# Another Hijack This log to decode **URL:** \ **Category:** Factual Questions\ **Created:** [June 30, 2004, 4:46pm UTC](https://boards.straightdope.com/t/another-hijack-this-log-to-decode/252903 "2004-06-30T16:46:30Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Ike\_Witt](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/ike_witt/32/283_2.png) [@Ike\_Witt](https://boards.straightdope.com/u/Ike_Witt)\ **Post date:** [June 30, 2004, 4:46pm UTC](https://boards.straightdope.com/t/another-hijack-this-log-to-decode/252903/1 "2004-06-30T16:46:30Z")
I just ran HJT on a Win 98 machine that is bogged down to the poin that it is almost impossible to do anything on the machine. FTR, last night I removed 400+ objects from the machine with adaware. Both Spybot S&D and CWShredder found nothing. Thanks in advance for the assistance. 🙂 Logfile of HijackThis v1.97.7 Scan saved at 11:38:00 AM, on 6/30/04 Platform: Windows 98 SE (Win9x 4.10.2222A) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\SYSTEM\KERNEL32.DLL C:\WINDOWS\SYSTEM\MSGSRV32.EXE C:\WINDOWS\SYSTEM\MPREXE.EXE C:\WINDOWS\SYSTEM\MSTASK.EXE C:\WINDOWS\SYSTEM\SPOOL32.EXE C:\WINDOWS\SYSTEM\mmtask.tsk C:\WINDOWS\EXPLORER.EXE C:\WINDOWS\TASKMON.EXE C:\WINDOWS\SYSTEM\SYSTRAY.EXE C:\WINDOWS\LOADQM.EXE C:\WINDOWS\SYSTEM\QTTASK.EXE C:\WINDOWS\TEMP\TTAY9TZ.EXE C:\WINDOWS\SYSTEM\HPJETDSC.EXE C:\PROGRAM FILES\INTUIT\QUICKBOOKS PRO\COMPONENTS\QBAGENT\QBDAGENT2002.EXE C:\WINDOWS\SYSTEM\WMIEXE.EXE C:\WINDOWS\SYSTEM\DDHELP.EXE C:\WINDOWS\SYSTEM\STORERCP.EXE G:\ADAM\DOWNLOADA\HIJACK THIS\HIJACKTHIS.EXE R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R3 - URLSearchHook: (no name) - \_{707E6F76-9FFB-4920-A976-EA101271BC25} - (no file) R3 - URLSearchHook: (no name) - {707E6F76-9FFB-4920-A976-EA101271BC25} - (no file) O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O2 - BHO: (no name) - {C5183ABC-EB6E-4E05-B8C9-500A16B6CF94} - C:\PROGRAM FILES\SEP\SEP.DLL O2 - BHO: (no name) - {00000010-6F7D-442C-93E3-4A4827C2E4C8} - C:\WINDOWS\NEM219.DLL (file missing) O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX O3 - Toolbar: Band Class - {C5183ABC-EB6E-4E05-B8C9-500A16B6CF94} - C:\PROGRAM FILES\SEP\SEP.DLL O4 - HKLM…\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun O4 - HKLM…\Run: [TaskMonitor] C:\WINDOWS askmon.exe O4 - HKLM…\Run: [SystemTray] SysTray.Exe O4 - HKLM…\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM…\Run: [LoadQM] loadqm.exe O4 - HKLM…\Run: [mdac\_runonce] C:\WINDOWS\SYSTEM\runonce.exe O4 - HKLM…\Run: [QuickTime Task] “C:\WINDOWS\SYSTEM\QTTASK.EXE” -atboottime O4 - HKLM…\Run: [Ttay9tz.exe] C:\WINDOWS\TEMP\TTAY9TZ.EXE O4 - HKLM…\Run: [Dsi] C:\WINDOWS\SYSTEM\DP-HIM.EXE O4 - HKLM…\Run: [3AG5CB543YWTL2] C:\WINDOWS\SYSTEM\Kvw1.exe O4 - HKLM…\Run: [AutoLoaderpEot1ITjNJbM] “C:\WINDOWS\SYSTEM\VB4ACLEN.EXE” /PC=“AM.WILD” /HideUninstall O4 - HKLM…\Run: [pt7R36O] VB4ACLEN.EXE O4 - HKLM…\Run: [STORERCP] C:\WINDOWS\SYSTEM\STORERCP.exe O4 - HKLM…\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM…\RunServices: [SchedulingAgent] mstask.exe O4 - HKCU…\Run: [HP JetDiscovery] HPJETDSC.EXE O4 - HKCU…\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet O4 - HKLM…\RunOnce: [Ad-aware] “C:\PROGRAM FILES\LAVASOFT\AD-AWARE 6\AD-AWARE.EXE” “+b1” O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Startup: QuickBooks 2002 Delivery Agent.lnk = C:\Program Files\Intuit\QuickBooks Pro\Components\QBAgent\qbdagent2002.exe O4 - Startup: UPS Online PLD Reminder Utility.lnk = C:\Program Files\UPS\UOWS\PldReminder.exe O8 - Extra context menu item: Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm O8 - Extra context menu item: Yahoo! Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm O8 - Extra context menu item: &Google Search - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmsearch.html O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmcache.html O8 - Extra context menu item: Si&milar Pages - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmsimilar.html O8 - Extra context menu item: Backward &Links - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmbacklinks.html O8 - Extra context menu item: Translate into English - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmtrans.html O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll O12 - Plugin for .pdf: C:\PROGRA~1\INTERN~1\PLUGINS ppdf32.dll O12 - Plugin for .SWF: C:\PROGRAM FILES\NETSCAPE\COMMUNICATOR\PROGRAM\PLUGINS pswf32.dll O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - [http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab](http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab) O16 - DPF: Yahoo! Pyramids - [http://download.games.yahoo.com/games/clients/y/pyt1\_x.cab](http://download.games.yahoo.com/games/clients/y/pyt1_x.cab) O16 - DPF: Yahoo! Gin - [http://download.games.yahoo.com/games/clients/y/nt0\_x.cab](http://download.games.yahoo.com/games/clients/y/nt0_x.cab) O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - [http://download.yahoo.com/dl/installs/yinstc.cab](http://download.yahoo.com/dl/installs/yinstc.cab) O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - [http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?37893.4178587963](http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?37893.4178587963) O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - [http://www.installengine.com/engine/isetup.cab](http://www.installengine.com/engine/isetup.cab) O16 - DPF: {5D9E4B6D-CD17-4D85-99D4-6A52B394EC3B} (WSDownloader Control) - [Webshots - Wallpaper / Screen Savers](http://www.webshots.com/samplers/WSDownloader.ocx) O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} (Office Update Installation Engine) - [http://office.microsoft.com/officeupdate/content/opuc.cab](http://office.microsoft.com/officeupdate/content/opuc.cab) O16 - DPF: {33288993-5664-11D4-8B5B-00D0B73B3518} (ell Class) - [http://www.easports.com/downloads/games/common/ieell.cab](http://www.easports.com/downloads/games/common/ieell.cab) O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - [http://www.apple.com/qtactivex/qtplugin.cab](http://www.apple.com/qtactivex/qtplugin.cab) O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - [http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab](http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab) ---
**Author:** ![RealityChuck](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/realitychuck/32/195_2.png) [@RealityChuck](https://boards.straightdope.com/u/RealityChuck)\ **Post date:** [July 1, 2004, 2:38am UTC](https://boards.straightdope.com/t/another-hijack-this-log-to-decode/252903/2 "2004-07-01T02:38:14Z")
The first issue is the Peper trojan, which reinstalls itself. You need to download the cleaning tool; you can find one at [http://www.subratam.org/?page=removal](http://www.subratam.org/?page=removal) You need to have your computer connected to the Internet while it works. Once you’ve run the tool, restart the computer in safe mode: in Win98, you either press the F8 key while booting, or hold down CTRL, depending on the system. When the black screen displays, use the arrow keys to select “Safe Mode” and hit “Enter.” Once booted, run hijackthis again. Click on “Scan,” and put a check mark by the following: R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R3 - URLSearchHook: (no name) - \_{707E6F76-9FFB-4920-A976-EA101271BC25} - (no file) R3 - URLSearchHook: (no name) - {707E6F76-9FFB-4920-A976-EA101271BC25} - (no file) O2 - BHO: (no name) - {C5183ABC-EB6E-4E05-B8C9-500A16B6CF94} - C:\PROGRAM FILES\SEP\SEP.DLL O2 - BHO: (no name) - {00000010-6F7D-442C-93E3-4A4827C2E4C8} - C:\WINDOWS\NEM219.DLL (file missing) O3 - Toolbar: Band Class - {C5183ABC-EB6E-4E05-B8C9-500A16B6CF94} - C:\PROGRAM FILES\SEP\SEP.DLL O4 - HKLM…\Run: [Ttay9tz.exe] C:\WINDOWS\TEMP\TTAY9TZ.EXE O4 - HKLM…\Run: [Dsi] C:\WINDOWS\SYSTEM\DP-HIM.EXE O4 - HKLM…\Run: [3AG5CB543YWTL2] C:\WINDOWS\SYSTEM\Kvw1.exe **This is Peper. The tool may have already removed it**. O4 - HKLM…\Run: [AutoLoaderpEot1ITjNJbM] “C:\WINDOWS\SYSTEM\VB4ACLEN.EXE” /PC=“AM.WILD” /HideUninstall O4 - HKLM…\Run: [pt7R36O] VB4ACLEN.EXE O4 - HKLM…\Run: [STORERCP] C:\WINDOWS\SYSTEM\STORERCP.exe O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - [http://www.installengine.com/engine/isetup.cab](http://www.installengine.com/engine/isetup.cab) Click on “Fix Checked” and delete the items. Next, search for the following and, if found, delete: The entire “C:\PROGRAM FILES\SEP” folder TTAY9TZ.EXE DP-HIM.EXE Kvw1.exe VB4ACLEN.EXE STORERCP.exe Restart the computer in regular mode and test it out. ---
**Author:** ![Ike\_Witt](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/ike_witt/32/283_2.png) [@Ike\_Witt](https://boards.straightdope.com/u/Ike_Witt)\ **Post date:** [July 2, 2004, 7:31pm UTC](https://boards.straightdope.com/t/another-hijack-this-log-to-decode/252903/3 "2004-07-02T19:31:19Z")
I missed the reply for a few days. I actually thought that this had fallen off the end of the world. It was the Peper virus and I have now cleaned up the machine. It hums along as well as a 98 box can.