What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Hijack log

16 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
Ken545, Ran HJT & removed E:\WINNT\system32\jtlo0733e.dll. When I tried to delete it in WINNT, I couldn't. Re-booted in Safemode but couldn't find it. Re-booted normally & looked for it but it's gone. Still getting pop-ups also. mozo11
Post #18
Ken545,

New log file:
Logfile of HijackThis v1.99.1
Scan saved at 4:59:23 PM, on 7/7/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
E:\WINNT\System32\smss.exe
E:\WINNT\system32\winlogon.exe
E:\WINNT\system32\services.exe
E:\WINNT\system32\lsass.exe
E:\WINNT\system32\Ati2evxx.exe
E:\WINNT\system32\svchost.exe
E:\WINNT\System32\svchost.exe
E:\WINNT\system32\spoolsv.exe
E:\PROGRA~1\Iomega\System32\AppServices.exe
E:\Program Files\Network Associates\Common Framework\FrameworkService.exe
E:\Program Files\Network Associates\VirusScan\Mcshield.exe
E:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
E:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
E:\WINNT\system32\regsvc.exe
E:\WINNT\system32\MSTask.exe
E:\WINNT\system32\stisvc.exe
E:\WINNT\System32\WBEM\WinMgmt.exe
E:\WINNT\System32\mspmspsv.exe
E:\WINNT\system32\svchost.exe
C:\Program Files\Intel\Intel® Active Monitor\imonnt.exe
E:\WINNT\system32\rundll32.exe
E:\WINNT\Explorer.EXE
E:\Program Files\Analog Devices\SoundMAX\Smtray.exe
C:\Program Files\Intel\Intel® Active Monitor\imontray.exe
E:\WINNT\system32\atiptaxx.exe
E:\WINNT\system32\desk95.exe
C:\Program Files\ahead\InCD\InCD.exe
E:\WINNT\system32\NWTRAY.EXE
E:\PROGRA~1\DATACA~1\FLashKsk.exe
C:\Program Files\Iomega\DriveIcons\ImgIcon.exe
E:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
E:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
E:\Program Files\QuickTime\qttask.exe
E:\Program Files\ATI Technologies\ATI.ACE\cli.exe
E:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
E:\Program Files\Winamp\winampa.exe
E:\WINNT\system32\ctfmon.exe
E:\Program Files\Spyware Doctor\swdoctor.exe
E:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
C:\Program Files\WinZip\WZQKPICK.EXE
E:\Program Files\Internet Explorer\IEXPLORE.EXE
E:\Program Files\Outlook Express\msimn.exe
E:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\HIJACKTHIS\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = \\10.0.0.101:8080
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - E:\WINNT\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - e:\program files\google\googletoolbar1.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - E:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_1.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [Smapp] E:\Program Files\Analog Devices\SoundMAX\Smtray.exe
O4 - HKLM\..\Run: [DrvListnr] E:\Program Files\Analog Devices\SoundMAX\DrvListnr.exe
O4 - HKLM\..\Run: [IMONTRAY] C:\Program Files\Intel\Intel® Active Monitor\imontray.exe
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [HydarVisionDesktopManager] desk95.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [ZENRC Tray Icon] zentray.exe
O4 - HKLM\..\Run: [NWTRAY] NWTRAY.EXE
O4 - HKLM\..\Run: [DataCaching] E:\PROGRA~1\DATACA~1\FLashKsk.exe
O4 - HKLM\..\Run: [Iomega Drive Icons] C:\Program Files\Iomega\DriveIcons\ImgIcon.exe
O4 - HKLM\..\Run: [Deskup] C:\Program Files\Iomega\DriveIcons\deskup.exe /IMGSTART
O4 - HKLM\..\Run: [ShStatEXE] "E:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "E:\Program Files\Network Associates\Common Framework\UpdaterUI.exe"
O4 - HKLM\..\Run: [QuickTime Task] "E:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ATICCC] "E:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKLM\..\Run: [RemoteControl] "E:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [WinampAgent] E:\Program Files\Winamp\winampa.exe
O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
O4 - HKCU\..\Run: [SpySweeper] E:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe /0
O4 - HKCU\..\Run: [PhotoShow Deluxe Media Manager] E:\PROGRA~1\SIMPLE~1\PHOTOS~1\data\Xtras\mssysmgr.exe
O4 - HKCU\..\Run: [Spyware Doctor] "E:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - Global Startup: ATI CATALYST System Tray.lnk = E:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: MonacoGamma.lnk = E:\Program Files\Monaco Systems\MonacoOPTIX 2.0\MonacoGamma.exe
O4 - Global Startup: MonacoReminder.lnk = E:\Program Files\Monaco Systems\MonacoOPTIX 2.0\Monaco Reminder.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Google Search - res://e:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://e:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://e:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Open Client to Monitor &1 - E:\WINNT\web\AOpenClient.htm
O8 - Extra context menu item: Open Client to Monitor &2 - E:\WINNT\web\AOpenClient.htm
O8 - Extra context menu item: Similar Pages - res://e:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://e:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\WINNT\system32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\WINNT\system32\msjava.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - E:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - E:\Program Files\Yahoo!\Messenger\yhexbmes0411.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - E:\Program Files\Yahoo!\Messenger\yhexbmes0411.dll
O12 - Plugin for .pdf: E:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O15 - Trusted Zone: http://music.yahoo.com
O15 - Trusted Zone: http://radio.music.yahoo.com
O16 - DPF: {C68F9105-04FD-4B48-B6CC-2A076F711C35} (HpodPCFileCtrl2 Class) - file://J:\MEMDISC\ALBUM_A\VIEW\PLUGIN\HPODPCFC.CAB
O16 - DPF: {CC05BC12-2AA2-4AC7-AC81-0E40F83B1ADF} (Live365Player Class) - http://www.live365.com/players/play365.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{C4EA0007-E7F0-423E-9911-D3D9DB30F531}: NameServer = 216.136.33.82,216.54.204.186,204.215.250.150
O20 - Winlogon Notify: Installer - E:\WINNT\system32\ir4ul5h91.dll
O23 - Service: .fdw16xcrs - - (no file)
O23 - Service: Adobe LM Service - Unknown owner - E:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - E:\WINNT\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - E:\WINNT\system32\ati2sgag.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - E:\WINNT\System32\dmadmin.exe
O23 - Service: Intel® Active Monitor (imonNT) - Intel Corp. - C:\Program Files\Intel\Intel® Active Monitor\imonnt.exe
O23 - Service: Iomega App Services - Iomega Corporation - E:\PROGRA~1\Iomega\System32\AppServices.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - E:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - E:\Program Files\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - E:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: Remote management (Novell WUser Agent) - Novell, Inc. - E:\NOVELL\ZENRC\wuser32.exe
O23 - Service: WUOLservice (WUOLService) - Novell, Inc. - E:\NOVELL\ZENRC\WUOLService.exe

mozo11
Post #19
Back at ya mozo11,

This goes a little deeper than I first thought, this is what we need to do.

Download Pocket Killbox to your desktop but don't run anything yet.
http://www.downloads.subratam.org/KillBox.exe

Now you have both SpySweeper and Spyware Doctor both running on your system, we need to disable both programs

To disable SpySweeper:

* Open it click >Options over to the left then >program options >Uncheck "load at windows startup".
* Over to the left click "shields" and uncheck all there.
* Uncheck "home page shield".
* Uncheck 'automaticly restore default without notifiction".

Spyware Doctor, right click in system tray to disable, I am not familiar with this program so open it and look under options to stop it from loading on startup.


* Go to Start->Run and type in regedit and hit OK.
* Go to File->Export and save the registry to ( your desktop) as a backup.
* After that's done, go to:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\App Management]

Find the entry key (on the right pane) for both jtlo0733e.dll. and ir4ul5h91.dll. Click on each one and delete it.
Close Regedit.

* Run KillBox now.
* Click on the 'Replace on Reboot' button and check these both underneath it.
* Check 'End Explorer Shell While Killing File.'
* Check 'Unregister .dll Before Deleting' for each file if it's available

Copy and paste each of the following (one by one) into the top line and hit the red X
button for each one, when it asks you if you want to reboot, click NO until the last file has been entered and then click yes.

E:\WINNT\system32\jtlo0733e.dll
E:\WINNT\system32\ir4ul5h91.dll

* When finished exit Killbox and restart your PC.

Now run HJT SCAN ONLY and remove these entries if still present.

* O20 - Winlogon Notify: Installer - E:\WINNT\system32\ir4ul5h91.dll
* O20 - Winlogon Notify: URL - E:\WINNT\system32\jtlo0733e.dll
* O23 - Service: .fdw16xcrs - - (no file)

Now download and run CleanUp
http://www.stevengould.org/software/cleanup/

When your done, post a new log please.
Post #20
Ken545, I couldn't find spysweeper, only an uninstall. Disabled Spydoctor. When I opened the registry, got to the Notify folder & opened that but App Management folder wasn't there. The next folder available was Installer.Stopped at that point. mozo11
Post #21
mozo11,

Just go on to the next step using Killbox as I laid out in my previous post.


Then Download this program L2MFix from either of the links below to your desktop. Start the program L2MFix choosing Option 4 Merge WinLogon Notify defaults.
That will reset the Notify Key to its defaults.

http://www.atribune.org/downloads/l2mfix.exe
http://www.downloads.subratam.org/l2mfix.exe

Then post a new log when your done.

Ken :D
Post #22
Ken545, 'Unregister .dll Before Deleting' is not coming up as an option. Also, for the destination, should I use Dummy? and in the bottom right box, (System Process) correct?
Post #23
Disregard this line if it grayed out Check 'Unregister .dll Before Deleting' for each file if it's available No to Dummy file Yes to System Process Ken :D
Post #25
No problem, slack day at work today :D

Are you doing this correctly…You need to copy and paste each file one at a time into the top box…the whole path…Not just the file. E:\WINNT\system32\jtlo0733e.dll , then set it up like below and hit the red X, when it asks you if you want to reboot, say no and then enter the second file E:\WINNT\system32\ir4ul5h91.dll . You need to enter the entire path, not just the file, it has to know where to look for that file. After entering the second file and hitting the red x, when it askes you to reboot, say yes


* Run KillBox now.
* Click on the 'Replace on Reboot' button and check these both underneath it.
* Check 'End Explorer Shell While Killing File.'
* Check 'Unregister .dll Before Deleting' for each file if it's available
* Yes to System Process
* No to Dummy File

Copy and paste each of the following (one by one) into the top line and hit the red X
button for each one, when it asks you if you want to reboot, click NO until the last file has been entered and then click yes.

E:\WINNT\system32\jtlo0733e.dll
E:\WINNT\system32\ir4ul5h91.dll

* When finished exit Killbox and restart your PC.
Post #26
Ken545, I could have sworn I was doing it correctly but after the 4th try, it went through. Not sure what I was doing the other times. Re-booted. I actually just noticed that since I came in this morning, I haven't seen a single pop-up. Then I realized that our computer tech guy was here last night and there is a new version of Macafee installed. Not sure if that solved the problem but so far so good. Is there anything else I need to do at this point? mozo11
Post #27
mozo11,

Go ahead and Download this program L2MFix from either of the links below to your desktop. Start the program L2MFix choosing Option 4 Merge WinLogon Notify defaults.
That will reset the Notify Key to its defaults.

http://www.atribune.org/downloads/l2mfix.exe
http://www.downloads.subratam.org/l2mfix.exe

Then post a new log when your done, outside of this issue you log looks ok. If I don't find anything else on it, I would like to direct you to install some free programs to keep all this garbage from being installed.

Ken :D
Post #28
Ken545, Couldn't find a way to run L2mfix. Inside folder is: regfixes, fixautont.html, l2mfix.bat, locate.com, Ntrights.exe, Process.exe, readme.txt, Reboot.exe, RegDACL.exe, second.bat, strings.exe, zip.exe. mozo11
Post #29 last edited
Sorry for the lack of info, I have logs swimming in my head. :D

Click on this…l2mfix.bat

Then select Option 4 and hit enter.

Ken
Post #30
Ken545, Sorry, but I guess I'm not following you. I clicked on l2mfix.bat and it highlights but nothing else. Maybe I'm not understanding what Option 4 is. Double clicking brings up a DOS prompt. mozo11

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI