Member Avatar for tread
tread 0 Newbie Poster

Please review hjt log for PJ. Adaware, spywareblasterand spybot have been installed and run. Thanks guys for the great service.

Logfile of HijackThis v1.97.7
Scan saved at 9:13:37 AM, on 5/5/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\cisvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\Program Files\America Online 7.0\aoltray.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\cidaemon.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = http://localhost
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: America Online 7.0 Tray Icon.lnk = C:\Program Files\America Online 7.0\aoltray.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: Real.com (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) -

  • 1 Contributor
  • 0 Replies
  • 121 Views

Dani AI

Generated

Quick summary for : the scan you posted looks like a system with normal third‑party add‑ons and startup programs rather than an obvious active hijacker. Since anti‑spyware was already run, the sensible next steps are verification with updated scanners, careful research of any remaining unknown entries, and only removing items you can positively identify as malicious. Blind use of the HijackThis "Fix checked" button can break legitimate programs.

Practical checklist to follow before making changes:

  • Make a full backup or create a system restore point and export the registry.
  • Boot to Safe Mode with Networking and update all detection tools to the latest definitions.
  • Run a full antivirus scan plus at least one reputable second‑opinion scanner and a rootkit checker.
  • Save a fresh HijackThis log and compare it to the current one; flag entries that are unfamiliar and research them before removal.

How to research and act safely:

  • Look up unknown startup entries and browser add‑ons using trusted removal forums and databases; do not delete entries that match known hardware, antivirus, or manufacturer services.
  • Use an autorun viewer to get full file paths for startup items so you can confirm whether they live under Program Files or Windows system folders.
  • If you decide to remove an entry with HijackThis, remove one item at a time, reboot, and verify system/browser behavior. If anything breaks, restore from your backup or system restore point.

Final notes: update Windows to the latest service pack and security updates, remove unused software, and keep realtime protection enabled. If persistent redirection or spyware traces remain after the steps above, collect fresh logs and seek targeted help from a dedicated malware‑removal forum.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.