HJT file, please help

Status
Not open for further replies.
I can't edit my registry, I can't install certain programs, and I can't sleep! Somebody please read my log file and let me know what to do.
 
Welcome to TS.

Please follow the 8-step malware removal guide , when you are able.

Scan with HJT. Tick & fix the following
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
Please note that many Administrators at offices lock this down on purpose so having HijackThis fix this may be a breach of corporate policy. If you are the Administrator and it has been enabled without your permission, then have HijackThis fix it.


F2 - REG:system.ini: Shell=Explorer.exe "C:\WINDOWS\server.exe"
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,"C:\WINDOWS\server.exe",

Duplicate entries found in HJT. Tick duplicates , as well

O4 - HKLM\..\Run: [xsjfn83jkemfofght] C:\DOCUME~1\Teresa\LOCALS~1\Temp\winlogin.exe
O4 - HKLM\..\Run: [rs32net] C:\WINDOWS\System32\rs32net.exe
O4 - HKLM\..\Run: [xsjfn83jkemfofght] C:\DOCUME~1\Teresa\LOCALS~1\Temp\winlogin.exe
O4 - HKLM\..\Run: [rs32net] C:\WINDOWS\System32\rs32net.exe
O4 - HKLM\..\Run: [Microsoft(R) System Manager] C:\WINDOWS\system32\sysmgr.exe
O4 - HKLM\..\Run: [C:\WINDOWS\system32\kdbpk.exe] C:\WINDOWS\system32\kdbpk.exe
O4 - HKCU\..\Run: [xsjfn83jkemfofght] C:\DOCUME~1\Teresa\LOCALS~1\Temp\winlogin.exe
O4 - HKCU\..\Run: [rs32net] C:\WINDOWS\System32\rs32net.exe
O4 - HKCU\..\Run: [gadcom] "C:\Documents and Settings\Teresa\Application Data\gadcom\gadcom.exe"

Unknown, but suspicious
O4 - HKLM\..\Run: [C:\WINDOWS\system32\kdbpk.exe] C:\WINDOWS\system32\kdbpk.exe


O17 - HKLM\System\CCS\Services\Tcpip\..\{02183E60-BE26-4F42-9EDA-8A4AAD4F0D10}: NameServer = 85.255.112.100;85.255.112.217
O17 - HKLM\System\CCS\Services\Tcpip\..\{A7C31FFE-7CD0-4146-88BF-06D13EA1210C}: NameServer = 85.255.112.100;85.255.112.217
O17 - HKLM\System\CS1\Services\Tcpip\..\{02183E60-BE26-4F42-9EDA-8A4AAD4F0D10}: NameServer = 85.255.112.100;85.255.112.217

O22 - SharedTaskScheduler: mcb7uehuj3n8weuhejsw - {C5BF49A2-94F3-42BD-F434-3604812C897D} –
C:\WINDOWS\system32\jsne87fidgf.dll

Log contains extra information citing other HJT scans

Restart the computer. Re-scan with HJT.

Follow the 8-steps if possible. Post logs as you are able. Report progress & re-state symptoms, as they may change.
 
Status
Not open for further replies.
Back