removal programs:

SpyBot

AD-Aware


Good luck and thanks for using the forum - MrC
Post #9
Wow, Thanks for all your help! Everything seems to be running well! I am trying to learn more about antivirus, spyware, adware, firewalls, etc. I do have the Norton Antivirus 2001 and was able to finally use Spybot search and destroy last evening. Since, I couldn't get that to work the last couple of months, we put Spysweeper on our computer. I know I need to go and read through what those programs you mentioned to download for preventative measures are for and what they can do. One last question, do they all work together? I suppose some of them may do several functions like antivirus, firewall, etc. Thanks again, Mr. Charlie, for all your help and the time you spend to help others on this site!
Post #10
Thanks, yes they all work together.

Here's what I have on my machine.

AGV Free - anti virus program - keeps your system from being attacked by viruses, check for updates every day.

ZoneAlarm Free - Firewall - it's like the front door on your house, no one gets in or out with out your permission. For a computer - no program can access the internet with out your permission and no one can get into your computer from the internet. It also makes your computer invisible to others.

SpywareGuard and SpywareBlaster - Prevents spy/adware from being installed on your computer and also from it being hijacked.

SpyBot and Ad-Aware - Used to rid the system of spy/adware. Once the system is free of spy/adware, you'll find that you just have to run these once in a while.

Hope that answers your question. MrC
Post #12
Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI