What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Hijackthis Log... Please Help! 4/10/05

3 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
:angry: I have some annoying spyware running around my comp and i sure could use some help with it… Someone please tell me what to delete out of this log. Any help will be greatly appreciated. Thx. RoboRick
p.s. One of the key ones i have probs with right now is bett.exe, super annoying, and also the owkkamhn. I believe these two are online poker spyware progs.

Logfile of HijackThis v1.99.1
Scan saved at 2:57:18 PM, on 4/10/2005
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\PROGRAM FILES\COMMON FILES\STOPZILLA!\SZSERVER.EXE
C:\WINDOWS\SYSTEM\DEVLDR16.EXE
C:\WINDOWS\EXPLORER.EXE
C:\PROGRAM FILES\STOPZILLA!\STOPZILLA.EXE
C:\PROGRAM FILES\WEBROOT\SPY SWEEPER\SPYSWEEPER.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\OWKKAMHN.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\WINDOWS\APPLICATION DATA\BETT.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\PROGRAMFILES\HIJACKTHIS\HIJACKTHIS.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.bellsouth.net
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://hometab.bellsouth.net/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by BellSouth
O2 - BHO: (no name) - {09F61E8E-D33B-8396-4E32-DC38713B92CD} - C:\WINDOWS\SYSTEM\CJGTKVYA.DLL
O2 - BHO: (no name) - {0DF61A8A-D33E-8093-4E37-D838713B92CD} - C:\WINDOWS\SYSTEM\CJGTKVYA.DLL
O2 - BHO: STOPzilla Browser Helper Object - {E3215F20-3212-11D6-9F8B-00D0B743919D} - C:\Program Files\STOPzilla!\SZIEBHO.dll
O4 - HKLM\..\Run: [STOPzilla] C:\PROGRAM FILES\STOPZILLA!\STOPZILLA.EXE /autostart
O4 - HKLM\..\Run: [devldr16.exe] C:\WINDOWS\SYSTEM\devldr16.exe
O4 - HKLM\..\RunServices: [szserver] "C:\PROGRAM FILES\COMMON FILES\STOPZILLA!\SZSERVER.EXE" szserver
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SPYSWEEPER.EXE" /0
O12 - Plugin for .pdf: C:\PROGRA~1\INTERN~1\PLUGINS\nppdf32.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.bellsouth.net
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/017a88a31aa350…ip/RdxIE601.cab
O16 - DPF: {8C875948-9C60-4381-9248-0DF180542D53} - http://installs.spamblockerutility.com/ins…ckerutility.cab

Please reply or email me, thx.
Post #2
Hello RoboRick, Welcome to TomCoyote forum. If you still need some help, I will see what I can do.

1) This item does not identify: C:\OWKKAMHN.EXE as such we call it a random named trojan. I will remove it unless you know it is good, if so pass over it.

2) C:\WINDOWS\APPLICATION DATA\BETT.EXE same as above, the little Google info available is in German.

3) Question: Is Stopzilla any good? I use the free Google Toolbar, I have the built in search and an excellant popup blocker, something to consider: http://toolbar.google.com/ Take a look and if you want me to clean out the Stopzilla let me know. If you consider other software, please hold all downloading until the log is clean. Thanks.

4) Open task Manager then under Procesces Tab hightlite and end process on:
C:\OWKKAMHN.EXE
C:\WINDOWS\APPLICATION DATA\BETT.EXE

5) Download CCleaner from this link: http://www.ccleaner.com/ Take the time to review the instructions on the download page so that when I ask you to run it you will know what you are doing.

6) Open Hijack this and choose "Do a system scan only" then check the box in front of these line items:

(careful, there are two of these, get them both)
O2 - BHO: (no name) - {09F61E8E-D33B-8396-4E32-DC38713B92CD} - C:\WINDOWS\SYSTEM\CJGTKVYA.DLL
O2 - BHO: (no name) - {0DF61A8A-D33E-8093-4E37-D838713B92CD} - C:\WINDOWS\SYSTEM\CJGTKVYA.DLL
(if you don't want this as your Startpage, check it)
O14 - IERESET.INF: START_PAGE_URL=http://www.bellsouth.net
(next is Netster, nasty ActiveX)
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/017a88a31aa350…ip/RdxIE601.cab
(does not identify)
O16 - DPF: {8C875948-9C60-4381-9248-0DF180542D53} - http://installs.spamblockerutility.com/ins…ckerutility.cab

Close all programs but HJT and all browser windows, then click on "Fix Checked"

SHOW HIDDEN FILES: Follow the instructions in the link to enable hidden files for your operating system.
You may wish to reverse this process if you have any concern about anyone getting into these hidden system files.
http://www.xtra.co.nz/help/0,,4155-1916458,00.html

RIGHT Click on Start then click on Explore. Locate and delete these items:

This is after you have checked and agree thay need to be removed:

C:\OWKKAMHN.EXE >>> file

C:\WINDOWS\APPLICATION DATA\BETT.EXE >>> file

Run CCleaner then restart the computer and post a new log in this same thread along with any feedback you have.

Thanks…pskelley
TomCoyote forum
Slyware Warrior

PURGE SYSTEM RESTORE
When you are completely finished with the removal procedure and are satisfied that the threat has been removed follow these instruction:
http://service1.symantec.com/SUPPORT/tsgen…src=sec_doc_nam
Post #3
pskelley,
I really appreciate your help and reply. I was beginning to wonder if anyone was going to even attempt helping me. I followed your instructions and the poker spyware (owkkamhn and bett.exe) are gone! Much thanks for that. Ccleaner cleaned a lot of things and freed up some space too. I had a windows icon popup in the system tray concerning an update. That is really the only thing new that should be in my hjt log. (kb891711.exe) Please inform of the status of this file, windows or virus, etc. I also (in accordance with your advice/opinion) took off stopzilla. I never really noticed it helping at all, i was just desperate and trying all spyware progs i could get my hands on. What were you saying about helping me remove it? I uninstalled it, but are there other areas i need to remove it from? Also, i plan on getting the google toolbar like u suggested. Let me know about this log and some of my other questions. Thanks again, Rick

Logfile of HijackThis v1.99.1
Scan saved at 6:19:15 PM, on 4/14/2005
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
C:\WINDOWS\SYSTEM\DEVLDR16.EXE
C:\WINDOWS\EXPLORER.EXE
C:\PROGRAM FILES\WEBROOT\SPY SWEEPER\SPYSWEEPER.EXE
C:\PROGRAMFILES\HIJACKTHIS\HIJACKTHIS.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.bellsouth.net
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://hometab.bellsouth.net/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by BellSouth
O4 - HKLM\..\Run: [devldr16.exe] C:\WINDOWS\SYSTEM\devldr16.exe
O4 - HKLM\..\RunServices: [KB891711] C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SPYSWEEPER.EXE" /0
O4 - HKCU\..\Run: [HijackThis startup scan] C:\PROGRAMFILES\HIJACKTHIS\HijackThis.exe /startupscan
O14 - IERESET.INF: START_PAGE_URL=http://www.bellsouth.net
Post #4

I really appreciate your help and reply. I was beginning to wonder if anyone was going to even attempt helping me.


Yeah, we are extremely busy here, the list for not receiving any attention starts at five days.
The item you ask about: C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
http://www.microsoft.com/technet/security/…n/MS05-002.mspx was put there by Microsoft and it is safe as you can read in the link. I also see Bell South here and there in the log, if you do not use or need that stuff you can use HJT to remove it. I was wondering about this:
O4 - HKCU\..\Run: [HijackThis startup scan] C:\PROGRAMFILES\HIJACKTHIS\HijackThis.exe /startupscan
I have never seen HJT like this before, were you running the Program when you created the log? You can reply if you wish, but you do not have much in the log at all and surely no malware. Here is some great information from Tony Klein, Texruss, ChrisRLG and Grinler to help you stay clean and safe online:
http://forums.net-integration.net/index.php?showtopic=3051
http://russelltexas.com/malware/allclear.htm
http://forum.malwareremoval.com/viewtopic.php?t=14
http://www.bleepingcomputer.com/forums/topict2520.html

As far as StopZilla sometimes the uninstaller will leave stuff that causes error messages, but your log looks clean of it.

Thanks…pskelley
TomCoyote forum
Slyware Warrior
If you get help here consider a donation:
http://tomcoyote.com/donate.php
If you are reading this information…thank a teacher, If you are reading it in English…thank a soldier.
Post #5
If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)
Include your post user name and detail why you need it reopened with a valid link to your post.
Any bad links or emails that are not from the original poster will be deleted without response.
Any emails without the subject "Reopen" will be deleted without being looked at.

If this is not your thread please start a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI