Member Avatar for annna

Hello, :cry:
Internet been terribly slow lately, I have run all anti virus/adwares/ online scans I could, and so far nothing has been found. I have just run hijackthis, does anyone see anything strange in the log? Maybe it has something to do with svchost processes? (all those issr.exe, lass.exe etc?)

Id appreciate any suggestion or advice, I dont know much about computers, and this is really driving me crazy!!!!!!!! Thank you guys! ;) Anna


Heres the log:

Logfile of HijackThis v1.97.7
Scan saved at 11:25:05 PM, on 3/25/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Norton Personal Firewall\NISUM.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\Microsoft Hardware\Keyboard\type32.exe
C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE
C:\Program Files\Tweak-XP Pro 3\AdBlocker.exe
C:\Program Files\Norton Personal Firewall\ccPxySvc.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Yahoo!\Messenger\YPager.exe
C:\Documents and Settings\Bananit\My Documents\HijackThis.exe
C:\Program Files\Messenger\msmsgs.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.uol.com.br
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.harim.co.il
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [IntelliType] "C:\Program Files\Microsoft Hardware\Keyboard\type32.exe"
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE
O4 - HKLM\..\Run: [LogitechGalleryRepair] C:\Program Files\Logitech\ImageStudio\ISStart.exe
O4 - HKLM\..\Run: [LogitechImageStudioTray] C:\Program Files\Logitech\ImageStudio\LogiTray.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~2\AdvTools\ADVCHK.EXE
O4 - HKCU\..\Run: [BlockAds] "C:\Program Files\Tweak-XP Pro 3\AdBlocker.exe"
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: Yahoo! Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinst0401.cab
O16 - DPF: {556DDE35-E955-11D0-A707-000000521957} - http://www.xblock.com/download/xclean_micro.exe
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) -
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) -
O16 - DPF: {A8658086-E6AC-4957-BC8E-7D54A7E8A78D} (DoomCln Object) -
O16 - DPF: {C3DFA998-A486-11D4-AA25-00C04F72DAEB} (MSN Photo Upload Tool) -
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{EE5A8E1A-27D4-4E8C-AF2C-097A4166BF72}: NameServer =
:-|

  • 2 Contributors
  • 1 Reply
  • 234 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by BountyX

Dani AI

Generated

The HijackThis output posted by doesn't show an obvious, classic browser hijacker or an obvious autorun backdoor — most entries look like common third‑party services and security utilities. Multiple instances of svchost.exe are normal on Windows; name variants such as “issr.exe” or “lass.exe” are often typos or look‑alikes of the legitimate lsass.exe — only an lsass.exe that runs from the Windows\System32 folder should be trusted. ’s idea to watch outbound connections is exactly the right direction: slow Internet can be caused by background traffic, bad DNS, or a misbehaving process rather than a visible “virus” entry in HijackThis.

Practical, ordered checks that narrow the cause quickly: isolate the problem (test the same site from another machine or in Safe Mode with Networking) to decide between PC versus ISP/router; compare the system’s DNS/hosts values with what the ISP/router should be serving and reset them if they don’t match; perform a controlled clean‑boot to disable nonessential autostarts (IMs, update schedulers, toolbars/ad blockers) and note whether throughput improves.

When looking for a culprit, map network activity to process names and file paths (use a connection‑to‑process viewer) and verify any suspect executable’s full path and signature — legitimate system files belong in the System32 folder. Heavy outbound connections from a process located in Temp or a user profile are a red flag; scan such files with an up‑to‑date on‑demand scanner or an offline rescue scanner.

Final cautions: don’t delete startup entries or registry keys without a backup or restore point. If DNS/hosts were changed without authorization, reset the router and change its admin password. If the machine is running unpatched XP (SP1), treat it as higher risk and prefer offline/isolated diagnosis or a patched environment for removal steps.

Member Avatar for BountyX

get a firewall or some sort of network utility. close all programs (block all that shouldn't have access) and watch ur network connection closley for activity. if there is activity quickly go to comand prompt type netstat and see where the established connection resides.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.