What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Morze1

4 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I am having trouble with morze1!!!!! I have run spybot and adaware and deleted the items it suggested. This is my log file from HJT. Can you advise me on what needs to be deleted. I need to cleanup my startup file!!! thanks alot






Logfile of HijackThis v1.97.7
Scan saved at 2:50:26 PM, on 4/3/04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\GWHOTKEY.EXE
C:\PROGRAM FILES\BROADJUMP\CLIENT FOUNDATION\CFD.EXE
C:\PROGRAM FILES\SUPPORT.COM\BIN\TGCMD.EXE
C:\WINDOWS\STARTER.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE
C:\PROGRAM FILES\REAL\REALPLAYER\REALPLAY.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\PROGRAM FILES\MSWORKS\CALENDAR\WKCALREM.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\HJT\HIJACKTHIS\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://charter.msn.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = C:\WINDOWS\system32\searchbar.html
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - c:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: IE Agent - {00000000-0000-0000-0000-000000000221} - C:\PROGRA~1\LYCOS\IEAGENT\CSIE.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - c:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [Multi-function Keyboard] GWHotKey.exe
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [tgcmd] "C:\Program Files\Support.com\bin\tgcmd.exe" /server /startmonitor /deaf
O4 - HKLM\..\Run: [EnsoniqMixer] starter.exe
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "c:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\realplay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [SSRunScript] "C:\Program Files\Support.com\Charter\bin\SSRunScript.exe" /script "C:\Program Files\Support.com\Charter\vbs\verifyconnection.vbs" /args //b startupdelay
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [BPPQW64I.EXE] C:\WINDOWS\BPPQW64I.EXE /dk
O4 - HKLM\..\RunServices: [ccEvtMgr] "c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"
O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - Startup: Microsoft Works Calendar Reminders.lnk = C:\Program Files\MSWorks\Calendar\WKCALREM.EXE
O4 - Startup: 09U0U94A.lnk = C:\WINDOWS\09u0u94a.exe
O4 - Startup: RWTGA5VD.lnk = C:\WINDOWS\rwtga5vd.exe
O4 - Startup: N17QRQTG.lnk = C:\WINDOWS\n17qrqtg.exe
O4 - Startup: 90AD8544.lnk = C:\WINDOWS\90ad8544.exe
O4 - Startup: 18TXQ0X3.lnk = C:\WINDOWS\18txq0x3.exe
O4 - Startup: BRUQGP4V.lnk = C:\WINDOWS\bruqgp4v.exe
O4 - Startup: 593LFIML.lnk = C:\WINDOWS\593lfiml.exe
O4 - Startup: MORZE1.lnk = C:\WINDOWS\morze1.exe
O4 - Startup: UP0BBTZJ.lnk = C:\WINDOWS\up0bbtzj.exe
O4 - Startup: M6DH0RHL.lnk = C:\WINDOWS\m6dh0rhl.exe
O4 - Startup: 6BQ0PHKH.lnk = C:\WINDOWS\6bq0phkh.exe
O4 - Startup: 0GKGOZQI.lnk = C:\WINDOWS\0gkgozqi.exe
O4 - Startup: YDKHUH2W.lnk = C:\WINDOWS\ydkhuh2w.exe
O4 - Startup: TPF82XYR.lnk = C:\WINDOWS\tpf82xyr.exe
O4 - Startup: PBMWWEVG.lnk = C:\WINDOWS\pbmwwevg.exe
O4 - Startup: A179CHE4.lnk = C:\WINDOWS\a179che4.exe
O4 - Startup: 0043O0Y6.lnk = C:\WINDOWS\0043o0y6.exe
O4 - Startup: AEG9M0B3.lnk = C:\WINDOWS\aeg9m0b3.exe
O4 - Startup: DKK3KLYY.lnk = C:\WINDOWS\dkk3klyy.exe
O4 - Startup: W6II0XQT.lnk = C:\WINDOWS\w6ii0xqt.exe
O4 - Startup: JENJPIZI.lnk = C:\WINDOWS\jenjpizi.exe
O4 - Startup: 5B79J3MK.lnk = C:\WINDOWS\5b79j3mk.exe
O4 - Startup: BPPQW64I.lnk = C:\WINDOWS\bppqw64i.exe
O4 - Global Startup: YG1RD4QW.lnk = C:\WINDOWS\yg1rd4qw.exe
O4 - Global Startup: MORZE1.lnk = C:\WINDOWS\morze1.exe
O4 - Global Startup: QTB10R04.lnk = C:\WINDOWS\qtb10r04.exe
O4 - Global Startup: BRUQGP4V.lnk = C:\WINDOWS\bruqgp4v.exe
O4 - Global Startup: 593LFIML.lnk = C:\WINDOWS\593lfiml.exe
O4 - Global Startup: UP0BBTZJ.lnk = C:\WINDOWS\up0bbtzj.exe
O4 - Global Startup: M6DH0RHL.lnk = C:\WINDOWS\m6dh0rhl.exe
O4 - Global Startup: 18TXQ0X3.lnk = C:\WINDOWS\18txq0x3.exe
O4 - Global Startup: 6BQ0PHKH.lnk = C:\WINDOWS\6bq0phkh.exe
O4 - Global Startup: 0GKGOZQI.lnk = C:\WINDOWS\0gkgozqi.exe
O4 - Global Startup: YDKHUH2W.lnk = C:\WINDOWS\ydkhuh2w.exe
O4 - Global Startup: TPF82XYR.lnk = C:\WINDOWS\tpf82xyr.exe
O4 - Global Startup: PBMWWEVG.lnk = C:\WINDOWS\pbmwwevg.exe
O4 - Global Startup: A179CHE4.lnk = C:\WINDOWS\a179che4.exe
O4 - Global Startup: 0043O0Y6.lnk = C:\WINDOWS\0043o0y6.exe
O4 - Global Startup: AEG9M0B3.lnk = C:\WINDOWS\aeg9m0b3.exe
O4 - Global Startup: DKK3KLYY.lnk = C:\WINDOWS\dkk3klyy.exe
O4 - Global Startup: W6II0XQT.lnk = C:\WINDOWS\w6ii0xqt.exe
O4 - Global Startup: JENJPIZI.lnk = C:\WINDOWS\jenjpizi.exe
O4 - Global Startup: 5B79J3MK.lnk = C:\WINDOWS\5b79j3mk.exe
O4 - Global Startup: BPPQW64I.lnk = C:\WINDOWS\bppqw64i.exe
O9 - Extra button: AIM (HKLM)
O12 - Plugin for .wav: C:\Program Files\Netscape\Communicator\Program\PLUGINS\npaudio.dll
O12 - Plugin for .swf: C:\Program Files\Netscape\Communicator\Program\PLUGINS\npswf32.dll
O12 - Plugin for .au: C:\Program Files\Netscape\Communicator\Program\PLUGINS\npaudio.dll
O12 - Plugin for .aif: C:\Program Files\Netscape\Communicator\Program\PLUGINS\npaudio.dll
O12 - Plugin for .aiff: C:\Program Files\Netscape\Communicator\Program\PLUGINS\npaudio.dll
O12 - Plugin for .avi: C:\Program Files\Netscape\Communicator\Program\PLUGINS\npavi32.dll
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwa…ector/swdir.cab
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/cha…v45/yacscom.cab
O16 - DPF: {F72A7B0E-0DD8-11D1-BD6E-00AA00B92AF1} (IE Active Setup Control) - http://www.microsoft.com/windows/ie/ie40/d…df/setupctl.cab
O16 - DPF: {C3EF17D6-2201-11D4-9F0E-00B0D011B1AE} (Communities.com Passport) - http://cartoonorbit.cartoonnetwork.com/orb…/ie/orbiter.cab
O16 - DPF: {BAA165DA-1DAF-4F18-9A28-E0D2D3937A1F} (Wrapper Class) - http://webevents.broadcast.com/wsp/VisionBrowser.CAB
O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} (Yahoo! Audio UI1) - http://chat.yahoo.com/cab/yacsui.cab
O16 - DPF: {22D6F312-B0F6-11D0-94AB-0080C74C7E95} (Windows Media Player) - http://activex.microsoft.com/activex/contr…en/nsmp2inf.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwa…ash/swflash.cab
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/…37942.693275463
O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/games/clients/y/potc_x.cab
O16 - DPF: {E504EE6E-47C6-11D5-B8AB-00D0B78F3D48} (Yahoo! Webcam Viewer Wrapper) - http://chat.yahoo.com/cab/yvwrctl.cab
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
Post #2 last edited
Hi dxlewis,

You appear to have Adtomi, which can be awkward to remove. :angry:

First, let's clean up some of the other entries - click http://www.lavasoftusa.com/support/download/ to download Ad-Aware and install. Before scanning click on "check for updates now" to make sure you have the latest reference file. Install any available updates, then click on the gear wheel icon at the top and check these options In selecting options, remember "GREEN=ON": The latest Referencel File should say "01R279 31.03.2004" or a higher number/later date.

General> activate these: "Automatically save log-file" and "Automatically quarantine objects prior to removal"

Scanning > activate these: "Scan within archives", "Scan active processes", "Scan registry", "Deep scan registry", "Scan my IE Favorites for banned sites" and "Scan my Hosts file"

Tweaks > Scanning Engine> activate this: "Unload recognized processes during scanning."

Tweaks > Cleaning Engine: activate these: "Automatically try to unregister objects prior to deletion" and "Let Windows remove files in use after reboot."

Click "Proceed" to save your settings, make sure "Activate in-depth scan" is ON (green) , and then click "Next" to scan your system. When the scan is finished, the screen will tell you if anything has been found; click "Next" and the bad files will be listed.

Right click on the pane and choose "Select all objects" (this will put a check mark in all boxes at the left side). Click "Next" again, and click "OK" at the prompt "(#) objects will be removed. Continue?". When it is finished, reboot your computer.

Restart and rescan with HJT, and post a new log here so we can move to the next stage.
Post #3 last edited
Reboot into safe mode by tapping F8 after the BIOS has loaded. Make sure that you have no browser windows open as this could prevent the fix from working properly. Open HijackThis, scan and when complete, remove the following entries by checking the box to the left and clicking 'fixed checked':

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = C:\WINDOWS\system32\searchbar.html
R3 - Default URLSearchHook is missing
O2 - BHO: IE Agent - {00000000-0000-0000-0000-000000000221} - C:\PROGRA~1\LYCOS\IEAGENT\CSIE.DLL
O4 - HKLM\..\Run: [BPPQW64I.EXE] C:\WINDOWS\BPPQW64I.EXE /dk
O4 - Startup: 09U0U94A.lnk = C:\WINDOWS\09u0u94a.exe
O4 - Startup: RWTGA5VD.lnk = C:\WINDOWS\rwtga5vd.exe
O4 - Startup: N17QRQTG.lnk = C:\WINDOWS\n17qrqtg.exe
O4 - Startup: 90AD8544.lnk = C:\WINDOWS\90ad8544.exe
O4 - Startup: 18TXQ0X3.lnk = C:\WINDOWS\18txq0x3.exe
O4 - Startup: BRUQGP4V.lnk = C:\WINDOWS\bruqgp4v.exe
O4 - Startup: 593LFIML.lnk = C:\WINDOWS\593lfiml.exe
O4 - Startup: MORZE1.lnk = C:\WINDOWS\morze1.exe
O4 - Startup: UP0BBTZJ.lnk = C:\WINDOWS\up0bbtzj.exe
O4 - Startup: M6DH0RHL.lnk = C:\WINDOWS\m6dh0rhl.exe
O4 - Startup: 6BQ0PHKH.lnk = C:\WINDOWS\6bq0phkh.exe
O4 - Startup: 0GKGOZQI.lnk = C:\WINDOWS\0gkgozqi.exe
O4 - Startup: YDKHUH2W.lnk = C:\WINDOWS\ydkhuh2w.exe
O4 - Startup: TPF82XYR.lnk = C:\WINDOWS\tpf82xyr.exe
O4 - Startup: PBMWWEVG.lnk = C:\WINDOWS\pbmwwevg.exe
O4 - Startup: A179CHE4.lnk = C:\WINDOWS\a179che4.exe
O4 - Startup: 0043O0Y6.lnk = C:\WINDOWS\0043o0y6.exe
O4 - Startup: AEG9M0B3.lnk = C:\WINDOWS\aeg9m0b3.exe
O4 - Startup: DKK3KLYY.lnk = C:\WINDOWS\dkk3klyy.exe
O4 - Startup: W6II0XQT.lnk = C:\WINDOWS\w6ii0xqt.exe
O4 - Startup: JENJPIZI.lnk = C:\WINDOWS\jenjpizi.exe
O4 - Startup: 5B79J3MK.lnk = C:\WINDOWS\5b79j3mk.exe
O4 - Startup: BPPQW64I.lnk = C:\WINDOWS\bppqw64i.exe
O4 - Global Startup: YG1RD4QW.lnk = C:\WINDOWS\yg1rd4qw.exe
O4 - Global Startup: MORZE1.lnk = C:\WINDOWS\morze1.exe
O4 - Global Startup: QTB10R04.lnk = C:\WINDOWS\qtb10r04.exe
O4 - Global Startup: BRUQGP4V.lnk = C:\WINDOWS\bruqgp4v.exe
O4 - Global Startup: 593LFIML.lnk = C:\WINDOWS\593lfiml.exe
O4 - Global Startup: UP0BBTZJ.lnk = C:\WINDOWS\up0bbtzj.exe
O4 - Global Startup: M6DH0RHL.lnk = C:\WINDOWS\m6dh0rhl.exe
O4 - Global Startup: 18TXQ0X3.lnk = C:\WINDOWS\18txq0x3.exe
O4 - Global Startup: 6BQ0PHKH.lnk = C:\WINDOWS\6bq0phkh.exe
O4 - Global Startup: 0GKGOZQI.lnk = C:\WINDOWS\0gkgozqi.exe
O4 - Global Startup: YDKHUH2W.lnk = C:\WINDOWS\ydkhuh2w.exe
O4 - Global Startup: TPF82XYR.lnk = C:\WINDOWS\tpf82xyr.exe
O4 - Global Startup: PBMWWEVG.lnk = C:\WINDOWS\pbmwwevg.exe
O4 - Global Startup: A179CHE4.lnk = C:\WINDOWS\a179che4.exe
O4 - Global Startup: 0043O0Y6.lnk = C:\WINDOWS\0043o0y6.exe
O4 - Global Startup: AEG9M0B3.lnk = C:\WINDOWS\aeg9m0b3.exe
O4 - Global Startup: DKK3KLYY.lnk = C:\WINDOWS\dkk3klyy.exe
O4 - Global Startup: W6II0XQT.lnk = C:\WINDOWS\w6ii0xqt.exe
O4 - Global Startup: JENJPIZI.lnk = C:\WINDOWS\jenjpizi.exe
O4 - Global Startup: 5B79J3MK.lnk = C:\WINDOWS\5b79j3mk.exe
O4 - Global Startup: BPPQW64I.lnk = C:\WINDOWS\bppqw64i.exe

Find and delete the following:

C:\WINDOWS\BPPQW64I.EXE
C:\WINDOWS\BrowserHelper.dll

Reboot back into normal mode, rescan with HJT and post a new log here for a final check over.
Post #4
This is my most recent log file from my problems with Atomi. Please help me get rid of this aggravation

Logfile of HijackThis v1.97.7
Scan saved at 8:50:33 PM, on 4/3/04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\EXPLORER.EXE
C:\PROGRAM FILES\BROADJUMP\CLIENT FOUNDATION\CFD.EXE
C:\PROGRAM FILES\SUPPORT.COM\BIN\TGCMD.EXE
C:\WINDOWS\STARTER.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE
C:\PROGRAM FILES\REAL\REALPLAYER\REALPLAY.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\PROGRAM FILES\MSWORKS\CALENDAR\WKCALREM.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\80M1K2K4.EXE
C:\HJT\HIJACKTHIS\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://charter.msn.com/
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - c:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {B549456D-F5D0-4641-BCED-8648A0C13D83} - C:\WINDOWS\BrowserHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - c:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [tgcmd] "C:\Program Files\Support.com\bin\tgcmd.exe" /server /startmonitor /deaf
O4 - HKLM\..\Run: [EnsoniqMixer] starter.exe
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "c:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\realplay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [SSRunScript] "C:\Program Files\Support.com\Charter\bin\SSRunScript.exe" /script "C:\Program Files\Support.com\Charter\vbs\verifyconnection.vbs" /args //b startupdelay
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [80M1K2K4.EXE] C:\WINDOWS\80M1K2K4.EXE /dk
O4 - HKLM\..\RunServices: [ccEvtMgr] "c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"
O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKCU\..\Run: [80M1K2K4.EXE] C:\WINDOWS\80M1K2K4.EXE /dk
O4 - Startup: Microsoft Works Calendar Reminders.lnk = C:\Program Files\MSWorks\Calendar\WKCALREM.EXE
O4 - Startup: 80M1K2K4.lnk = C:\WINDOWS\80m1k2k4.exe
O4 - Global Startup: 80M1K2K4.lnk = C:\WINDOWS\80m1k2k4.exe
O9 - Extra button: AIM (HKLM)
O12 - Plugin for .wav: C:\Program Files\Netscape\Communicator\Program\PLUGINS\npaudio.dll
O12 - Plugin for .swf: C:\Program Files\Netscape\Communicator\Program\PLUGINS\npswf32.dll
O12 - Plugin for .au: C:\Program Files\Netscape\Communicator\Program\PLUGINS\npaudio.dll
O12 - Plugin for .aif: C:\Program Files\Netscape\Communicator\Program\PLUGINS\npaudio.dll
O12 - Plugin for .aiff: C:\Program Files\Netscape\Communicator\Program\PLUGINS\npaudio.dll
O12 - Plugin for .avi: C:\Program Files\Netscape\Communicator\Program\PLUGINS\npavi32.dll
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwa…ector/swdir.cab
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/cha…v45/yacscom.cab
O16 - DPF: {F72A7B0E-0DD8-11D1-BD6E-00AA00B92AF1} (IE Active Setup Control) - http://www.microsoft.com/windows/ie/ie40/d…df/setupctl.cab
O16 - DPF: {C3EF17D6-2201-11D4-9F0E-00B0D011B1AE} (Communities.com Passport) - http://cartoonorbit.cartoonnetwork.com/orb…/ie/orbiter.cab
O16 - DPF: {BAA165DA-1DAF-4F18-9A28-E0D2D3937A1F} (Wrapper Class) - http://webevents.broadcast.com/wsp/VisionBrowser.CAB
O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} (Yahoo! Audio UI1) - http://chat.yahoo.com/cab/yacsui.cab
O16 - DPF: {22D6F312-B0F6-11D0-94AB-0080C74C7E95} (Windows Media Player) - http://activex.microsoft.com/activex/contr…en/nsmp2inf.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwa…ash/swflash.cab
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/…37942.693275463
O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/games/clients/y/potc_x.cab
O16 - DPF: {E504EE6E-47C6-11D5-B8AB-00D0B78F3D48} (Yahoo! Webcam Viewer Wrapper) - http://chat.yahoo.com/cab/yvwrctl.cab
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
Post #5
Yes it's still there. Try this, copy the contents of the quote box to Notepad. Save as Remove.reg (Save as type: 'all files'). Reboot into Safe Mode by tapping F8 after the BIOS has loaded. Doubleclick Remove.reg and answer Yes when prompted to add its contents to the Registry:

REGEDIT4

[-HKEY_CURRENT_USER\Software\adtomi]

[-HKEY_CLASSES_ROOT\CLSID\{B549456D-F5D0-4641-BCED-8648A0C13D83}]

[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{B549456D-F5D0-4641-BCED-8648A0C13D83}]


Then open HijackThis, scan and when complete, remove the following entries by checking the box to the left and clicking 'fixed checked':

O2 - BHO: (no name) - {B549456D-F5D0-4641-BCED-8648A0C13D83} - C:\WINDOWS\BrowserHelper.dll
O4 - HKLM\..\Run: [80M1K2K4.EXE] C:\WINDOWS\80M1K2K4.EXE /dk
O4 - HKCU\..\Run: [80M1K2K4.EXE] C:\WINDOWS\80M1K2K4.EXE /dk
O4 - Startup: 80M1K2K4.lnk = C:\WINDOWS\80m1k2k4.exe
O4 - Global Startup: 80M1K2K4.lnk = C:\WINDOWS\80m1k2k4.exe

Using Explorer, find and delete the following:

C:\WINDOWS\BrowserHelper.dll
C:\WINDOWS\80M1K2K4.EXE

Reboot back into Normal Mode when done, rescan with HJT and post a new log.
Post #6
After running the file "remove.reg" and thendoing the scan with Hijackthis, the items you wanted me to delete after the scan weren't in the scan results. I did delete the 2 files from the "windows" directory and this is my new HJT scan log. If I am now repaired how in the world did I get this. Thanks alot!!!!!!!!!!!!!!

Logfile of HijackThis v1.97.7
Scan saved at 10:08:24 AM, on 4/4/04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\EXPLORER.EXE
C:\PROGRAM FILES\BROADJUMP\CLIENT FOUNDATION\CFD.EXE
C:\PROGRAM FILES\SUPPORT.COM\BIN\TGCMD.EXE
C:\WINDOWS\STARTER.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE
C:\PROGRAM FILES\REAL\REALPLAYER\REALPLAY.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\PROGRAM FILES\MSWORKS\CALENDAR\WKCALREM.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\HJT\HIJACKTHIS\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://charter.msn.com/
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - c:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - c:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [tgcmd] "C:\Program Files\Support.com\bin\tgcmd.exe" /server /startmonitor /deaf
O4 - HKLM\..\Run: [EnsoniqMixer] starter.exe
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "c:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\realplay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [SSRunScript] "C:\Program Files\Support.com\Charter\bin\SSRunScript.exe" /script "C:\Program Files\Support.com\Charter\vbs\verifyconnection.vbs" /args //b startupdelay
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\RunServices: [ccEvtMgr] "c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"
O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - Startup: Microsoft Works Calendar Reminders.lnk = C:\Program Files\MSWorks\Calendar\WKCALREM.EXE
O9 - Extra button: AIM (HKLM)
O12 - Plugin for .wav: C:\Program Files\Netscape\Communicator\Program\PLUGINS\npaudio.dll
O12 - Plugin for .swf: C:\Program Files\Netscape\Communicator\Program\PLUGINS\npswf32.dll
O12 - Plugin for .au: C:\Program Files\Netscape\Communicator\Program\PLUGINS\npaudio.dll
O12 - Plugin for .aif: C:\Program Files\Netscape\Communicator\Program\PLUGINS\npaudio.dll
O12 - Plugin for .aiff: C:\Program Files\Netscape\Communicator\Program\PLUGINS\npaudio.dll
O12 - Plugin for .avi: C:\Program Files\Netscape\Communicator\Program\PLUGINS\npavi32.dll
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwa…ector/swdir.cab
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/cha…v45/yacscom.cab
O16 - DPF: {F72A7B0E-0DD8-11D1-BD6E-00AA00B92AF1} (IE Active Setup Control) - http://www.microsoft.com/windows/ie/ie40/d…df/setupctl.cab
O16 - DPF: {C3EF17D6-2201-11D4-9F0E-00B0D011B1AE} (Communities.com Passport) - http://cartoonorbit.cartoonnetwork.com/orb…/ie/orbiter.cab
O16 - DPF: {BAA165DA-1DAF-4F18-9A28-E0D2D3937A1F} (Wrapper Class) - http://webevents.broadcast.com/wsp/VisionBrowser.CAB
O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} (Yahoo! Audio UI1) - http://chat.yahoo.com/cab/yacsui.cab
O16 - DPF: {22D6F312-B0F6-11D0-94AB-0080C74C7E95} (Windows Media Player) - http://activex.microsoft.com/activex/contr…en/nsmp2inf.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwa…ash/swflash.cab
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/…37942.693275463
O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/games/clients/y/potc_x.cab
O16 - DPF: {E504EE6E-47C6-11D5-B8AB-00D0B78F3D48} (Yahoo! Webcam Viewer Wrapper) - http://chat.yahoo.com/cab/yvwrctl.cab
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
Post #7
That looks OK now - well done :D To help keep you clean follow the recommendations in Tony's article here:

So how did I get infected in the first place?

In particular, click here to make sure that you have the latest Critical Update patches for Windows. It's very important to keep your system up to date to avoid unnecessary security risks.


As this problem has been resolved the topic will be closed. If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)

The subject of the email must be "Reopen". Include your post username and details about why you need it reopened, with a valid link to your post.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI