Member Avatar for shane'r69

Hi, I was wondering if someone could look at my hijackthis log and tell me what needs to be removed. I thank you in advance.

  • 3 Contributors
  • 10 Replies
  • 210 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by caperjack

Dani AI

Generated

Quick practical summary tied to the thread: the HijackThis log posted by looks like a typical Windows XP system with several third‑party autostart programs rather than an obvious show‑stopper malware entry. Slowness is more often caused by many background programs loading at startup than by a single registry key; correctly pointed out HJT is primarily an entry‑listing tool, not a full performance profiler.

Before you change anything: put HijackThis in its own folder (for example C:\HJT), use HJT’s Backups/Restore if you need to roll changes back, and create a System Restore point or full registry backup so you can recover quickly. Recent HJT builds do create a local backups folder, but keep a copy of important backups off the machine before you “fix” items. (qweas.com)

Safer ways to reduce startup load and check suspicious entries:

  • For quick tests, use the built‑in System Configuration utility (msconfig) to uncheck startup items, reboot, and evaluate impact.
  • For a thorough, safe view (BHOs, services, Winsock/LSPs, scheduled autostarts), use Autoruns from Sysinternals; it lets you disable entries (recommended) and jump to the file location to verify publisher/path before deleting.
  • Before removing anything, verify the file location and digital signature, run an updated full AV scan and an on‑demand scanner (Microsoft Safety Scanner or equivalent) to rule out hidden threats. (support.microsoft.com)

Minimal, low‑risk checklist to apply now:

  1. Create a restore point; 2) Move HijackThis to a permanent folder and copy its Backups to USB; 3) Disable nonessential autostart items via msconfig and test reboots; 4) If needed, use Autoruns to inspect BHOs and services before disabling; 5) Run full AV + an on‑demand scan, then Disk Cleanup and Defragment. If an entry looks unfamiliar or is missing a valid path/signature, pause and ask before deleting — accidental removals are the most common cause of follow‑up problems.

Recommended Answers

All 10 Replies

Member Avatar for DMR

Sure, we could. Um... but you would have to post it, first. :mrgreen:

Member Avatar for shane'r69

Sure, we could. Um... but you would have to post it, first. :mrgreen:

oops sorry about that. thanks.

Logfile of HijackThis v1.98.2
Scan saved at 12:32:57 PM, on 11/23/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\CTHELPER.EXE
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_Monitor.exe
C:\Program Files\Hewlett-Packard\PhotoSmart\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\Panda Software\Panda Antivirus Platinum\APVXDWIN.EXE
C:\Program Files\MSN Apps\Updater\01.02.3000.1001\en-ca\msnappau.exe
C:\PROGRA~1\HEWLET~1\PHOTOS~1\HPSHAR~1\hpgs2wnf.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\InterMute\SpySubtract\SpySub.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Panda Software\Panda Antivirus Platinum\Firewall\PavFires.exe
C:\Program Files\Panda Software\Panda Antivirus Platinum\pavsrv51.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Panda Software\Panda Antivirus Platinum\AVENGINE.EXE
C:\Program Files\Panda Software\Panda Antivirus Platinum\pavProxy.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
D:\My Received Files\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Zero Popup - {2EF37A01-884F-11d5-AC99-B112050ECB4F} - C:\PROGRA~1\ZEROPO~1\ZERO-P~1.DLL
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.02.3000.1002\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-ca\msntb.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-ca\msntb.dll
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [CXMon] "C:\Program Files\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_Monitor.exe"
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\PhotoSmart\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [SCANINICIO] "C:\Program Files\Panda Software\Panda Antivirus Platinum\Inicio.exe"
O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Software\Panda Antivirus Platinum\APVXDWIN.EXE" /s
O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\en-ca\msnappau.exe"
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\Symantec\LIVEUP~1\SNDMon.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: SpySubtract.lnk = C:\Program Files\InterMute\SpySubtract\SpySub.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) -
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
O16 - DPF: {6FDB0065-2787-11D6-B1D8-0001023916FC} (CLOActiveXInstaller Control) - http://www.igl.net/clo/install/CLOActiveXInstallerProj1.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) -
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) -

Member Avatar for DMR

1. Can you tell us what exact problems you are having? I don't see anything obviously "nasty" in your log.

2. You should move HijackThis into it's own separate folder. A folder like C:\HijackThis or C:\downloads\HijackThis will be fine.
HJT creates backup recovery files when it runs, and if you run it from your desktop folder , "My documents" folder, or some other such general folder (like "My Received Files", in your case) the backup files will be scattered all over the folder and possibly even accidentally deleted.

Member Avatar for shane'r69

my comp seemed slower so I was just wondering if I had something.

Member Avatar for DMR

There are many reasons aside from malicious infections for system slowdowns, but HJT isn't meant as a tool for diagnosing those sorts of general peformance issues. However, your log does show that you have a few programs set to automatically run when Windows starts, but not all of them necessarily need to be running all of the time. The choice is yours, but choosing not to have them auto-run should at least speed up your startup time a bit:

O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [CXMon] "C:\Program Files\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_Monitor.exe"
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\PhotoSmart\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE


Some routine cleanup never hurts either:

- Delete the contents of your Cookies, Temp, and Temporary Internet Files folders.

- Use the Add/Remove Programs control panel to uninstall any programs that you don't need or never use.

- Run scandisk and defrag.

Member Avatar for shane'r69

tthanks for the info man , I appreciate it.

Member Avatar for DMR

No problem... :)

Member Avatar for caperjack

1. Can you tell us what exact problems you are having? I don't see anything obviously "nasty" in your log.

2. You should move HijackThis into it's own separate folder. A folder like C:\HijackThis or C:\downloads\HijackThis will be fine.
HJT creates backup recovery files when it runs, and if you run it from your desktop folder , "My documents" folder, or some other such general folder (like "My Received Files", in your case) the backup files will be scattered all over the folder and possibly even accidentally deleted.

Actually the latest version of hijackthis will create a folder called Backups ,in the folder its ran from ,when you use it !.and then when you go to use the backup feature it will auto go to the backup folder and find the idem you want to put back . when you use it !
Still putting it in its own folder is a good suggestion ,just not the disaster it use to be if not in its own folder .

Member Avatar for DMR

Actually the latest version of hijackthis will create a folder called Backups ,in the folder its ran from

You're right, my bad- HJT does do that now... :o

I still agree with putting HJT in its own folder though, as the backup folder HJT creates is named just "backups"; a folder with such a non-descriptive name floating around loose in another folder could easily get chucked in the bin by mistake.

Member Avatar for caperjack

Good Point !:)

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.