HijackThis log - need to know what to do next

Question

surfperch1 0 Newbie Poster

22 Years Ago

I have a problem which most people seem to be having about IE not working and other programs in the Start menu (control panel, search,etc...) I downloaded the Hijackthis program and have the log created:

Logfile of HijackThis v1.97.7
Scan saved at 1:31:44 PM, on 4/8/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\Mixer.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\JOHN GILDEA\My Documents\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer =
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {BCF96FB4-5F1B-497B-AECC-910304A55011} - C:\WINDOWS\hhUU.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe /0
O4 - Startup: Event Reminder.lnk = C:\pmw\PMREMIND.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: TextBridge Instant Access.lnk = C:\Program Files\Plustek USA\Scanner\TBClass\Bin\TBMenu.exe
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) -
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) -
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -
O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) -

What should I do now? Thanks!

-Surfperch1

microsoft:windows-nt-2000-xp virus-malware

3 Contributors
8 Replies
258 Views
1 Day Discussion Span
Latest Post 22 Years Ago Latest Post by surfperch1

Dani AI

Generated 9 Months Ago

This thread is a typical example of a startup/proxy/BHO mix that can break Internet Explorer and some Start-menu items. was correct to point out that the KernelFaultCheck/dumprep entry is a Windows component and retracted the earlier identification; removed that entry before the confirmation and asked whether that will cause problems. The short practical guidance below covers verification, safe restoration, and cleanup steps that avoid guesswork.

First, verify suspicious items before removing them. Confirm anti‑spyware executables actually live under Program Files and carry a valid publisher signature before deleting their startup entries. Cross‑check unnamed BHOs or odd DLL filenames against reputable process/library lists and disable only after recording the original values. HijackThis makes backups of any items it fixes; prefer using its restore feature or System Restore rather than manual guessing.

If the crash‑helper run entry was removed, system stability is unlikely to be catastrophic, but restoring the prior state is simple. The safest recovery is a System Restore to a point before the change. If that is not available, restore from HijackThis backups or recreate the Run value under the HKLM Run key so it points to the dumprep executable in the system32 folder. Always export the affected registry branch and create a restore point before editing the registry.

Additional cleanup checklist: reset IE LAN/proxy settings if pages fail to load, scan with an up‑to‑date antivirus and anti‑spyware scanner (use a second opinion tool), boot to Safe Mode for removal if necessary, and make a full backup once the machine is clean. When in doubt about an entry, prefer restoring and investigating rather than deleting permanently; contributors such as are helpful at validating ambiguous items.

All 8 Replies

Tekmaven 258 Software Architect

22 Years Ago

Dump These:
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer =
O2 - BHO: (no name) - {BCF96FB4-5F1B-497B-AECC-910304A55011} - C:\WINDOWS\hhUU.dll
O4 - HKCU\..\Run: [SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe /0

crunchie 990 Most Valuable Poster

22 Years Ago

This one too
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

Did you pay for spysweeper?

Reply to this topic

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.

Tekmaven 258 Software Architect Team Colleague · Answer 1 · 2004-04-09T11:42:15+00:00

Again crunchie, you are wrong. Dumpprep is legit - its actually from Microsoft.

More information here: http://www.liutilities.com/products/wintaskspro/processlibrary/dumprep/

crunchie 990 Most Valuable Poster Team Colleague Featured Poster · Answer 2 · 2004-04-09T12:21:48+00:00

crunchie 990 Most Valuable Poster

22 Years Ago

Yep my mistake. Please ignore.

surfperch1 0 Newbie Poster · Answer 3 · 2004-04-09T22:46:43+00:00

Okay, thanks guys, but what if I deleted that mistake. I didn't know that it was until after a while and you posted that. Is something going to be wrong on the computer now?

Tekmaven 258 Software Architect Team Colleague · Answer 4 · 2004-04-10T00:18:40+00:00

Nah, you're safe on this one. My XP Pro installation doesn't have this in the startup.

If you're real paranoid, we could tell ya how to restore that one manually ;-).

surfperch1 0 Newbie Poster · Answer 5 · 2004-04-10T00:28:15+00:00

Okay, thanks. I'm not too paranoid if it's not going to harm anything. Another question to this though, is

O4 - HKCU\..\Run: [SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe /0

this the actual spysweeper program? Because if it is I don't want to get rid of it. But if I have to I will.

surfperch1 0 Newbie Poster · Answer 6 · 2004-04-10T00:31:43+00:00

btw, here is the new log without the deletion of the

O4 - HKCU\..\Run: [SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe /0

Logfile of HijackThis v1.97.7
Scan saved at 11:30:08 AM, on 4/9/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\Mixer.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\JOHN GILDEA\My Documents\HijackThis.exe
C:\WINDOWS\system32\NOTEPAD.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe /0
O4 - Startup: Event Reminder.lnk = C:\pmw\PMREMIND.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: TextBridge Instant Access.lnk = C:\Program Files\Plustek USA\Scanner\TBClass\Bin\TBMenu.exe
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) -
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) -
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -
O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) -

HijackThis log - need to know what to do next

Dani AI

Recommended Answers Collapse Answers

All 8 Replies

Recommended Answers