Please click the link below for your operating system to download the TSG SysInfo Utility. Click on "Save File" then double-click the file to run it. Copy and paste the report in your initial post. Windows 7 and later (downloads a file named tsginfo.exe) | Windows XP (downloads a file named SysInfo.exe)

missing shortcut?

2433 Views 33 Replies 3 Participants Last post by Flrman1, Apr 5, 2004

omghelp

Discussion Starter · Apr 4, 2004

When I reboot the pc it has many popups that say missing shortcut error.
some of these are:
meroz5.ink
01bunyeu.ink
dnxv34uz.ink

I looked this up, they are some kinda graphics file. I also found them in startup folder. So I deleted them, and when I reboot they are back.

Also when I hit control alt delete....they are in my task manager running?

I have Win ME, plz help if this is familiar problem!

Status: Not open for further replies.

21 - 34 of 34 Posts

omghelp

Discussion Starter · #21 · Apr 5, 2004

the ones that i searched for on c and found an app file, i deleted. they are now gone
but there are many that do not come up with an app file just shortcuts. and yes they are in the startup folder.

LONGHAIR

· #22 · Apr 5, 2004

Are these all still those .ink files?

If not what are they?

omghelp

Discussion Starter · #23 · Apr 5, 2004

yes....they say .ink at startup

omghelp

Discussion Starter · #24 · Apr 5, 2004

ok I have run a program called Stop sign threat scanner and it has found many many things....trojan flood, backdoor irc agent. and many other spyware threats. So I am going to attempt to format this hd. I have doen this once before and with success, so wish me luck. Think you very much for yur help Longhair. Much appreciated!
Also I am curious if copieing favorites to a diskette will infect the pc after a format? Since they are simply url adresses i am not sure?

omghelp

Discussion Starter · #25 · Apr 5, 2004

i am now trying to format, i ran fdisk and trying to delete primary partition it says....could not change partition because disk could not be locked??? help plz

LONGHAIR

· #26 · Apr 5, 2004

What Operating System are you trying to install?

You don't have to delete the partition, just format the one you have.
Be sure that you have everyting you need first.
Windows CD
Drivers for your hardware
back-ups of your data (user created) images, music files, etc.

Flrman1

· #27 · Apr 5, 2004

Hi omghelp

These files:

WGEWNA63
T2D3G05V
E79L74LK
MORZE5
OVEDKM3Z

They're from the Adtomi parasite. I have removal instructions for it, but first let's see your Hijack This log.

Please do this. Click here to download Hijack This. Click on the Hijackthis.exe.

Click the "Scan" button when the scan is finished the scan button will become "Save Log" click that and save the log.

Go to where you saved the log and click on "Edit > Select All" then click on "Edit > Copy" then Paste the log back here in a reply.

DO NOT have Hijack This fix anything yet. Most of what it finds will be harmless or even required. Someone here will be glad to advise you on what to fix.

*Note: When you download Hijack This Do Not download it to a temp folder or to the desktop. Create a permanent folder somewhere like in My Documents and name it Hijack This and put it in that folder.

Once we see your Hijack This log I'll post the removal instructions.

See less See more

Flrman1

· #28 · Apr 5, 2004

OOPS! I didn't see the part about you formating. You don't have to do that. We can help you get this thing cleaned up.

omghelp

Discussion Starter · #29 · Apr 5, 2004

ok here it is

Logfile of HijackThis v1.97.7
Scan saved at 11:01:51 PM, on 4/4/04
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v5.50 (5.50.4134.0100)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\R_SERVER.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\WINLOGIN.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\DDREGA.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\PROGRAM FILES\BARGAIN BUDDY\BIN2\BARGAINS.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\MY DOCUMENTS\HIJACK THIS\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.searchenhancement.com/searchbar/iev1.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.searchenhancement.com/nph-enhanced.cgi?affid=sesm&sstring=
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msnbc.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.searchenhancement.com/nph-enhanced.cgi?affid=sesm&sstring=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.searchenhancement.com/searchbar/iev1.html
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://search.searchenhancement.com/nph-enhanced.cgi?affid=sesm&sstring=
R3 - URLSearchHook: WebSearch Class - {9368D063-44BE-49B9-BD14-BB9663FD38FC} - C:\PROGRAM FILES\SCBAR\V2\SCBAR.DLL
O2 - BHO: (no name) - {6ACD11BD-4CA0-4283-A8D8-872B9BA289B6} - C:\PROGRAM FILES\ACCELERATION SOFTWARE\STOPSIGN\WEBCBROWSE.DLL
O2 - BHO: (no name) - {00000EF1-0786-4633-87C6-1AA7A44296DA} - C:\WINDOWS\SYSTEM\CALSDR.DLL
O2 - BHO: (no name) - {000020DD-C72E-4113-AF77-DD56626C6C42} - C:\WINDOWS\TWAINTEC.DLL
O2 - BHO: IE Agent - {00000000-0000-0000-0000-000000000221} - C:\PROGRA~1\LYCOS\IEAGENT\CSIE.DLL
O2 - BHO: (no name) - {B549456D-F5D0-4641-BCED-8648A0C13D83} - C:\WINDOWS\BrowserHelper.dll
O2 - BHO: (no name) - {000006B1-19B5-414A-849F-2A3C64AE6939} - C:\WINDOWS\BI.DLL
O2 - BHO: Url Catcher - {CE31A1F7-3D90-4874-8FBE-A5D97F8BC8F1} - C:\PROGRA~1\BARGAI~1\BIN2\APUC.DLL
O2 - BHO: (no name) - {00041A26-7033-432C-94C7-6371DE343822} - C:\PROGRAM FILES\SCBAR\V2\SCBAR.DLL
O2 - BHO: (no name) - {00000762-3965-4A1A-98CE-3D4BF457D4C8} - C:\PROGRAM FILES\LYCOS\SIDESEARCH\SIDESEARCH13218.DLL
O2 - BHO: (no name) - {0019C3E2-DD48-4A6D-ABCD-8D32436323D9} - C:\WINDOWS\BXXS5.DLL
O3 - Toolbar: @msdxmLC.dll,[email protected],&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [EnsoniqMixer] starter.exe
O4 - HKLM\..\Run: [WebScan] C:\PROGRAM FILES\ACCELERATION SOFTWARE\ANTI-VIRUS\DEFSCANGUI.EXE -k
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] c:\windows\taskmon.exe
O4 - HKLM\..\Run: [PCHealth] c:\windows\PCHealth\Support\PCHSchd.exe -s
O4 - HKLM\..\Run: [EanthologyApp] C:\PROGRA~1\COMMON~1\EACCEL~1\EANTHO~1.EXE /b Startup
O4 - HKLM\..\Run: [Windows Logon] WINLOGIN.EXE
O4 - HKLM\..\Run: [ClrSchLoader] \Progra~1\Lycos\IEagent\Loader.exe
O4 - HKLM\..\Run: [bxxs5] RunDLL32.EXE C:\WINDOWS\BXXS5.DLL,DllRun
O4 - HKLM\..\Run: [msbb] C:\WINDOWS\SYSTEM\MSBB.EXE
O4 - HKLM\..\Run: [Bargains] C:\Program Files\Bargain Buddy\bin2\bargains.exe
O4 - HKLM\..\Run: [duz] C:\WINDOWS\duz.exe
O4 - HKLM\..\Run: [DownloadWare] "C:\Program Files\DownloadWare\dw.exe" /H
O4 - HKLM\..\Run: [eanth_critical_update_alert] "C:\PROGRAM FILES\ACCELERATION SOFTWARE\SYSTEMPATCHER\SYS_ALERT.EXE" /Startup
O4 - HKLM\..\Run: [SearchEnhancement] "C:\PROGRAM FILES\SCBAR\V2\SCBAR.EXE" /U
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [DDREGA] C:\WINDOWS\SYSTEM\DDREGA.exe
O4 - HKLM\..\Run: [E43K2I69.EXE] C:\WINDOWS\E43K2I69.EXE /dk
O4 - HKLM\..\RunServices: [r_server] C:\WINDOWS\SYSTEM\R_SERVER.EXE /service
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKCU\..\Run: [E43K2I69.EXE] C:\WINDOWS\E43K2I69.EXE /dk
O4 - HKCU\..\RunOnce: [Windows Logon] WINLOGIN.EXE
O4 - Startup: YT3EUQLI.lnk = C:\WINDOWS\yt3euqli.exe
O4 - Startup: ONOMX60U.lnk = C:\WINDOWS\onomx60u.exe
O4 - Startup: M5WJHPMF.lnk = C:\WINDOWS\m5wjhpmf.exe
O4 - Startup: T0AAL52H.lnk = C:\WINDOWS\t0aal52h.exe
O4 - Startup: MORZE5.lnk = C:\WINDOWS\morze5.exe
O4 - Startup: 02XBIU4W.lnk = C:\WINDOWS\02xbiu4w.exe
O4 - Startup: FIHVXDPT.lnk = C:\WINDOWS\fihvxdpt.exe
O4 - Startup: 66U3H0QW.lnk = C:\WINDOWS\66u3h0qw.exe
O4 - Startup: QAQIFQCF.lnk = C:\WINDOWS\qaqifqcf.exe
O4 - Startup: DB3P63BX.lnk = C:\WINDOWS\db3p63bx.exe
O4 - Startup: E43K2I69.lnk = C:\WINDOWS\e43k2i69.exe
O4 - Global Startup: T0AAL52H.lnk = C:\WINDOWS\t0aal52h.exe
O4 - Global Startup: YT3EUQLI.lnk = C:\WINDOWS\yt3euqli.exe
O4 - Global Startup: ONOMX60U.lnk = C:\WINDOWS\onomx60u.exe
O4 - Global Startup: M5WJHPMF.lnk = C:\WINDOWS\m5wjhpmf.exe
O4 - Global Startup: MORZE5.lnk = C:\WINDOWS\morze5.exe
O4 - Global Startup: 02XBIU4W.lnk = C:\WINDOWS\02xbiu4w.exe
O4 - Global Startup: FIHVXDPT.lnk = C:\WINDOWS\fihvxdpt.exe
O4 - Global Startup: 66U3H0QW.lnk = C:\WINDOWS\66u3h0qw.exe
O4 - Global Startup: QAQIFQCF.lnk = C:\WINDOWS\qaqifqcf.exe
O4 - Global Startup: DB3P63BX.lnk = C:\WINDOWS\db3p63bx.exe
O4 - Global Startup: E43K2I69.lnk = C:\WINDOWS\e43k2i69.exe
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra 'Tools' menuitem: Block This Page (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: MSN Messenger Service (HKLM)
O9 - Extra button: Sidesearch (HKLM)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

See less See more

Flrman1

· #30 · Apr 5, 2004

To get rid of Adtomi run this script put together by Mosaic1:

Click here to download 9xAdtomi Cleanup.zip.

Unzip the files to a folder of your choice.

If you have a Script Blocking Program enabled, disable it first so the scripts may run.

Open the folder and Double Click Cleanup.bat

*NOTE: DO NOT Touch the VBS files. The bat file will run the scripts all by itself.

It will:

Remove the Adtomi Spyware files from the Windows Folder
Clean the Startup Folders
Create Backups of the Adtomi exe files it deletes and save them in this folder
Create a list of all oddly named files deleted from the Windows Folder
Uninstall the Browserhelper.dll browser plugin
Start HijackThis and give you directions on what to remove.

When you have finished please restart the computer.

Go to the folder that you extracted the Adtomi cleanup files to and find the Adtomi.txt file. Copy and paste the contents of that text file here along with a fresh Hijack This log.

See less See more

omghelp

Discussion Starter · #31 · Apr 5, 2004

well the script worked....I no longer have those missing shortcut errors.
Thank you very much for the intelligent help!

hopefully this parasite is gone.

Now one other thing.....I have already run Adaware to remove spyware....but there seems to be a \lot of popups and lag when trying to pull up browser.

Can you recomend anything better for removal?

these things are in my task manager:
DW
bargains
eanthology
defscangui
loader
starter
sys_alert
msbb and a couple others i beleive should be running.
if these dont belong....how do i remove?

Once again ty very much....good show!

See less See more

Flrman1

· #32 · Apr 5, 2004

You need to post another Hijack This log and the contents of the Adtomi.txt file per my previous instructions.

omghelp

Discussion Starter · #33 · Apr 5, 2004

This is the second log

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msnbc.com/
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {000020DD-C72E-4113-AF77-DD56626C6C42} - C:\WINDOWS\TWAINTEC.DLL
O2 - BHO: IE Agent - {00000000-0000-0000-0000-000000000221} - C:\PROGRA~1\LYCOS\IEAGENT\CSIE.DLL
O2 - BHO: (no name) - {0019C3E2-DD48-4A6D-ABCD-8D32436323D9} - C:\WINDOWS\BXXS5.DLL
O3 - Toolbar: @msdxmLC.dll,[email protected],&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [EnsoniqMixer] starter.exe
O4 - HKLM\..\Run: [WebScan] C:\PROGRAM FILES\ACCELERATION SOFTWARE\ANTI-VIRUS\DEFSCANGUI.EXE -k
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] c:\windows\taskmon.exe
O4 - HKLM\..\Run: [PCHealth] c:\windows\PCHealth\Support\PCHSchd.exe -s
O4 - HKLM\..\Run: [Windows Logon] WINLOGIN.EXE
O4 - HKLM\..\Run: [bxxs5] RunDLL32.EXE C:\WINDOWS\BXXS5.DLL,DllRun
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [W3DPROS] C:\WINDOWS\SYSTEM\W3DPROS.exe
O4 - HKLM\..\RunServices: [r_server] C:\WINDOWS\SYSTEM\R_SERVER.EXE /service
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKCU\..\RunOnce: [Windows Logon] WINLOGIN.EXE
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: MSN Messenger Service (HKLM)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: ppctlcab - http://www.pestscan.com/scanner/ppctlcab.cab
O16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} (PPSDKActiveXScanner.MainScreen) - http://www.pestscan.com/scanner/axscanner.cab

See less See more

Flrman1

· #34 · Apr 5, 2004

Sorry it tooke me so long to reply, but I had to work late.

You didn't post the full log. You cut off the top part. Please post it again and make sure you copy and paste all of it.

21 - 34 of 34 Posts

Status: Not open for further replies.