1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

Could you please look at my Hijackthis log.

Discussion in 'Virus & Other Malware Removal' started by suegee855, Apr 10, 2004.

Thread Status:
Not open for further replies.
  1. suegee855

    suegee855 Thread Starter

    Apr 10, 2004
    I am running Windows 98. I started running a program to fix my registry and have had problems when starting. It's always looking for and can't find certain files. These files change everytime I start up. I run AdAware and Spyhunter.
    and still can't get rid of these problems. Here is my Hijackthis log.
    Logfile of HijackThis v1.97.7
    Scan saved at 10:09:48 AM, on 4/10/04
    Platform: Windows 98 SE (Win9x 4.10.2222A)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL = http://www.jetseeker.com/ie/
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Cox High Speed Internet
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
    R3 - Default URLSearchHook is missing
    O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN2\YCOMP5_3_11_0.DLL
    O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - C:\PROGRAM FILES\MYWAY\MYBAR\1.BIN\MYBAR.DLL
    O2 - BHO: (no name) - {6BAB14FC-BD1B-5A7A-B1DF-9EF0EAF11A2A} - C:\windows\system\yahhwhft.dll
    O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
    O2 - BHO: IE Agent - {00000000-0000-0000-0000-000000000221} - C:\PROGRA~1\LYCOS\IEAGENT\CSIE.DLL
    O2 - BHO: (no name) - {B549456D-F5D0-4641-BCED-8648A0C13D83} - C:\WINDOWS\BrowserHelper.dll
    O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN2\YCOMP5_3_11_0.DLL
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
    O3 - Toolbar: &SearchBar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - C:\PROGRAM FILES\MYWAY\MYBAR\1.BIN\MYBAR.DLL
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
    O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
    O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
    O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
    O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
    O4 - HKLM\..\Run: [Atikey] Atitask.exe
    O4 - HKLM\..\Run: [AtiCwd32] Aticwd32.exe
    O4 - HKLM\..\Run: [AtiQiPcl] AtiQiPcl.exe
    O4 - HKLM\..\Run: [POINTER] point32.exe
    O4 - HKLM\..\Run: [EnsoniqMixer] starter.exe
    O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
    O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
    O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
    O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
    O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
    O4 - HKLM\..\Run: [LoadQM] loadqm.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
    O4 - HKLM\..\Run: [ukuncncf] C:\WINDOWS\ldnhvarf.exe
    O4 - HKLM\..\Run: [] c:\WINDOWS\System\
    O4 - HKLM\..\Run: [mdac_runonce] C:\WINDOWS\SYSTEM\runonce.exe
    O4 - HKLM\..\Run: [systray] C:\WINDOWS\SYSTEM\A.EXE
    O4 - HKLM\..\Run: [SpyHunter] C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter.exe
    O4 - HKLM\..\Run: [EnigmaPopupStop] C:\Program Files\Enigma Software Group\SpyHunter\PopupBlocker\EnigmaPopupStop.exe
    O4 - HKLM\..\Run: [J5J8U61O.EXE] C:\WINDOWS\J5J8U61O.EXE /dk
    O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
    O4 - HKCU\..\Run: [] c:\WINDOWS\System\
    O4 - HKCU\..\Run: [J5J8U61O.EXE] C:\WINDOWS\J5J8U61O.EXE /dk
    O4 - Startup: J5J8U61O.lnk = C:\WINDOWS\j5j8u61o.exe
    O4 - Startup: PowerReg Scheduler.exe
    O4 - Startup: PowerReg SchedulerV2.exe
    O4 - Startup: 8BH66DRN.lnk = C:\WINDOWS\8bh66drn.exe
    O4 - Startup: YZ57UE2U.lnk = C:\WINDOWS\yz57ue2u.exe
    O4 - Startup: KD0URKGC.lnk = C:\WINDOWS\kd0urkgc.exe
    O4 - Startup: 3DJYWGCH.lnk = C:\WINDOWS\3djywgch.exe
    O4 - Startup: 2E9HWDLF.lnk = C:\WINDOWS\2e9hwdlf.exe
    O4 - Startup: NQF2K1C9.lnk = C:\WINDOWS\nqf2k1c9.exe
    O4 - Global Startup: J5J8U61O.lnk = C:\WINDOWS\j5j8u61o.exe
    O4 - Global Startup: 8BH66DRN.lnk = C:\WINDOWS\8bh66drn.exe
    O4 - Global Startup: YZ57UE2U.lnk = C:\WINDOWS\yz57ue2u.exe
    O4 - Global Startup: 3DJYWGCH.lnk = C:\WINDOWS\3djywgch.exe
    O4 - Global Startup: KD0URKGC.lnk = C:\WINDOWS\kd0urkgc.exe
    O4 - Global Startup: 2E9HWDLF.lnk = C:\WINDOWS\2e9hwdlf.exe
    O4 - Global Startup: NQF2K1C9.lnk = C:\WINDOWS\nqf2k1c9.exe
    O8 - Extra context menu item: &Google Search - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmsearch.html
    O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmcache.html
    O8 - Extra context menu item: Si&milar Pages - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmsimilar.html
    O8 - Extra context menu item: Backward &Links - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmbacklinks.html
    O8 - Extra context menu item: Translate into English - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmtrans.html
    O9 - Extra button: AIM (HKLM)
    O9 - Extra button: Wallpaper (HKLM)
    O9 - Extra 'Tools' menuitem: &Toolbar Wallpaper (HKLM)
    O12 - Plugin for .mid: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin2.dll
    O12 - Plugin for .wav: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin.dll
    O12 - Plugin for .au: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin2.dll
    O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
    O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
    O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} (Yahoo! Companion) - http://us.dl1.yimg.com/download.yahoo.com/dl/toolbar/yiebio5_1_3_0.cab
    O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52...pple.com/borris/us/win/QuickTimeInstaller.exe
    O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?37884.6045601852
  2. Flrman1


    Jul 26, 2002
    Hi suegee855

    Welcome to TSG! :)

    You have been infected by the Adtomi parasite.

    Click here to download 9xAdtomi Cleanup.zip.

    Unzip the files to a folder of your choice.

    Now see if there is an Adtomi or yahoo stocks icon in your system tray , it might be a red ?? and if so right click and select remove , you must be online for this part

    --A web page from Adtomi would appear "-uninstall was succesful!".

    *Note: Not all infections have this icon, so if you don't have it just proceed with the rest.

    Now go offline before proceeding with the rest of these instructions.

    If you have a Script Blocking Program enabled, disable it first so the scripts may run.

    Next press CTRL+ ALT+DEL to bring up task manager, look in applications for this file LDNHVARF.EXE and End Task on it. Open Task Manager again and make sure it is gone.
    If it isn't listed in the applications, then look in processes tab.

    Close all open windows, open the Adtomi cleanup folder and Double Click Cleanup.bat then close the Adtomi cleanup folder while the cleanup.bat file runs.

    *NOTE: DO NOT Touch the VBS files. The bat file will run the scripts all by itself.

    It will:

    Remove the Adtomi Spyware files from the Windows Folder
    Clean the Startup Folders
    Create Backups of the Adtomi exe files it deletes and save them in this folder
    Create a list of all oddly named files deleted from the Windows Folder
    Uninstall the Browserhelper.dll browser plugin
    Start HijackThis and give you directions on what to remove.

    When you have finished please restart the computer.

    Go to the folder that you extracted the Adtomi cleanup files to and find the Adtomi.txt file. Copy and paste the contents of that text file here along with a fresh Hijack This log.
  3. Flrman1


    Jul 26, 2002
    I edited my post. Please read again before proceeding.
  4. suegee855

    suegee855 Thread Starter

    Apr 10, 2004
    When I press ctrl+alt+del I get...explorer L7lwlq2m loadqm point32 stimon systray ldnhvarf loader. The 2nd and last one change everytime I start my computer. When I start my computer J5J8U61O.EXE comes up looking for missing shortcut. When I cancel that another one comes up and another and another all different. After I cancel all of them I get An Error has Occured etc...Ignore or Close.
    I click close and I get the Illigal operation in DDEML.DLL. Now when I try to bring up Outlook Express for my mail it tells me It can't be started because MSOE.DLL could not be loaded.
    When I ran the Cleanup.bat file it said batch not found.
    If you could help again I'd appreciate it. I'm apparently doing the wrong thing here.
As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/219004

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice