|
|
|||||||||
|
|||||||||
| |||||||||
|
|
|
| |||||||||
![]() |
|
|
«
Previous Thread
|
Next Thread
»
|
Thread Tools | Search this Thread | Rate Thread | Display Modes |
|
|
|
Stop making mediocre tutorials.The best tutorials are video! Camtasia Studio makes it easy to create engaging, buzz-building screen videos at any size, in any popular format. Download the free trial!
|
|
#1
|
|||
|
|||
|
Ran Hijack This... What to delete?
I'm running XP Pro, and IE is closing immediately upon opening. I looked around the forum and found some posts about resetting the opening page to a dll file, but mine isn't even doing that. I double click IE and immediately get the dialog box saying it needs to be shut down.
Here's the Hijack This logfile: Logfile of HijackThis v1.97.7 Scan saved at 5:32:50 PM, on 6/3/2004 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\windows\System32\smss.exe C:\windows\system32\winlogon.exe C:\windows\system32\services.exe C:\windows\system32\lsass.exe C:\windows\system32\svchost.exe C:\windows\System32\svchost.exe C:\windows\System32\svchost.exe C:\windows\System32\P2P Networking\P2P Networking.exe C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe C:\HJT\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = URL R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Comcast R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm N3 - Netscape 7: user_pref("browser.startup.homepage", "http://www.hotmail.com"); (C:\Documents and Settings\Jenny\Application Data\Mozilla\Profiles\default\yktmseg1.slt\prefs.js) N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_02.src"); (C:\Documents and Settings\Jenny\Application Data\Mozilla\Profiles\default\yktmseg1.slt\prefs.js) O2 - BHO: (no name) - {000020DD-C72E-4113-AF77-DD56626C6C42} - (no file) O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: (no name) - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll O2 - BHO: . - {D34F08C5-4F18-477c-86CB-1A9BEECFE37B} - C:\Documents and Settings\Jenny\Application Data\winly\winly.dll O2 - BHO: ShowSearch module - {E2DDF680-9905-4dee-8C64-0A5DE7FE133C} - C:\Documents and Settings\Jenny\Application Data\syskb\apidb.dll O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll O4 - HKLM\..\Run: [SystemTray] SysTray.Exe O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto O4 - HKLM\..\Run: [P2P Networking] C:\windows\System32\P2P Networking\P2P Networking.exe /AUTOSTART O4 - HKLM\..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe -osboot O4 - HKLM\..\Run: [systune] C:\windows\System32\acespy\systune.exe O4 - HKLM\..\Run: [regsvc] C:\windows\System32\acespy\systune O4 - HKLM\..\Run: [Image] rundll32 C:\windows\javaue32.dll,Install O4 - HKLM\..\Run: [qwnwmsc] C:\windows\System32\hemwpa.exe O4 - HKLM\..\RunServices: [Windows API Structure] win.exe O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM95\aim.exe -cnetwait.odl O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [regsvc] C:\windows\System32\acespy\systune O4 - HKCU\..\RunServices: [Image] rundll32 C:\windows\javaue32.dll,Install O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\WebshotsTray.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE10\EXCEL.EXE/3000 O9 - Extra 'Tools' menuitem: MaxSpeed (HKLM) O9 - Extra button: ComcastHSI (HKLM) O9 - Extra button: Support (HKLM) O9 - Extra button: Help (HKLM) O9 - Extra button: AIM (HKLM) O9 - Extra button: Related (HKLM) O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM) O9 - Extra button: Yahoo! Messenger (HKLM) O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM) O9 - Extra button: Messenger (HKLM) O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM) O9 - Extra button: Help (HKCU) O9 - Extra button: Support (HKCU) O9 - Extra button: ComcastHSI (HKCU) O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O14 - IERESET.INF: START_PAGE_URL=http://www.comcast.net O16 - DPF: Yahoo! Graffiti - URL O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - URL O16 - DPF: {12398DD6-40AA-4C40-A4EC-A42CFC0DE797} (Installer Class) - URL O16 - DPF: {17D72920-7A15-11D4-921E-0080C8DA7A5E} (AimSp32 Class) - URL O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) - O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - URL O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - URL O16 - DPF: {B8E71371-F7F7-11D2-A2CE-0060B0FB9D0D} (CDToolCtrl Class) - URL O16 - DPF: {CC05BC12-2AA2-4AC7-AC81-0E40F83B1ADF} (Live365Player Class) - URL O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - URL O16 - DPF: {FF65677A-8977-48CA-916A-DFF81B037DF3} (WMService Class) - URL ---- This poor machine is in its death throes, I believe, but I have faith in the old girl yet. Thanks in advance for the help. ![]() |
|
#2
|
|||
|
|||
|
Here is how to read the hijackthis logfile .
Compare it with yours . http://homepage.ntlworld.com/dvk01uk/tutorial.htm http://www.spywareinfo.com/~merijn/htlogtutorial.html http://www.help2go.com/article153.html http://hjt.wizardsofwebsites.com/ http://www.spywareinfo.com/bhos/ http://www.spychecker.com/program/bholist.html http://www.spywareinfo.com/~merijn/htlogtutorial.html#r http://www.computercops.biz/postt6393.html http://www.google.com/search?q=spyware+list Beginners Guides: Browser Hijacking & How to Stop It http://www.pcstats.com/articleview.cfm?articleID=1579 |
![]() |
| Viewing: Dev Shed Forums > System Administration > Antivirus Protection > Ran Hijack This... What to delete? |
| Thread Tools | Search this Thread |
| Display Modes | Rate This Thread |
|
|
|
|