Member Avatar for dragonlogic

Steam

:sad:
Please give me some advice. I downloaded hijackthis and the log is pasted below:

Logfile of HijackThis v1.97.7

Scan saved at 1:28:00 PM, on 2/2/2004

Platform: Windows XP (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\netdde.exe

C:\WINDOWS\system32\CRYPSERV.EXE

C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe

C:\Program Files\FactorySuite\Common\NTServApp.exe

C:\Program Files\CIMPLICITY Machine Edition\fxControl\Runtime\NT\FxControl.exe

C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\Program Files\FactorySuite\Common\slssvc.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\CIMPLICITY Machine Edition\Common\Components\NT\trapiserver.exe

C:\Program Files\FactorySuite\Common\wwlogsvc.exe

C:\Program Files\FactorySuite\Common\wwnetdde.exe

C:\WINDOWS\Explorer.EXE

C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe

C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe

C:\Program Files\QuickTime\qttask.exe

C:\Program Files\Common Files\Real\Update_OB\realsched.exe

C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fppdis2a.exe

C:\WINDOWS\System32\rundll32.exe

C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE

C:\Program Files\MSN Messenger\MsnMsgr.Exe

C:\Program Files\Hewlett-Packard\AiO\hp psc 700 series\Bin\hpobrt07.exe

C:\PROGRA~1\HEWLET~1\HPSHAR~1\hpgs2wnf.exe

C:\PROGRA~1\HEWLET~1\AiO\Shared\Bin\hpoevm07.exe

C:\Program Files\Hewlett-Packard\AiO\Shared\bin\hpOSTS07.exe

C:\Program Files\Messenger\msmsgs.exe

C:\Documents and Settings\Shaun Derise.ECI_ENGRS\My Documents\Downloads\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://mshp.dll/sp.html#37049

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://mshp.dll/index.html#37049

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://mshp.dll/sp.html#37049

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://mshp.dll/index.html#37049

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://mshp.dll/sp.html#37049

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {2E9CAFF6-30C7-4208-8807-E79D4EC6F806} - C:\Program Files\Submit\submithook.dll

O2 - BHO: . - {587DBF2D-9145-4c9e-92C2-1F953DA73773} - C:\Documents and Settings\Administrator\Application Data\sysmn\sysmn32.dll

O2 - BHO: (no name) - {FD9BC004-8331-4457-B830-4759FF704C22} - C:\Documents and Settings\Administrator\Application Data\sysmn\msiesh.dll

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe

O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook

O4 - HKCU\..\Run: [pdfFactory Pro Dispatcher v2] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fppdis2a.exe

O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"

O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background

O4 - Global Startup: HPAiODevice(hp psc 700 series) - 1.lnk = C:\Program Files\Hewlett-Packard\AiO\hp psc 700 series\Bin\hpobrt07.exe

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000

O9 - Extra button: Create Mobile Favorite (HKLM)

O9 - Extra 'Tools' menuitem: Create Mobile Favorite... (HKLM)

O9 - Extra button: Related (HKLM)

O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)

O9 - Extra button: Messenger (HKLM)

O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)

O12 - Plugin for .mid: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin2.dll

O12 - Plugin for .wav: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll

O16 - DPF: {03F998B2-0E00-11D3-A498-00104B6EB52E} (MetaStreamCtl Class) -

O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) -

O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

Please tell me what I should fix.

Thanks

  • 2 Contributors
  • 1 Reply
  • 192 Views
  • 8 Hours Discussion Span
  • Latest Post Latest Post by caperjack

Dani AI

Generated

The HijackThis log posted by shows Internet Explorer being forced to load a local DLL as the Start/Search page and several Browser Helper Objects that live under an Application Data path. That pattern is a classic persistent IE‑hijacker (res:// DLL homepages / CoolWebSearch family) rather than a simple homepage preference — the offending DLL is used as a persistence mechanism so the setting returns after ordinary resets. (spywareremove.com)

Immediate priorities are: protect data, stop reinfection, then scan. Export or back up important files (bookmarks, documents), disconnect the PC from the network, and boot into Safe Mode before attempting removals. Run up‑to‑date antimalware scans (current reputable scanners and Microsoft’s tools) rather than relying only on manual registry edits; HijackThis is useful but should be used cautiously and only after removal tools have had a chance to remove the backing files (removing registry entries while the file remains can hide the problem). (microsoft.com)

A practical cleanup sequence that works for these variants: (1) Safe Mode scan with a modern antimalware tool; (2) run an offline / second‑opinion scanner if available; (3) if a CoolWebSearch‑type infection is identified, use a removal tool targeted at that family or trusted manual removal steps, then rerun scans; (4) finally use HijackThis to remove the leftover Start/Search (res://...) and BHO entries that point to Application Data, and delete the associated files (turn off System Restore on XP while deleting). If the infection persists or you’re unsure which entries to fix, collecting the log and asking an experienced remover is safer than “fix all.” (bleepingcomputer.com)

After cleanup: reset IE to defaults and clear temporary files, install all available security updates, and change important passwords from a known‑clean device. If credential theft is a concern or symptoms recur, reimaging the system is the most reliable way to guarantee eradication. ’s suggestion to start with anti‑spyware scans points in the right direction — prefer actively maintained, up‑to‑date tools and proceed in the safe order above. (microsoft.com)

Member Avatar for caperjack

run adaware and spybot{,links in my signature },if you haven't allready .and post back a new hijack log .

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.